From 334032b1851ef6b9f5af2098ea92c06f523c1f88 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:09:28 +0100 Subject: [PATCH 01/17] feat: add ECK compatibility scraper --- utils/compatibility/scrapers/eck-operator.py | 107 +++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 utils/compatibility/scrapers/eck-operator.py diff --git a/utils/compatibility/scrapers/eck-operator.py b/utils/compatibility/scrapers/eck-operator.py new file mode 100644 index 0000000000..2613b1cf78 --- /dev/null +++ b/utils/compatibility/scrapers/eck-operator.py @@ -0,0 +1,107 @@ +from __future__ import annotations + +import re +from collections import OrderedDict + +from packaging.version import InvalidVersion, Version + +from utils import fetch_page, get_chart_versions, update_compatibility_info + +app_name = "eck-operator" +README_URL = "https://raw.githubusercontent.com/elastic/cloud-on-k8s/v{version}/README.md" +MIN_MAJOR = 3 + + +def parse_kube_range(markdown: str) -> list[str]: + match = re.search( + r"^\s*[*-]\s+Kubernetes\s+1\.(\d+)\s*-\s*1\.(\d+)\s*$", + markdown, + re.MULTILINE, + ) + if not match: + raise ValueError("ECK Kubernetes support range not found") + + start, end = map(int, match.groups()) + if start > end: + raise ValueError("ECK Kubernetes support range is reversed") + + return [f"1.{minor}" for minor in range(end, start - 1, -1)] + + +def latest_chart_per_minor(chart_versions: dict[str, str]) -> list[tuple[str, str]]: + latest: dict[tuple[int, int], tuple[Version, str]] = {} + + for app_version, chart_version in chart_versions.items(): + try: + parsed = Version(app_version) + except InvalidVersion: + continue + + if parsed.is_prerelease or parsed.is_devrelease or parsed.major < MIN_MAJOR: + continue + + key = (parsed.major, parsed.minor) + current = latest.get(key) + if current is None or parsed > current[0]: + latest[key] = (parsed, chart_version) + + return [ + (str(parsed), chart_version) + for parsed, chart_version in sorted( + latest.values(), + key=lambda item: item[0], + reverse=True, + ) + ] + + +def build_rows( + chart_versions: dict[str, str], + fetcher=fetch_page, +) -> list[OrderedDict[str, object]]: + candidates = latest_chart_per_minor(chart_versions) + if not candidates: + raise ValueError("No supported ECK Helm releases found") + + rows: list[OrderedDict[str, object]] = [] + for version, chart_version in candidates: + url = README_URL.format(version=version) + content = fetcher(url) + if not content: + raise ValueError(f"Could not fetch ECK {version} README") + + if isinstance(content, bytes): + try: + markdown = content.decode("utf-8") + except UnicodeDecodeError as exc: + raise ValueError(f"Could not decode ECK {version} README") from exc + elif isinstance(content, str): + markdown = content + else: + raise ValueError(f"Unexpected ECK {version} README payload") + + rows.append( + OrderedDict( + [ + ("version", version), + ("kube", parse_kube_range(markdown)), + ("chart_version", chart_version), + ("requirements", []), + ("incompatibilities", []), + ] + ) + ) + + return rows + + +def scrape() -> None: + chart_versions = get_chart_versions(app_name) + if not chart_versions: + raise ValueError("No official ECK Helm releases found") + + rows = build_rows(chart_versions) + update_compatibility_info( + f"../../static/compatibilities/{app_name}.yaml", + rows, + ) From f05204c46005b0c05d33c2cf39a5405a9054f099 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:09:51 +0100 Subject: [PATCH 02/17] test: cover ECK compatibility scraper --- .../compatibility/tests/test_eck_operator.py | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 utils/compatibility/tests/test_eck_operator.py diff --git a/utils/compatibility/tests/test_eck_operator.py b/utils/compatibility/tests/test_eck_operator.py new file mode 100644 index 0000000000..9320a0600e --- /dev/null +++ b/utils/compatibility/tests/test_eck_operator.py @@ -0,0 +1,118 @@ +import importlib.util +from pathlib import Path +from types import ModuleType +import sys +import unittest +from unittest.mock import Mock, patch + +helpers = ModuleType("utils") +helpers.fetch_page = Mock() +helpers.get_chart_versions = Mock() +helpers.update_compatibility_info = Mock() +sys.modules["utils"] = helpers + +SCRAPER_PATH = Path(__file__).parents[1] / "scrapers" / "eck-operator.py" +spec = importlib.util.spec_from_file_location("eck_operator", SCRAPER_PATH) +scraper = importlib.util.module_from_spec(spec) +spec.loader.exec_module(scraper) + + +def readme(kube_range: str) -> bytes: + return f"""# Elastic Cloud on Kubernetes (ECK) + +Supported versions: + +* Kubernetes {kube_range} +* OpenShift 4.16-4.22 +""".encode("utf-8") + + +class EckOperatorTests(unittest.TestCase): + def test_parses_kubernetes_range_descending(self): + self.assertEqual( + scraper.parse_kube_range(readme("1.32-1.36").decode()), + ["1.36", "1.35", "1.34", "1.33", "1.32"], + ) + + def test_accepts_whitespace_around_range_separator(self): + self.assertEqual( + scraper.parse_kube_range(readme("1.31 - 1.35").decode()), + ["1.35", "1.34", "1.33", "1.32", "1.31"], + ) + + def test_missing_kubernetes_range_fails_closed(self): + with self.assertRaisesRegex(ValueError, "support range not found"): + scraper.parse_kube_range("# ECK\n* OpenShift 4.16-4.22") + + def test_reversed_range_fails_closed(self): + with self.assertRaisesRegex(ValueError, "reversed"): + scraper.parse_kube_range(readme("1.36-1.32").decode()) + + def test_latest_patch_per_minor_and_legacy_filter(self): + charts = { + "3.5.0": "3.5.0", + "3.4.0": "3.4.0", + "3.4.1": "3.4.1", + "3.3.2": "3.3.2", + "3.6.0-beta1": "3.6.0-beta1", + "2.16.0": "2.16.0", + "not-a-version": "x", + } + self.assertEqual( + scraper.latest_chart_per_minor(charts), + [ + ("3.5.0", "3.5.0"), + ("3.4.1", "3.4.1"), + ("3.3.2", "3.3.2"), + ], + ) + + def test_build_rows_uses_tagged_release_readmes(self): + charts = {"3.5.0": "3.5.0", "3.4.1": "3.4.1"} + payloads = { + scraper.README_URL.format(version="3.5.0"): readme("1.32-1.36"), + scraper.README_URL.format(version="3.4.1"): readme("1.31-1.36"), + } + + rows = scraper.build_rows(charts, payloads.get) + + self.assertEqual([row["version"] for row in rows], ["3.5.0", "3.4.1"]) + self.assertEqual(rows[0]["kube"], ["1.36", "1.35", "1.34", "1.33", "1.32"]) + self.assertEqual(rows[1]["chart_version"], "3.4.1") + + def test_missing_tagged_readme_fails_closed(self): + with self.assertRaisesRegex(ValueError, "Could not fetch"): + scraper.build_rows({"3.5.0": "3.5.0"}, lambda _: None) + + def test_invalid_utf8_fails_closed(self): + with self.assertRaisesRegex(ValueError, "Could not decode"): + scraper.build_rows({"3.5.0": "3.5.0"}, lambda _: b"\xff") + + def test_scrape_connects_helm_versions_to_shared_updater(self): + charts = {"3.5.0": "3.5.0"} + with ( + patch.object(scraper, "get_chart_versions", return_value=charts) as get_charts, + patch.object(scraper, "fetch_page", return_value=readme("1.32-1.36")), + patch.object(scraper, "update_compatibility_info") as update, + ): + original = scraper.build_rows + + def wired(chart_versions): + return original(chart_versions, scraper.fetch_page) + + with patch.object(scraper, "build_rows", side_effect=wired): + scraper.scrape() + + get_charts.assert_called_once_with("eck-operator") + path, rows = update.call_args.args + self.assertEqual(path, "../../static/compatibilities/eck-operator.yaml") + self.assertEqual(rows[0]["version"], "3.5.0") + + def test_scrape_rejects_empty_helm_mapping(self): + with patch.object(scraper, "get_chart_versions", return_value={}): + with self.assertRaisesRegex(ValueError, "No official ECK Helm"): + scraper.scrape() + + +if __name__ == "__main__": + unittest.main() From 8f2a53711c84ed48c7315f3b1399bced7bb202e7 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:10:04 +0100 Subject: [PATCH 03/17] data: add ECK compatibility metadata --- static/compatibilities/eck-operator.yaml | 42 ++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 static/compatibilities/eck-operator.yaml diff --git a/static/compatibilities/eck-operator.yaml b/static/compatibilities/eck-operator.yaml new file mode 100644 index 0000000000..b47732e767 --- /dev/null +++ b/static/compatibilities/eck-operator.yaml @@ -0,0 +1,42 @@ +icon: https://helm.elastic.co/icons/eck.png +git_url: https://github.com/elastic/cloud-on-k8s +release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} +helm_repository_url: https://helm.elastic.co +versions: +- version: 3.5.0 + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + chart_version: 3.5.0 + requirements: [] + incompatibilities: [] + summary: null +- version: 3.4.1 + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] + chart_version: 3.4.1 + requirements: [] + incompatibilities: [] + summary: null +- version: 3.3.2 + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + chart_version: 3.3.2 + requirements: [] + incompatibilities: [] + summary: null +- version: 3.2.0 + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] + chart_version: 3.2.0 + requirements: [] + incompatibilities: [] + summary: null +- version: 3.1.0 + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + chart_version: 3.1.0 + requirements: [] + incompatibilities: [] + summary: null +- version: 3.0.0 + kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] + chart_version: 3.0.0 + requirements: [] + incompatibilities: [] + summary: null +name: eck-operator From f31c27f5874b8fbc1875c91808a46ed3acb7aa70 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:10:23 +0100 Subject: [PATCH 04/17] manifest: register ECK operator --- static/compatibilities/manifest.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/static/compatibilities/manifest.yaml b/static/compatibilities/manifest.yaml index 6d325d796f..6edfc83601 100644 --- a/static/compatibilities/manifest.yaml +++ b/static/compatibilities/manifest.yaml @@ -49,3 +49,4 @@ names: - wiz-sensor - wiz-admission-controller - wiz-network-analyzer +- eck-operator From 286bfcab49bf974d8f55f5348958d7402478d99e Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:23:01 +0100 Subject: [PATCH 05/17] test: isolate ECK scraper utils stub --- .../compatibility/tests/test_eck_operator.py | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/utils/compatibility/tests/test_eck_operator.py b/utils/compatibility/tests/test_eck_operator.py index 9320a0600e..878b205589 100644 --- a/utils/compatibility/tests/test_eck_operator.py +++ b/utils/compatibility/tests/test_eck_operator.py @@ -9,12 +9,22 @@ helpers.fetch_page = Mock() helpers.get_chart_versions = Mock() helpers.update_compatibility_info = Mock() -sys.modules["utils"] = helpers -SCRAPER_PATH = Path(__file__).parents[1] / "scrapers" / "eck-operator.py" -spec = importlib.util.spec_from_file_location("eck_operator", SCRAPER_PATH) -scraper = importlib.util.module_from_spec(spec) -spec.loader.exec_module(scraper) +# The scraper imports its helpers from a top-level `utils` module. Keep that +# temporary stub strictly scoped to module loading so this test cannot affect +# compatibility tests imported later in the same unittest discovery process. +_original_utils = sys.modules.get("utils") +sys.modules["utils"] = helpers +try: + SCRAPER_PATH = Path(__file__).parents[1] / "scrapers" / "eck-operator.py" + spec = importlib.util.spec_from_file_location("eck_operator", SCRAPER_PATH) + scraper = importlib.util.module_from_spec(spec) + spec.loader.exec_module(scraper) +finally: + if _original_utils is None: + sys.modules.pop("utils", None) + else: + sys.modules["utils"] = _original_utils def readme(kube_range: str) -> bytes: From 462c9b77b17da5e0c2476a7bd4e453cee53f0496 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:28:10 +0100 Subject: [PATCH 06/17] ci: regenerate ECK compatibility aggregate --- .../workflows/eck-regenerate-aggregate.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/eck-regenerate-aggregate.yml diff --git a/.github/workflows/eck-regenerate-aggregate.yml b/.github/workflows/eck-regenerate-aggregate.yml new file mode 100644 index 0000000000..d95a1e7853 --- /dev/null +++ b/.github/workflows/eck-regenerate-aggregate.yml @@ -0,0 +1,46 @@ +name: Regenerate ECK compatibility aggregate + +on: + push: + branches: + - feat/eck-operator-compatibility + paths: + - '.github/workflows/eck-regenerate-aggregate.yml' + +permissions: + contents: write + +jobs: + regenerate: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + ref: feat/eck-operator-compatibility + - uses: actions/setup-python@v6 + with: + python-version: '3.13' + - run: pip install pyyaml + - name: Regenerate aggregate + run: | + python - <<'PY' + import yaml + from pathlib import Path + + aggregate_path = Path('static/compatibilities.yaml') + addon_path = Path('static/compatibilities/eck-operator.yaml') + aggregate = yaml.safe_load(aggregate_path.read_text()) or {'addons': []} + addon = yaml.safe_load(addon_path.read_text()) + addon['name'] = 'eck-operator' + aggregate['addons'] = [a for a in aggregate.get('addons', []) if a.get('name') != 'eck-operator'] + aggregate['addons'].append(addon) + aggregate_path.write_text(yaml.dump(aggregate, default_flow_style=False, sort_keys=False)) + PY + - name: Commit aggregate + run: | + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add static/compatibilities.yaml + git diff --cached --quiet && exit 0 + git commit -m 'chore: regenerate compatibility aggregate for ECK' + git push origin HEAD:feat/eck-operator-compatibility From 26f7ce383bcb942291e6a6941d9a475367c19c94 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:28:33 +0000 Subject: [PATCH 07/17] chore: regenerate compatibility aggregate for ECK --- static/compatibilities.yaml | 40309 ++++++++++++++++++++++------------ 1 file changed, 25881 insertions(+), 14428 deletions(-) diff --git a/static/compatibilities.yaml b/static/compatibilities.yaml index 61ed8195ae..46ebf66b78 100644 --- a/static/compatibilities.yaml +++ b/static/compatibilities.yaml @@ -5,32 +5,44 @@ addons: readme_url: https://github.com/kubevirt/sig-release/blob/main/releases/k8s-support-matrix.md versions: - version: 1.9.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null - version: 1.8.4 - kube: ['1.35', '1.34'] + kube: + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null - version: 1.7.4 - kube: ['1.34'] + kube: + - '1.34' requirements: [] incompatibilities: [] summary: null - version: 1.6.6 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null - version: 1.5.3 - kube: ['1.32', '1.31'] + kube: + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null - version: 1.4.1 - kube: ['1.31'] + kube: + - '1.31' requirements: [] incompatibilities: [] summary: null @@ -41,142 +53,200 @@ addons: helm_repository_url: https://argoproj.github.io/argo-helm versions: - version: 1.8.3 - kube: ['1.34', '1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No Helm chart changelog was provided in the notes you pasted\ - \ (only application GitHub release notes). Treat this as an application-only\ - \ summary; verify the Helm chart version you\u2019ll deploy and diff `values.yaml`\ - \ separately."] - features: ['Prometheus metric provider: adds range query support, enabling analyses - over a time range instead of single-point queries.', 'Analysis/New Relic: - can now set a timeout and the provider returns the resolved query as metadata - (useful for debugging/traceability).', 'Datadog metric provider: supports - multi-account configurations and adds support for providing credentials - to download plugins.', 'Controller: adds an (alpha) canary steps plugin - mechanism for extending canary step behavior.', 'Controller: canary ingress - support allows specifying full annotations for nginx canary ingresses (more - flexibility for NGINX users).', 'Controller: enables pprof profiling support - for debugging performance issues.', 'Analysis: adds ConsecutiveSuccessLimit - to Analysis (lets you require N consecutive successful measurements).', - 'Metrics/observability: new Prometheus `build_info` metric is emitted.'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No Helm chart changelog was provided in the notes you pasted (only application\ + \ GitHub release notes). Treat this as an application-only summary; verify\ + \ the Helm chart version you\u2019ll deploy and diff `values.yaml` separately." + features: + - 'Prometheus metric provider: adds range query support, enabling analyses over + a time range instead of single-point queries.' + - 'Analysis/New Relic: can now set a timeout and the provider returns the resolved + query as metadata (useful for debugging/traceability).' + - 'Datadog metric provider: supports multi-account configurations and adds support + for providing credentials to download plugins.' + - 'Controller: adds an (alpha) canary steps plugin mechanism for extending canary + step behavior.' + - 'Controller: canary ingress support allows specifying full annotations for + nginx canary ingresses (more flexibility for NGINX users).' + - 'Controller: enables pprof profiling support for debugging performance issues.' + - 'Analysis: adds ConsecutiveSuccessLimit to Analysis (lets you require N consecutive + successful measurements).' + - 'Metrics/observability: new Prometheus `build_info` metric is emitted.' breaking_changes: [] chart_version: 2.40.5 - images: ['quay.io/argoproj/argo-rollouts:v1.8.3'] + images: + - quay.io/argoproj/argo-rollouts:v1.8.3 - version: 1.8.0 - kube: ['1.31', '1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Prometheus metric provider: adds Prometheus range query support - for Analysis metrics (enables querying over a time window instead of only - instant queries).', 'Controller: introduces an (alpha) canary steps plugin - mechanism, allowing canary step behavior/logic to be extended via plugins.', - 'Controller: allows specifying full annotations for NGINX canary ingresses - (not just limited/filtered subsets).', 'Metrics/Analysis providers: expands - New Relic provider (adds timeout support and returns resolved queries as - metadata) and adds multi-account support for Datadog metrics provider; also - adds support for providing credentials to download metric provider plugins.', - 'Observability: adds pprof profiling support in the controller for performance - troubleshooting.', 'Monitoring: adds a new Prometheus build_info metric - to expose version/build metadata.'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Prometheus metric provider: adds Prometheus range query support for Analysis + metrics (enables querying over a time window instead of only instant queries).' + - 'Controller: introduces an (alpha) canary steps plugin mechanism, allowing + canary step behavior/logic to be extended via plugins.' + - 'Controller: allows specifying full annotations for NGINX canary ingresses + (not just limited/filtered subsets).' + - 'Metrics/Analysis providers: expands New Relic provider (adds timeout support + and returns resolved queries as metadata) and adds multi-account support for + Datadog metrics provider; also adds support for providing credentials to download + metric provider plugins.' + - 'Observability: adds pprof profiling support in the controller for performance + troubleshooting.' + - 'Monitoring: adds a new Prometheus build_info metric to expose version/build + metadata.' breaking_changes: [] chart_version: 2.39.1 - images: ['quay.io/argoproj/argo-rollouts:v1.8.0'] + images: + - quay.io/argoproj/argo-rollouts:v1.8.0 - version: 1.7.0 - kube: ['1.29', '1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Support multiple ALB ingresses for ALB traffic routing (useful when - a rollout needs to manage traffic across more than one ALB resource)., 'Prometheus - metric provider enhancements: configurable request timeout, optional TLS - verification disable (insecure), and support for custom HTTP headers when - querying Prometheus.', 'AnalysisRun/AnalysisTemplate enhancements: support - custom metadata on AnalysisRun, allow setting job metadata via metrics.provider.job.metadata, - include Rollout selector MatchLabels in generated AnalysisRuns, and add - a merge key to AnalysisTemplate.', 'UI/UX: refreshed Rollouts dashboard.', - 'Events/notifications: controller can emit Kubernetes events on informer add; - adds self-service notification support.'] - breaking_changes: ['No explicit breaking changes were called out in the provided - notes for v1.7.0; however, verify any custom traffic router plugins and - ALB configuration fields against your current manifests because several - ALB-related behaviors changed in 1.7.0.'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Support multiple ALB ingresses for ALB traffic routing (useful when a rollout + needs to manage traffic across more than one ALB resource). + - 'Prometheus metric provider enhancements: configurable request timeout, optional + TLS verification disable (insecure), and support for custom HTTP headers when + querying Prometheus.' + - 'AnalysisRun/AnalysisTemplate enhancements: support custom metadata on AnalysisRun, + allow setting job metadata via metrics.provider.job.metadata, include Rollout + selector MatchLabels in generated AnalysisRuns, and add a merge key to AnalysisTemplate.' + - 'UI/UX: refreshed Rollouts dashboard.' + - 'Events/notifications: controller can emit Kubernetes events on informer add; + adds self-service notification support.' + breaking_changes: + - No explicit breaking changes were called out in the provided notes for v1.7.0; + however, verify any custom traffic router plugins and ALB configuration fields + against your current manifests because several ALB-related behaviors changed + in 1.7.0. chart_version: 2.36.0 - images: ['quay.io/argoproj/argo-rollouts:v1.7.0'] + images: + - quay.io/argoproj/argo-rollouts:v1.7.0 - version: 1.6.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No Helm chart changelog/values information was provided in\ - \ the notes you pasted (these are Argo Rollouts *application* release notes).\ - \ Treat the Helm upgrade as potentially requiring chart value review (RBAC,\ - \ container args, extraVolumes/extraArgs, dashboard/service) but confirm\ - \ against the chart\u2019s own CHANGELOG/values.yaml for the versions you\u2019\ - re moving between."] - features: [Dashboard UI refresh in v1.6.0 improves Rollouts dashboard look/UX., - 'AnalysisRun supports custom metadata, plus additional context/merge behavior - (e.g., merge key) to help manage metric/analysis configuration.', 'Prometheus - metric provider enhancements: configurable timeout, optional insecure TLS, - and support for custom HTTP headers.', 'Traffic routing/ingress improvements: - support multiple ALB ingresses and retain TLS config for NGINX canary ingresses; - additional docs/plugins for routers like Contour and guidance for other - ingress controllers.', 'Operational/observability improvements: controller - emits additional Kubernetes events and logging improvements (klog/logrus - bridge).'] - breaking_changes: ['Traffic router plugin naming pattern was standardized/changed; - if you use trafficrouter plugins (or custom plugins), verify plugin names/identifiers - and update any references accordingly.'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No Helm chart changelog/values information was provided in the notes you\ + \ pasted (these are Argo Rollouts *application* release notes). Treat the\ + \ Helm upgrade as potentially requiring chart value review (RBAC, container\ + \ args, extraVolumes/extraArgs, dashboard/service) but confirm against the\ + \ chart\u2019s own CHANGELOG/values.yaml for the versions you\u2019re moving\ + \ between." + features: + - Dashboard UI refresh in v1.6.0 improves Rollouts dashboard look/UX. + - AnalysisRun supports custom metadata, plus additional context/merge behavior + (e.g., merge key) to help manage metric/analysis configuration. + - 'Prometheus metric provider enhancements: configurable timeout, optional insecure + TLS, and support for custom HTTP headers.' + - 'Traffic routing/ingress improvements: support multiple ALB ingresses and + retain TLS config for NGINX canary ingresses; additional docs/plugins for + routers like Contour and guidance for other ingress controllers.' + - 'Operational/observability improvements: controller emits additional Kubernetes + events and logging improvements (klog/logrus bridge).' + breaking_changes: + - Traffic router plugin naming pattern was standardized/changed; if you use + trafficrouter plugins (or custom plugins), verify plugin names/identifiers + and update any references accordingly. chart_version: 2.32.0 - images: ['quay.io/argoproj/argo-rollouts:v1.6.0'] + images: + - quay.io/argoproj/argo-rollouts:v1.6.0 - version: 1.2.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No Helm chart changelog was provided in the notes; summary\ - \ below covers application/controller changes only. If you are upgrading\ - \ via Helm, also review the chart\u2019s own CHANGELOG/values for your chart\ - \ version bump (image tag, CRDs install/upgrade behavior, RBAC, ServiceAccount,\ - \ leaderElection settings, ingress apiVersion handling)."] - features: ['HA (active-passive) leader election support for rollouts-controller, - enabling higher availability controller deployments.', 'Networking.k8s.io/v1 - Ingress support (Kubernetes v1.22+), improving compatibility with newer - clusters.', "Analysis \u201Cdry-run\u201D mode (also for experiments), allowing\ - \ you to validate analysis definitions without enforcing failures.", Support - for weighted experiment steps and richer experiment traffic routing behavior., - Ping-pong service management to simplify blue/green-style service swapping - patterns., 'Customizable metric/measurement retention limits for AnalysisRuns/metrics, - improving resource usage control.', AWS App Mesh traffic routing support - as an additional provider., Support for multiple traffic routing providers - simultaneously via multiple TrafficRoutingReconcilers., 'Web metric providers - now support POST/PUT requests (not just GET), enabling more flexible integrations.', - Additional metadata surfaced from analysis providers (useful for debugging) - and Argo Rollouts version exported on the /metrics endpoint., Scalability/performance - improvements including higher default Kubernetes client QPS/Burst (and making - them tunable).] - breaking_changes: ['Canary rollout calculation/approximation behavior was changed - to improve accuracy and to honor maxSurge (marked as a breaking fix in the - release notes). This can change how many pods are created at each step compared - to v1.1, so watch capacity and rollout pacing during the first upgrades.'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No Helm chart changelog was provided in the notes; summary below covers application/controller\ + \ changes only. If you are upgrading via Helm, also review the chart\u2019\ + s own CHANGELOG/values for your chart version bump (image tag, CRDs install/upgrade\ + \ behavior, RBAC, ServiceAccount, leaderElection settings, ingress apiVersion\ + \ handling)." + features: + - HA (active-passive) leader election support for rollouts-controller, enabling + higher availability controller deployments. + - Networking.k8s.io/v1 Ingress support (Kubernetes v1.22+), improving compatibility + with newer clusters. + - "Analysis \u201Cdry-run\u201D mode (also for experiments), allowing you to\ + \ validate analysis definitions without enforcing failures." + - Support for weighted experiment steps and richer experiment traffic routing + behavior. + - Ping-pong service management to simplify blue/green-style service swapping + patterns. + - Customizable metric/measurement retention limits for AnalysisRuns/metrics, + improving resource usage control. + - AWS App Mesh traffic routing support as an additional provider. + - Support for multiple traffic routing providers simultaneously via multiple + TrafficRoutingReconcilers. + - Web metric providers now support POST/PUT requests (not just GET), enabling + more flexible integrations. + - Additional metadata surfaced from analysis providers (useful for debugging) + and Argo Rollouts version exported on the /metrics endpoint. + - Scalability/performance improvements including higher default Kubernetes client + QPS/Burst (and making them tunable). + breaking_changes: + - Canary rollout calculation/approximation behavior was changed to improve accuracy + and to honor maxSurge (marked as a breaking fix in the release notes). This + can change how many pods are created at each step compared to v1.1, so watch + capacity and rollout pacing during the first upgrades. chart_version: 2.12.0 - images: ['quay.io/argoproj/argo-rollouts:v1.2.0'] + images: + - quay.io/argoproj/argo-rollouts:v1.2.0 - version: 1.1.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: ['quay.io/argoproj/argo-rollouts:v1.1.0'] + images: + - quay.io/argoproj/argo-rollouts:v1.1.0 name: argo-rollouts - icon: https://kubernetes.io/images/blog-logging/2018-04-10-container-storage-interface-beta/csi-logo.png git_url: https://github.com/kubernetes-sigs/aws-ebs-csi-driver @@ -184,776 +254,1535 @@ addons: helm_repository_url: https://kubernetes-sigs.github.io/aws-ebs-csi-driver versions: - version: 1.65.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific features are listed in the provided v1.65.0 release notes - snippet; it only links to the upstream CHANGELOG for details.] - breaking_changes: [No breaking changes are listed in the provided v1.65.0 release - notes snippet; you need to review the upstream CHANGELOG for any behavior/config - changes between v1.64.0 and v1.65.0.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific features are listed in the provided v1.65.0 release notes snippet; + it only links to the upstream CHANGELOG for details. + breaking_changes: + - No breaking changes are listed in the provided v1.65.0 release notes snippet; + you need to review the upstream CHANGELOG for any behavior/config changes + between v1.64.0 and v1.65.0. chart_version: 2.65.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.7', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.7', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.6', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.5', - 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.7', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.65.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.7 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.7 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.6 + - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.5 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.7 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.65.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master - version: 1.64.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature details provided in the supplied release notes - for v1.64.0; they only point to the upstream CHANGELOG.md.] - breaking_changes: [No breaking changes are mentioned in the supplied release - notes; details (if any) would be in the upstream CHANGELOG.md.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature details provided in the supplied release notes for v1.64.0; + they only point to the upstream CHANGELOG.md. + breaking_changes: + - No breaking changes are mentioned in the supplied release notes; details (if + any) would be in the upstream CHANGELOG.md. chart_version: 2.64.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.64.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.64.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master - version: 1.63.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not enumerate changes; both versions only - link to the upstream CHANGELOG.] - breaking_changes: ['Unknown from provided notes; need to review upstream CHANGELOG - between v1.62.0 and v1.63.0 (and Helm chart changelog, if using the Helm - chart) to confirm any breaking changes.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not enumerate changes; both versions only link to + the upstream CHANGELOG. + breaking_changes: + - Unknown from provided notes; need to review upstream CHANGELOG between v1.62.0 + and v1.63.0 (and Helm chart changelog, if using the Helm chart) to confirm + any breaking changes. chart_version: 2.63.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.1', - 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.63.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260720-39d457d26c-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.1 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.3 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.63.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260720-39d457d26c-master - version: 1.62.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not include any v1.62.0 change entries - beyond a link to the full CHANGELOG; no specific new features can be extracted - from the text shared.] - breaking_changes: [No breaking changes are mentioned in the provided release - notes; full upstream CHANGELOG must be reviewed to confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not include any v1.62.0 change entries beyond a + link to the full CHANGELOG; no specific new features can be extracted from + the text shared. + breaking_changes: + - No breaking changes are mentioned in the provided release notes; full upstream + CHANGELOG must be reviewed to confirm. chart_version: 2.62.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1', 'public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2', - 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.62.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260615-b4199512ce-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1 + - public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.62.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260615-b4199512ce-master - version: 1.61.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided contain no detailed changes; both versions - point to the repository CHANGELOG for details.] - breaking_changes: [No breaking changes are described in the provided release - notes; must review the upstream CHANGELOG between v1.60.0 and v1.61.1 to - confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided contain no detailed changes; both versions point to + the repository CHANGELOG for details. + breaking_changes: + - No breaking changes are described in the provided release notes; must review + the upstream CHANGELOG between v1.60.0 and v1.61.1 to confirm. chart_version: 2.61.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7', 'public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2', - 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.61.1', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260601-2cbf4bdb47-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7 + - public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.61.1 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260601-2cbf4bdb47-master - version: 1.60.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include any itemized changes;\ - \ v1.60.0 points to the upstream CHANGELOG for details."] - breaking_changes: [No breaking changes are stated in the provided release notes; - need the upstream CHANGELOG diff between v1.59.0 and v1.60.0 to confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include any itemized changes; v1.60.0 points\ + \ to the upstream CHANGELOG for details." + breaking_changes: + - No breaking changes are stated in the provided release notes; need the upstream + CHANGELOG diff between v1.59.0 and v1.60.0 to confirm. chart_version: 2.60.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.5', - 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.60.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260512-1f34ef0df3-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.5 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.60.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260512-1f34ef0df3-master - version: 1.59.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific features were included in the provided v1.59.0 release - note excerpt; it only links to the upstream CHANGELOG for details.] - breaking_changes: [No breaking changes were listed in the provided release note - excerpt; you must review the upstream CHANGELOG between v1.58.0 and v1.59.0 - to confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific features were included in the provided v1.59.0 release note excerpt; + it only links to the upstream CHANGELOG for details. + breaking_changes: + - No breaking changes were listed in the provided release note excerpt; you + must review the upstream CHANGELOG between v1.58.0 and v1.59.0 to confirm. chart_version: 2.59.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.59.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260414-5a49ebcf1f-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.59.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260414-5a49ebcf1f-master - version: 1.58.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature details provided in the supplied release notes - for v1.58.0 (only a link to the upstream CHANGELOG).] - breaking_changes: [No breaking change details provided in the supplied release - notes for v1.58.0 (only a link to the upstream CHANGELOG).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature details provided in the supplied release notes for v1.58.0 + (only a link to the upstream CHANGELOG). + breaking_changes: + - No breaking change details provided in the supplied release notes for v1.58.0 + (only a link to the upstream CHANGELOG). chart_version: 2.58.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.58.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.58.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master - version: 1.57.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes between\ - \ v1.56.0 and v1.57.1; they only point to the upstream CHANGELOG. No concrete\ - \ new features can be derived from the supplied text."] - breaking_changes: ['No breaking changes are listed in the provided release notes; - they only reference the upstream CHANGELOG, so breaking changes (if any) - cannot be confirmed from the supplied data.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include itemized changes between v1.56.0\ + \ and v1.57.1; they only point to the upstream CHANGELOG. No concrete new\ + \ features can be derived from the supplied text." + breaking_changes: + - No breaking changes are listed in the provided release notes; they only reference + the upstream CHANGELOG, so breaking changes (if any) cannot be confirmed from + the supplied data. chart_version: 2.57.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.57.1', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.57.1 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master - version: 1.56.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific v1.56.0 features provided in the supplied notes; release - notes only link to the upstream CHANGELOG.] - breaking_changes: [No breaking changes identified from the provided notes; must - review the upstream CHANGELOG for v1.56.0 to confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific v1.56.0 features provided in the supplied notes; release notes + only link to the upstream CHANGELOG. + breaking_changes: + - No breaking changes identified from the provided notes; must review the upstream + CHANGELOG for v1.56.0 to confirm. chart_version: 2.56.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.1', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.1', - 'public.ecr.aws/csi-components/csi-provisioner:v6.1.1-eksbuild.1', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.1', - 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.1', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.56.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260217-29ba10ecec-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.1 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.1 + - public.ecr.aws/csi-components/csi-provisioner:v6.1.1-eksbuild.1 + - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.1 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.1 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.56.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260217-29ba10ecec-master - version: 1.55.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t list specific changes; both versions\ - \ point to the upstream CHANGELOG for details."] - breaking_changes: ["Cannot determine breaking changes from the provided notes\ - \ because the detailed CHANGELOG content wasn\u2019t included."] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t list specific changes; both versions point\ + \ to the upstream CHANGELOG for details." + breaking_changes: + - "Cannot determine breaking changes from the provided notes because the detailed\ + \ CHANGELOG content wasn\u2019t included." chart_version: 2.55.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.55.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260120-e2c483ffe9-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.4 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.55.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260120-e2c483ffe9-master - version: 1.54.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not include detailed changes; both versions - point to the upstream CHANGELOG for the full list of changes.] - breaking_changes: [Potential breaking changes cannot be determined from the - provided notes because no detailed changelog entries were included. Review - the upstream CHANGELOG between v1.53.0 and v1.54.0 before upgrading.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not include detailed changes; both versions point + to the upstream CHANGELOG for the full list of changes. + breaking_changes: + - Potential breaking changes cannot be determined from the provided notes because + no detailed changelog entries were included. Review the upstream CHANGELOG + between v1.53.0 and v1.54.0 before upgrading. chart_version: 2.54.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.54.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251209-855adc2699-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.54.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251209-855adc2699-master - version: 1.53.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature details provided in the supplied release notes - for v1.53.0; consult the project CHANGELOG.md between v1.52.0 and v1.53.0 - for the actual set of enhancements.] - breaking_changes: [No breaking changes were listed in the supplied release notes; - verify in CHANGELOG.md and the Helm chart changelog before upgrading.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature details provided in the supplied release notes for v1.53.0; + consult the project CHANGELOG.md between v1.52.0 and v1.53.0 for the actual + set of enhancements. + breaking_changes: + - No breaking changes were listed in the supplied release notes; verify in CHANGELOG.md + and the Helm chart changelog before upgrading. chart_version: 2.53.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.53.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251021-e2c2c9806f-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.5 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.53.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251021-e2c2c9806f-master - version: 1.52.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature notes were included in the provided release notes; - they only reference the upstream CHANGELOG for details.] - breaking_changes: ["No breaking-change information was included in the provided\ - \ release notes; you\u2019ll need to review the upstream CHANGELOG for v1.52.0\ - \ to confirm."] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature notes were included in the provided release notes; they + only reference the upstream CHANGELOG for details. + breaking_changes: + - "No breaking-change information was included in the provided release notes;\ + \ you\u2019ll need to review the upstream CHANGELOG for v1.52.0 to confirm." chart_version: 2.52.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.52.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.52.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master - version: 1.51.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not enumerate changes; both versions only - link to the upstream CHANGELOG without details.] - breaking_changes: [Unknown from provided notes; no breaking changes listed in - the release notes excerpt (must consult upstream CHANGELOG for confirmation).] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not enumerate changes; both versions only link to + the upstream CHANGELOG without details. + breaking_changes: + - Unknown from provided notes; no breaking changes listed in the release notes + excerpt (must consult upstream CHANGELOG for confirmation). chart_version: 2.51.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.51.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.51.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master - version: 1.50.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes; only\ - \ point to the upstream CHANGELOG.md. No new features can be reliably extracted\ - \ from the provided text."] - breaking_changes: [No breaking changes are stated in the provided release notes; - need the linked CHANGELOG.md or Helm chart changelog to assess potential - breaking changes.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include itemized changes; only point to\ + \ the upstream CHANGELOG.md. No new features can be reliably extracted from\ + \ the provided text." + breaking_changes: + - No breaking changes are stated in the provided release notes; need the linked + CHANGELOG.md or Helm chart changelog to assess potential breaking changes. chart_version: 2.50.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.50.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.50.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master - version: 1.49.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No feature details were provided in the supplied release notes; both - v1.48.0 and v1.49.0 entries only link to the project CHANGELOG.] - breaking_changes: [No breaking-change details were provided in the supplied - release notes; review the upstream CHANGELOG for v1.49.0 and any intervening - commits.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No feature details were provided in the supplied release notes; both v1.48.0 + and v1.49.0 entries only link to the project CHANGELOG. + breaking_changes: + - No breaking-change details were provided in the supplied release notes; review + the upstream CHANGELOG for v1.49.0 and any intervening commits. chart_version: 2.49.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.49.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250905-c89b045f57-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.49.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250905-c89b045f57-master - version: 1.48.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific changes are included in the provided release notes beyond - pointers to the full CHANGELOG for v1.48.0.] - breaking_changes: [No breaking changes are stated in the provided release notes; - you must consult the upstream CHANGELOG for v1.48.0 vs v1.47.0 to confirm.] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific changes are included in the provided release notes beyond pointers + to the full CHANGELOG for v1.48.0. + breaking_changes: + - No breaking changes are stated in the provided release notes; you must consult + the upstream CHANGELOG for v1.48.0 vs v1.47.0 to confirm. chart_version: 2.48.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.48.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250815-171060767f-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.48.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250815-171060767f-master - version: 1.47.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature details were provided in the supplied release - notes for v1.47.0 (they only link to the main CHANGELOG).] - breaking_changes: [No breaking-change details were provided in the supplied - release notes for v1.47.0 (they only link to the main CHANGELOG).] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature details were provided in the supplied release notes for + v1.47.0 (they only link to the main CHANGELOG). + breaking_changes: + - No breaking-change details were provided in the supplied release notes for + v1.47.0 (they only link to the main CHANGELOG). chart_version: 2.47.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.47.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250722-31ecdfb417-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.47.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250722-31ecdfb417-master - version: 1.46.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific changes were provided in the supplied release notes; - they only link to the upstream CHANGELOG.md.] - breaking_changes: [No breaking changes were described in the supplied release - notes; review the upstream CHANGELOG.md between v1.45.0 and v1.46.0 to confirm.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific changes were provided in the supplied release notes; they only + link to the upstream CHANGELOG.md. + breaking_changes: + - No breaking changes were described in the supplied release notes; review the + upstream CHANGELOG.md between v1.45.0 and v1.46.0 to confirm. chart_version: 2.46.0 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.46.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.46.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master - version: 1.45.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No concrete feature details provided in the pasted release notes; - both v1.44.0 and v1.45.0 notes only point to the upstream CHANGELOG.] - breaking_changes: [No breaking changes can be identified from the provided notes; - the release notes contain no change details beyond a link to CHANGELOG.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No concrete feature details provided in the pasted release notes; both v1.44.0 + and v1.45.0 notes only point to the upstream CHANGELOG. + breaking_changes: + - No breaking changes can be identified from the provided notes; the release + notes contain no change details beyond a link to CHANGELOG. chart_version: 2.45.1 - images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.2', - 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.45.0', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master'] + images: + - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.2 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.3 + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.45.0 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master - version: 1.44.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific features are listed in the provided release notes for - v1.44.0; both v1.43.0 and v1.44.0 entries only point to the upstream CHANGELOG - for details.] - breaking_changes: [No breaking changes are called out in the provided release - notes; you must review the linked upstream CHANGELOG between v1.43.0 and - v1.44.0 to confirm.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific features are listed in the provided release notes for v1.44.0; + both v1.43.0 and v1.44.0 entries only point to the upstream CHANGELOG for + details. + breaking_changes: + - No breaking changes are called out in the provided release notes; you must + review the linked upstream CHANGELOG between v1.43.0 and v1.44.0 to confirm. chart_version: 2.44.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.44.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-3', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250513-98d205aae3-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.44.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-3 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-3 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-3 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-3 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250513-98d205aae3-master - version: 1.43.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Release notes provided only link to the upstream CHANGELOG; no specific - v1.43.0 changes are included here, so features cannot be reliably summarized - from the supplied text.'] - breaking_changes: [No breaking changes are mentioned in the provided release - notes; need to consult the linked CHANGELOG for v1.43.0 vs v1.42.0 details.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided only link to the upstream CHANGELOG; no specific v1.43.0 + changes are included here, so features cannot be reliably summarized from + the supplied text. + breaking_changes: + - No breaking changes are mentioned in the provided release notes; need to consult + the linked CHANGELOG for v1.43.0 vs v1.42.0 details. chart_version: 2.43.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.43.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.43.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master - version: 1.42.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes; v1.42.0\ - \ points to the upstream CHANGELOG for details."] - breaking_changes: [No breaking changes are listed in the provided notes; need - the linked CHANGELOG (or Helm chart changelog) to verify.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include itemized changes; v1.42.0 points\ + \ to the upstream CHANGELOG for details." + breaking_changes: + - No breaking changes are listed in the provided notes; need the linked CHANGELOG + (or Helm chart changelog) to verify. chart_version: 2.42.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.42.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.42.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master - version: 1.41.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific feature details were included in the provided release - notes; both v1.40.0 and v1.41.0 notes only reference the repository CHANGELOG - link.] - breaking_changes: [No breaking changes were listed in the provided release notes; - need to consult the upstream CHANGELOG between v1.40.0 and v1.41.0 to confirm.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific feature details were included in the provided release notes; both + v1.40.0 and v1.41.0 notes only reference the repository CHANGELOG link. + breaking_changes: + - No breaking changes were listed in the provided release notes; need to consult + the upstream CHANGELOG between v1.40.0 and v1.41.0 to confirm. chart_version: 2.41.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.41.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-32-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-32-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-7', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250311-73aac21714-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.41.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-32-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-32-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-7 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250311-73aac21714-master - version: 1.40.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided contain no itemized changes between v1.39.0 - and v1.40.0 (they only link to the upstream CHANGELOG).] - breaking_changes: [No breaking changes are stated in the provided release notes; - consult the upstream CHANGELOG for v1.40.0 details before upgrading.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided contain no itemized changes between v1.39.0 and v1.40.0 + (they only link to the upstream CHANGELOG). + breaking_changes: + - No breaking changes are stated in the provided release notes; consult the + upstream CHANGELOG for v1.40.0 details before upgrading. chart_version: 2.40.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.40.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-32-6', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-6', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.1-eks-1-32-6', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-6', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250212-686cf422c6-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.40.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-32-6 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-6 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.1-eks-1-32-6 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-6 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250212-686cf422c6-master - version: 1.39.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes for v1.39.0\u2014\ - only a pointer to the upstream CHANGELOG, so no concrete new features can\ - \ be confirmed from the supplied text."] - breaking_changes: [No breaking changes are listed in the provided notes; need - the actual v1.39.0 CHANGELOG diff to verify.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include itemized changes for v1.39.0\u2014\ + only a pointer to the upstream CHANGELOG, so no concrete new features can\ + \ be confirmed from the supplied text." + breaking_changes: + - No breaking changes are listed in the provided notes; need the actual v1.39.0 + CHANGELOG diff to verify. chart_version: 2.39.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.39.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-31-12', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-12', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-11', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-12', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-31-12', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241230-3006692a6f-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.39.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-31-12 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-12 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-11 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-12 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-31-12 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241230-3006692a6f-master - version: 1.38.1 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes between\ - \ v1.37.0 and v1.38.1 (they only point to the upstream CHANGELOG)."] - breaking_changes: [Unknown from the provided notes; must review the upstream - CHANGELOG entries for v1.38.1 (and intermediate tags) to identify any breaking - changes.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include itemized changes between v1.37.0\ + \ and v1.38.1 (they only point to the upstream CHANGELOG)." + breaking_changes: + - Unknown from the provided notes; must review the upstream CHANGELOG entries + for v1.38.1 (and intermediate tags) to identify any breaking changes. chart_version: 2.38.1 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.38.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-32-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-32-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-32-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-32-1', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241128-8df65c072f-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.38.1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-32-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-32-1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-32-1 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-32-1 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241128-8df65c072f-master - version: 1.37.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t enumerate changes between v1.36.0\ - \ and v1.37.0; both point to the upstream CHANGELOG for details."] - breaking_changes: [No breaking changes can be identified from the provided notes; - you must consult the upstream CHANGELOG for v1.37.0 to confirm.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t enumerate changes between v1.36.0 and v1.37.0;\ + \ both point to the upstream CHANGELOG for details." + breaking_changes: + - No breaking changes can be identified from the provided notes; you must consult + the upstream CHANGELOG for v1.37.0 to confirm. chart_version: 2.37.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.37.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-7', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241021-d3a4913879-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.37.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-7 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241021-d3a4913879-master - version: 1.36.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific features are listed in the provided release notes; both - versions point to the project CHANGELOG for details.] - breaking_changes: [No breaking changes are listed in the provided release notes; - you must consult the upstream CHANGELOG between v1.35.0 and v1.36.0 to confirm.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific features are listed in the provided release notes; both versions + point to the project CHANGELOG for details. + breaking_changes: + - No breaking changes are listed in the provided release notes; you must consult + the upstream CHANGELOG between v1.35.0 and v1.36.0 to confirm. chart_version: 2.36.0 - images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.36.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5', - 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241011-e8871c079d-master'] + images: + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.36.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 + - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241011-e8871c079d-master - version: 1.35.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include detailed change items\ - \ beyond a pointer to the upstream CHANGELOG; no specific features can be\ - \ derived from the text shared."] - breaking_changes: ["Release notes provided don\u2019t list any breaking changes;\ - \ need to review the linked CHANGELOG between v1.34.0 and v1.35.0 to confirm."] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include detailed change items beyond a\ + \ pointer to the upstream CHANGELOG; no specific features can be derived from\ + \ the text shared." + breaking_changes: + - "Release notes provided don\u2019t list any breaking changes; need to review\ + \ the linked CHANGELOG between v1.34.0 and v1.35.0 to confirm." chart_version: 2.35.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240903-6a352c5344-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.35.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-3', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-3'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240903-6a352c5344-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.35.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-3 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-3 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-3 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-3 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-3 - version: 1.34.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided only link to the full CHANGELOG; no feature-level - details are included in the supplied notes for v1.34.0.] - breaking_changes: [No breaking changes are stated in the provided release notes; - must review upstream CHANGELOG for any upgrade-impacting changes between - v1.33.0 and v1.34.0.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided only link to the full CHANGELOG; no feature-level details + are included in the supplied notes for v1.34.0. + breaking_changes: + - No breaking changes are stated in the provided release notes; must review + upstream CHANGELOG for any upgrade-impacting changes between v1.33.0 and v1.34.0. chart_version: 2.34.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240803-cf1183f2db-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.34.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240803-cf1183f2db-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.34.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10 - version: 1.33.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Release notes provided only link to the full CHANGELOG; no specific - feature items were included in the notes you shared, so features for 1.33.0 - vs 1.32.0 cannot be determined from this input.'] - breaking_changes: ['No breaking changes are mentioned in the provided release - notes; the notes only point to the upstream CHANGELOG, so breaking changes - (if any) cannot be confirmed from this input.'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided only link to the full CHANGELOG; no specific feature + items were included in the notes you shared, so features for 1.33.0 vs 1.32.0 + cannot be determined from this input. + breaking_changes: + - No breaking changes are mentioned in the provided release notes; the notes + only point to the upstream CHANGELOG, so breaking changes (if any) cannot + be confirmed from this input. chart_version: 2.33.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240705-131cd74733-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.33.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240705-131cd74733-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.33.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10 - version: 1.32.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided only link to the upstream CHANGELOG; no concrete - feature list included in the supplied notes.] - breaking_changes: [No breaking changes were described in the supplied release - notes; need to consult the upstream CHANGELOG for v1.32.0 details.] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided only link to the upstream CHANGELOG; no concrete feature + list included in the supplied notes. + breaking_changes: + - No breaking changes were described in the supplied release notes; need to + consult the upstream CHANGELOG for v1.32.0 details. chart_version: 2.32.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240611-597c402033-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.32.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-8', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-8', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-8', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-8', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-8'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240611-597c402033-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.32.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-8 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-8 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-8 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-8 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-8 - version: 1.31.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22', '1.21', '1.20'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No substantive v1.31.0 release notes were provided beyond a pointer - to the full CHANGELOG; expect mostly incremental fixes/maintenance since - v1.30.0 was the major feature release in your notes.] + features: + - No substantive v1.31.0 release notes were provided beyond a pointer to the + full CHANGELOG; expect mostly incremental fixes/maintenance since v1.30.0 + was the major feature release in your notes. breaking_changes: [] chart_version: 2.31.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.31.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-4'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.31.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-4 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-4 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-4 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-4 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-4 - version: 1.30.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Retry Manager to reduce EC2 API RateLimitExceeded errors during high - churn/scale events., Prometheus metrics endpoint can be served over HTTPS - by providing a certificate., 'Improved node drain behavior: supports Cluster - Autoscaler taint and prestop hook now handles deleted Node objects to avoid - ~6 minute attachment delays.', Migrated AWS interactions to AWS SDK for - Go v2 for continued support and newer SDK features., Batch polling for DescribeVolumesModifications - across volume modify/expand paths to reduce non-mutating API token limit - issues at scale., 'Refactored node service to be platform-agnostic, improving - modularity, testability, and code coverage.', Improved configuration management - and internal architecture (entrypoint/controller/cloud module relationships)., - Added explicit AttachVolume call during attachment-state polling to handle - EC2 eventual consistency mismatches.] - breaking_changes: ['Migration to AWS SDK for Go v2 may change behavior of AWS - credential/config resolution and retry semantics; validate IAM/IRSA, endpoints, - and any custom AWS config assumptions before/after upgrade.'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Retry Manager to reduce EC2 API RateLimitExceeded errors during high churn/scale + events. + - Prometheus metrics endpoint can be served over HTTPS by providing a certificate. + - 'Improved node drain behavior: supports Cluster Autoscaler taint and prestop + hook now handles deleted Node objects to avoid ~6 minute attachment delays.' + - Migrated AWS interactions to AWS SDK for Go v2 for continued support and newer + SDK features. + - Batch polling for DescribeVolumesModifications across volume modify/expand + paths to reduce non-mutating API token limit issues at scale. + - Refactored node service to be platform-agnostic, improving modularity, testability, + and code coverage. + - Improved configuration management and internal architecture (entrypoint/controller/cloud + module relationships). + - Added explicit AttachVolume call during attachment-state polling to handle + EC2 eventual consistency mismatches. + breaking_changes: + - Migration to AWS SDK for Go v2 may change behavior of AWS credential/config + resolution and retry semantics; validate IAM/IRSA, endpoints, and any custom + AWS config assumptions before/after upgrade. chart_version: 2.30.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.30.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-2'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.30.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-2 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-2 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-2 - version: 1.29.1 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [No specific changes listed in the provided release notes; both v1.29.0 - and v1.29.1 entries only link to the main CHANGELOG without details.] - breaking_changes: [No breaking changes identified from the provided release - notes (no details included).] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - No specific changes listed in the provided release notes; both v1.29.0 and + v1.29.1 entries only link to the main CHANGELOG without details. + breaking_changes: + - No breaking changes identified from the provided release notes (no details + included). chart_version: 2.29.1 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 - version: 1.29.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not include specific changes; both v1.28.0 - and v1.29.0 point to the repository CHANGELOG for details. No concrete features - can be derived from the pasted notes alone.] - breaking_changes: [No breaking changes are mentioned in the provided release - notes; need the linked CHANGELOG (and Helm chart changelog/values diff) - to assess potential breaking changes.] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not include specific changes; both v1.28.0 and v1.29.0 + point to the repository CHANGELOG for details. No concrete features can be + derived from the pasted notes alone. + breaking_changes: + - No breaking changes are mentioned in the provided release notes; need the + linked CHANGELOG (and Helm chart changelog/values diff) to assess potential + breaking changes. chart_version: 2.29.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 - version: 1.28.0 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', - '1.20'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided don\u2019t include specific changes; both\ - \ versions only link to the upstream CHANGELOG. No concrete feature list\ - \ can be derived from the text provided."] - breaking_changes: [Unknown from the provided release notes; need to review the - upstream CHANGELOG entries between v1.26.1 and v1.28.0 to confirm any breaking - changes.] + features: + - "Release notes provided don\u2019t include specific changes; both versions\ + \ only link to the upstream CHANGELOG. No concrete feature list can be derived\ + \ from the text provided." + breaking_changes: + - Unknown from the provided release notes; need to review the upstream CHANGELOG + entries between v1.26.1 and v1.28.0 to confirm any breaking changes. chart_version: 2.28.0 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.28.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-5'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.28.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-5 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-5 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-5 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-5 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-5 - version: 1.26.1 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided only include links to the upstream CHANGELOG - for both v1.23.1 and v1.26.1; no specific features are listed in the provided - text.] - breaking_changes: [No breaking changes are called out in the provided release - notes; you must review the upstream CHANGELOG between v1.23.1 and v1.26.1 - to confirm.] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided only include links to the upstream CHANGELOG for both + v1.23.1 and v1.26.1; no specific features are listed in the provided text. + breaking_changes: + - No breaking changes are called out in the provided release notes; you must + review the upstream CHANGELOG between v1.23.1 and v1.26.1 to confirm. chart_version: 2.26.1 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.26.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.3-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.3-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.26.1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.3-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.3-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2 - version: 1.23.1 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', - '1.20'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: null chart_version: 2.23.1 - images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20230727-ea685f8747-master', - 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.3.0-eks-1-28-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4'] + images: + - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20230727-ea685f8747-master + - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.3.0-eks-1-28-4 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-4 + - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4 name: aws-ebs-csi-driver - icon: https://cdn.worldvectorlogo.com/logos/amazon-elastic-file-system.svg git_url: https://github.com/kubernetes-sigs/aws-efs-csi-driver @@ -967,15 +1796,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided don\u2019t list specific changes; both versions\ - \ only point to the project CHANGELOG for details."] - breaking_changes: [No breaking changes are called out in the provided release - notes; consult CHANGELOG-3.x.md for any upgrade-impacting changes between - v3.4.0 and v3.4.2.] + features: + - "Release notes provided don\u2019t list specific changes; both versions only\ + \ point to the project CHANGELOG for details." + breaking_changes: + - No breaking changes are called out in the provided release notes; consult + CHANGELOG-3.x.md for any upgrade-impacting changes between v3.4.0 and v3.4.2. chart_version: 4.4.2 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.2'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.2 - version: 3.4.0 kube: [] requirements: [] @@ -983,14 +1815,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided don\u2019t list specific changes; v3.4.0\ - \ points to the upstream CHANGELOG-3.x.md for details."] - breaking_changes: [No breaking changes are stated in the provided notes; need - to review CHANGELOG-3.x.md between v3.3.0 and v3.4.0 to confirm.] + features: + - "Release notes provided don\u2019t list specific changes; v3.4.0 points to\ + \ the upstream CHANGELOG-3.x.md for details." + breaking_changes: + - No breaking changes are stated in the provided notes; need to review CHANGELOG-3.x.md + between v3.3.0 and v3.4.0 to confirm. chart_version: 4.4.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.0 - version: 3.3.0 kube: [] requirements: [] @@ -998,14 +1834,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No concrete feature details provided in the supplied release notes; - v3.3.0 points to the upstream CHANGELOG for the actual list of changes.] - breaking_changes: [No breaking-change information provided in the supplied release - notes; must review CHANGELOG-3.x.md between v3.2.0 and v3.3.0 to confirm.] + features: + - No concrete feature details provided in the supplied release notes; v3.3.0 + points to the upstream CHANGELOG for the actual list of changes. + breaking_changes: + - No breaking-change information provided in the supplied release notes; must + review CHANGELOG-3.x.md between v3.2.0 and v3.3.0 to confirm. chart_version: 4.3.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.3.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7 + - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.3.0 - version: 3.2.0 kube: [] requirements: [] @@ -1013,15 +1853,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No specific feature details were included in the provided release - notes; both versions only point to the upstream CHANGELOG-3.x.md.] - breaking_changes: [No breaking changes were listed in the provided release notes; - need to review CHANGELOG-3.x.md and the Helm chart changelog for v3.2.0 - to confirm.] + features: + - No specific feature details were included in the provided release notes; both + versions only point to the upstream CHANGELOG-3.x.md. + breaking_changes: + - No breaking changes were listed in the provided release notes; need to review + CHANGELOG-3.x.md and the Helm chart changelog for v3.2.0 to confirm. chart_version: 4.2.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.2.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.2.0 - version: 3.1.0 kube: [] requirements: [] @@ -1029,14 +1872,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Release notes provided do not enumerate changes; v3.1.0 points to - the CHANGELOG-3.x.md for details.] - breaking_changes: [No breaking changes are listed in the provided release notes; - must review CHANGELOG-3.x.md between v3.0.0 and v3.1.0 to confirm.] + features: + - Release notes provided do not enumerate changes; v3.1.0 points to the CHANGELOG-3.x.md + for details. + breaking_changes: + - No breaking changes are listed in the provided release notes; must review + CHANGELOG-3.x.md between v3.0.0 and v3.1.0 to confirm. chart_version: 4.1.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', - 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.1.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 + - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 + - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.1.0 - version: 3.0.0 kube: [] requirements: [] @@ -1044,16 +1891,20 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided only link to external CHANGELOG files for - v3.x and v2.x; no specific feature items were included in the supplied text, - so features cannot be enumerated from the given data.'] - breaking_changes: ['Upgrade to major version v3.0.0 likely implies breaking - changes, but none are specified in the provided release-note excerpts; consult - CHANGELOG-3.x.md for explicit breaking changes before upgrading.'] + features: + - Release notes provided only link to external CHANGELOG files for v3.x and + v2.x; no specific feature items were included in the supplied text, so features + cannot be enumerated from the given data. + breaking_changes: + - Upgrade to major version v3.0.0 likely implies breaking changes, but none + are specified in the provided release-note excerpts; consult CHANGELOG-3.x.md + for explicit breaking changes before upgrading. chart_version: 4.0.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.0.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.0.0 - version: 2.3.0 kube: [] requirements: [] @@ -1061,130 +1912,273 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided don\u2019t include itemized changes for v2.3.0;\ - \ they only point to the upstream CHANGELOG-2.x.md. No specific new features\ - \ were listed in the notes you shared."] - breaking_changes: [No breaking changes were listed in the provided release notes; - need to consult CHANGELOG-2.x.md between v2.2.0 and v2.3.0 to confirm.] + features: + - "Release notes provided don\u2019t include itemized changes for v2.3.0; they\ + \ only point to the upstream CHANGELOG-2.x.md. No specific new features were\ + \ listed in the notes you shared." + breaking_changes: + - No breaking changes were listed in the provided release notes; need to consult + CHANGELOG-2.x.md between v2.2.0 and v2.3.0 to confirm. chart_version: 3.4.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', - 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.3.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 + - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.3.0 - version: 2.2.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', - '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include the actual v2.2.0 changelog\ - \ items; only a pointer to CHANGELOG-2.x.md. No concrete new features can\ - \ be derived from the pasted text."] - breaking_changes: [No breaking changes are listed in the provided notes; need - the actual entries from CHANGELOG-2.x.md (between v2.1.2 and v2.2.0) or - the Helm chart changelog to confirm.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include the actual v2.2.0 changelog items;\ + \ only a pointer to CHANGELOG-2.x.md. No concrete new features can be derived\ + \ from the pasted text." + breaking_changes: + - No breaking changes are listed in the provided notes; need the actual entries + from CHANGELOG-2.x.md (between v2.1.2 and v2.2.0) or the Helm chart changelog + to confirm. chart_version: 3.3.0 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.2.0'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5 + - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.2.0 - version: 2.1.12 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', - '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include any concrete changes;\ - \ they only reference the upstream CHANGELOG-2.x.md for details."] - breaking_changes: [Unknown from the provided notes; the release text contains - no breaking-change information and points to the full changelog for specifics.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include any concrete changes; they only\ + \ reference the upstream CHANGELOG-2.x.md for details." + breaking_changes: + - Unknown from the provided notes; the release text contains no breaking-change + information and points to the full changelog for specifics. chart_version: 3.2.3 - images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', - 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', - 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.12'] + images: + - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 + - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 + - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.12 - version: 2.1.2 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes for v2.1.2 do not enumerate changes; they only point - to the upstream CHANGELOG-2.x.md for details.] - breaking_changes: [None stated in the provided notes; treat as unknown until - you review the linked CHANGELOG-2.x.md.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes for v2.1.2 do not enumerate changes; they only point to the + upstream CHANGELOG-2.x.md for details. + breaking_changes: + - None stated in the provided notes; treat as unknown until you review the linked + CHANGELOG-2.x.md. chart_version: 3.1.3 - images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.2', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5'] + images: + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 - version: 2.1.1 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include change details; both versions\ - \ defer to the upstream CHANGELOG-2.x.md. No concrete features can be confirmed\ - \ from the supplied text."] - breaking_changes: [No breaking changes are listed in the provided release notes; - both versions only link to the full changelog. Treat breaking-change status - as unknown until reviewing CHANGELOG-2.x.md between v2.0.2 and v2.1.1.] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include change details; both versions defer\ + \ to the upstream CHANGELOG-2.x.md. No concrete features can be confirmed\ + \ from the supplied text." + breaking_changes: + - No breaking changes are listed in the provided release notes; both versions + only link to the full changelog. Treat breaking-change status as unknown until + reviewing CHANGELOG-2.x.md between v2.0.2 and v2.1.1. chart_version: 3.1.2 - images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5'] + images: + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.1 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 - version: 2.0.2 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Release notes provided don\u2019t include detailed changes between\ - \ 2.0.0 and 2.0.2; v2.0.2 points to the 2.x changelog for the actual list\ - \ of fixes/features."] - breaking_changes: [No breaking changes are stated in the provided notes; you - must review CHANGELOG-2.x.md and the Helm chart changelog/values for any - breaking changes before upgrading.] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Release notes provided don\u2019t include detailed changes between 2.0.0\ + \ and 2.0.2; v2.0.2 points to the 2.x changelog for the actual list of fixes/features." + breaking_changes: + - No breaking changes are stated in the provided notes; you must review CHANGELOG-2.x.md + and the Helm chart changelog/values for any breaking changes before upgrading. chart_version: 3.0.3 - images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.0.2', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] + images: + - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.0.2 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 - version: 2.0.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Release notes provided do not include any detailed change items; - both versions only link to the 1.x changelog.] - breaking_changes: ['Potential breaking changes may exist between 1.7.4 and 2.0.0, - but none are listed in the provided notes; you must consult the v2.0.0 changelog/release - documentation before upgrading.'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Release notes provided do not include any detailed change items; both versions + only link to the 1.x changelog. + breaking_changes: + - Potential breaking changes may exist between 1.7.4 and 2.0.0, but none are + listed in the provided notes; you must consult the v2.0.0 changelog/release + documentation before upgrading. chart_version: 3.0.0 - images: ['amazon/aws-efs-csi-driver:v2.0.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] + images: + - amazon/aws-efs-csi-driver:v2.0.0 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 - version: 1.7.4 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null chart_version: 2.5.4 - images: ['amazon/aws-efs-csi-driver:v1.7.4', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2', - 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2'] + images: + - amazon/aws-efs-csi-driver:v1.7.4 + - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2 + - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2 name: aws-efs-csi-driver - icon: https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/e5d625f96415fd44e6399e9c75e2bd985f5a2288/docs/assets/images/aws_load_balancer_icon.svg git_url: https://github.com/kubernetes-sigs/aws-load-balancer-controller @@ -1194,8 +2188,25 @@ addons: chart_name: aws-load-balancer-controller versions: - version: 3.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1213,63 +2224,108 @@ addons: \ set explicitly if you rely on certificate automation behavior).\n- Comment-only:\ \ Helm values comment corrected for `enableEndpointSlices` default (no functional\ \ change implied)." - chart_updates: [Gateway API support and conformance aligned to **Gateway API - v1.6.0**; L4 routes (TCPRoute/UDPRoute) now use stable `gateway.networking.k8s.io/v1`., - LBC-specific Gateway CRDs now use `gateway.k8s.aws/v1` as **storage version**; - `v1beta1` is deprecated but transparently converted by the apiserver for - now., 'Networking improvements: EndpointSlice registration filtered by IP - family; hosted zone lookup matches longest suffix; dualstack subnet autodiscovery - fix; ICMP constants fix; feature gates rendered as parseable key=value pairs.', - 'Route precedence refactor: unified precedence across HTTPRoute/GRPCRoute; - fixes non-transitive precedence issues.', Certificate management fix for - wildcard-host ACM cert creation; adds certificate list support for ECDSA/RSA - (per notes)., Go module path changed to `sigs.k8s.io/aws-load-balancer-controller/v3` - (relevant only if you import the controller as a library).] - features: [Gateway API L4 routes graduate to stable `gateway.networking.k8s.io/v1` - with conformance against Gateway API v1.6.0., 'Certificate management enhancements: - wildcard-host ingress ACM issuance fix and support for ECDSA/RSA certificate - list handling.', Ingress-to-Gateway migration tooling introduced in 3.4.0 - (lbc-migrate CLI + in-cluster migration console) to enable non-disruptive - parallel ALB stacks during migration.] - breaking_changes: ['**Gateway API CRD requirement:** controller v3.5.0 requires - **Gateway API CRDs v1.6.0**; upgrading controller first will disable NLB - Gateway L4 routing until CRDs are updated, and any `v1alpha2` route manifests - must move to `v1`.', '**LBC Gateway CRDs:** storage version is now `gateway.k8s.aws/v1`; - `v1beta1` is deprecated and will stop being served in a future release (plan - to update manifests).', "(From 3.4.0) **NLB Gateway behavior change:** only\ - \ one L4 route per listener serves traffic; when multiple attach to the\ - \ same listener, only the oldest continues after upgrade\u2014consolidate\ - \ routes to avoid traffic loss."] + chart_updates: + - Gateway API support and conformance aligned to **Gateway API v1.6.0**; L4 + routes (TCPRoute/UDPRoute) now use stable `gateway.networking.k8s.io/v1`. + - LBC-specific Gateway CRDs now use `gateway.k8s.aws/v1` as **storage version**; + `v1beta1` is deprecated but transparently converted by the apiserver for now. + - 'Networking improvements: EndpointSlice registration filtered by IP family; + hosted zone lookup matches longest suffix; dualstack subnet autodiscovery + fix; ICMP constants fix; feature gates rendered as parseable key=value pairs.' + - 'Route precedence refactor: unified precedence across HTTPRoute/GRPCRoute; + fixes non-transitive precedence issues.' + - Certificate management fix for wildcard-host ACM cert creation; adds certificate + list support for ECDSA/RSA (per notes). + - Go module path changed to `sigs.k8s.io/aws-load-balancer-controller/v3` (relevant + only if you import the controller as a library). + features: + - Gateway API L4 routes graduate to stable `gateway.networking.k8s.io/v1` with + conformance against Gateway API v1.6.0. + - 'Certificate management enhancements: wildcard-host ingress ACM issuance fix + and support for ECDSA/RSA certificate list handling.' + - Ingress-to-Gateway migration tooling introduced in 3.4.0 (lbc-migrate CLI + + in-cluster migration console) to enable non-disruptive parallel ALB stacks + during migration. + breaking_changes: + - '**Gateway API CRD requirement:** controller v3.5.0 requires **Gateway API + CRDs v1.6.0**; upgrading controller first will disable NLB Gateway L4 routing + until CRDs are updated, and any `v1alpha2` route manifests must move to `v1`.' + - '**LBC Gateway CRDs:** storage version is now `gateway.k8s.aws/v1`; `v1beta1` + is deprecated and will stop being served in a future release (plan to update + manifests).' + - "(From 3.4.0) **NLB Gateway behavior change:** only one L4 route per listener\ + \ serves traffic; when multiple attach to the same listener, only the oldest\ + \ continues after upgrade\u2014consolidate routes to avoid traffic loss." chart_version: 3.5.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.5.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.5.0 - version: 3.4.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No Helm chart-specific change notes were provided in the supplied\ - \ release notes for v3.4.0; treat this as an application/controller upgrade\ - \ (image tag bump) unless the chart changelog you\u2019re using says otherwise.", - 'v3.3.0 noted CRD update steps via the eks-charts CRD kustomize path and additional - Gateway API CRDs; for 3.4.0, assume those prerequisites still apply if you - use those features and re-apply CRDs as part of the upgrade runbook.'] - features: ["Ingress\u2192Gateway Migration Tooling: new `lbc-migrate` CLI to\ - \ translate Ingress manifests (including annotations and IngressGroups)\ - \ into equivalent Gateway API YAML, with cluster/file/dir inputs and optional\ - \ per-namespace output splitting.", 'Migration Console: an in-cluster web - UI to compare AWS resources produced by Ingress vs Gateway controllers field-by-field - to validate parity before cutover.'] - breaking_changes: ["Gateway API (NLB Gateway) behavior change: only one L4 route\ - \ (TCP/UDP/TLS) per listener will receive traffic; if multiple routes attach\ - \ to the same listener, only the oldest route will be served after upgrade\u2014\ - consolidate to a single route per listener."] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No Helm chart-specific change notes were provided in the supplied release\ + \ notes for v3.4.0; treat this as an application/controller upgrade (image\ + \ tag bump) unless the chart changelog you\u2019re using says otherwise." + - v3.3.0 noted CRD update steps via the eks-charts CRD kustomize path and additional + Gateway API CRDs; for 3.4.0, assume those prerequisites still apply if you + use those features and re-apply CRDs as part of the upgrade runbook. + features: + - "Ingress\u2192Gateway Migration Tooling: new `lbc-migrate` CLI to translate\ + \ Ingress manifests (including annotations and IngressGroups) into equivalent\ + \ Gateway API YAML, with cluster/file/dir inputs and optional per-namespace\ + \ output splitting." + - 'Migration Console: an in-cluster web UI to compare AWS resources produced + by Ingress vs Gateway controllers field-by-field to validate parity before + cutover.' + breaking_changes: + - "Gateway API (NLB Gateway) behavior change: only one L4 route (TCP/UDP/TLS)\ + \ per listener will receive traffic; if multiple routes attach to the same\ + \ listener, only the oldest route will be served after upgrade\u2014consolidate\ + \ to a single route per listener." chart_version: 3.4.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0 - version: 3.3.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1291,25 +2347,47 @@ addons: - **Feature gates / flags**:\n - To use the new cert feature: `--feature-gates=EnableCertificateManagement=true`\ \ plus ingress annotation `create-acm-cert: \"true\"`.\n - Gateway API auto-detection\ \ continues; feature flags still exist to disable if needed.\n" - chart_updates: [Gateway API auto-detection improvements and **LBC-specific CRD - handling in Helm** (behavioral improvements around detecting/handling CRDs)., - Helm **ClusterRole RBAC sync** is automated from kubebuilder (RBAC manifest - generation change).] - features: ['ACM Certificate Management (feature-gated): controller can create/manage - ACM certificates from Ingress hostnames, supporting Amazon-issued DNS validation - via Route53 and private certs via AWS Private CA.', 'Gateway API: improved - auto-detection behavior and Helm handling around LBC-specific Gateway CRDs.'] - breaking_changes: ['No explicit breaking changes called out for v3.3.0 vs v3.2.x, - but enabling `EnableCertificateManagement` without updating IAM will cause - reconciliation failures for certificate creation/validation.', "Gateway\ - \ API CRD install instructions include a potential **version mismatch**\ - \ for experimental CRDs; applying incompatible CRDs could break NLB Gateway/TLSRoute\ - \ behavior\u2014validate CRD versions before upgrading."] + chart_updates: + - Gateway API auto-detection improvements and **LBC-specific CRD handling in + Helm** (behavioral improvements around detecting/handling CRDs). + - Helm **ClusterRole RBAC sync** is automated from kubebuilder (RBAC manifest + generation change). + features: + - 'ACM Certificate Management (feature-gated): controller can create/manage + ACM certificates from Ingress hostnames, supporting Amazon-issued DNS validation + via Route53 and private certs via AWS Private CA.' + - 'Gateway API: improved auto-detection behavior and Helm handling around LBC-specific + Gateway CRDs.' + breaking_changes: + - No explicit breaking changes called out for v3.3.0 vs v3.2.x, but enabling + `EnableCertificateManagement` without updating IAM will cause reconciliation + failures for certificate creation/validation. + - "Gateway API CRD install instructions include a potential **version mismatch**\ + \ for experimental CRDs; applying incompatible CRDs could break NLB Gateway/TLSRoute\ + \ behavior\u2014validate CRD versions before upgrading." chart_version: 3.3.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0 - version: 3.2.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1332,28 +2410,51 @@ addons: \ Ensure your Helm `extraArgs` no longer depends on it. Also, VPC lookup behavior\ \ changed: **all** tags in `--aws-vpc-tags` are now used as filters (can be\ \ breaking if your VPC only matches a subset)." - chart_updates: [Exposes additional controller concurrency/max-concurrency flags - through the Helm chart (previously not all were configurable)., Adds Helm - values to configure namespace selectors for the Service and Ingress validating/mutating - webhooks., "Carries forward improved webhook cert handling introduced in\ - \ v3.1.0 (notably `keepTLSSecret`)\u2014ensure your chart values align with\ - \ your certificate management approach."] - features: ['Gateway API upgraded to v1.5.0, including new resources like ListenerSet - and improved Gateway functionality.', Gateway API resources are now auto-detected - (feature flags no longer required to enable; flags remain to disable)., - Ingress adds a new annotation for Frontend NLB attributes to tune NLB behavior - via Ingress.] - breaking_changes: ['Gateway API moves from v1.3 to v1.5; for NLB Gateway users, - TLSRoute is now served in v1 (not alpha). To avoid downtime, install the - experimental TLSRoute CRD during upgrade as recommended.', 'VPC tag lookup - now requires *all* tags in `--aws-vpc-tags` to match; previously a partial - match might have worked. `--aws-vpc-tag-key` is deprecated/ignored, so update - flags/tags accordingly.'] + chart_updates: + - Exposes additional controller concurrency/max-concurrency flags through the + Helm chart (previously not all were configurable). + - Adds Helm values to configure namespace selectors for the Service and Ingress + validating/mutating webhooks. + - "Carries forward improved webhook cert handling introduced in v3.1.0 (notably\ + \ `keepTLSSecret`)\u2014ensure your chart values align with your certificate\ + \ management approach." + features: + - Gateway API upgraded to v1.5.0, including new resources like ListenerSet and + improved Gateway functionality. + - Gateway API resources are now auto-detected (feature flags no longer required + to enable; flags remain to disable). + - Ingress adds a new annotation for Frontend NLB attributes to tune NLB behavior + via Ingress. + breaking_changes: + - Gateway API moves from v1.3 to v1.5; for NLB Gateway users, TLSRoute is now + served in v1 (not alpha). To avoid downtime, install the experimental TLSRoute + CRD during upgrade as recommended. + - VPC tag lookup now requires *all* tags in `--aws-vpc-tags` to match; previously + a partial match might have worked. `--aws-vpc-tag-key` is deprecated/ignored, + so update flags/tags accordingly. chart_version: 3.2.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.2.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.2.0 - version: 3.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1369,34 +2470,87 @@ addons: \ Expect different behavior around webhook TLS secret/certificate regeneration\ \ on upgrade; validate that the webhook comes up with a valid cert and that\ \ `aws-load-balancer-tls` is managed as intended in your environment.\n" - chart_updates: [Helm chart and controller versions remain aligned in v3.x (introduced - in v3.0.0)., v3.1.0 updates Helm chart information/documentation and changes - webhook cert upgrade logic (fixes cert regeneration and brings back `keepTLSSecret`).] - features: ['Gateway API: Redirect port defaulting now follows spec (defaults - to 80/443 based on scheme when port is omitted).', 'Gateway API: Improved - regex handling for route matching.', 'Gateway API: Gateway status hostname - is normalized to lowercase for consistency.', 'AWS Global Accelerator (AGA): - Cross-namespace reference support for more flexible multi-namespace setups.'] + chart_updates: + - Helm chart and controller versions remain aligned in v3.x (introduced in v3.0.0). + - v3.1.0 updates Helm chart information/documentation and changes webhook cert + upgrade logic (fixes cert regeneration and brings back `keepTLSSecret`). + features: + - 'Gateway API: Redirect port defaulting now follows spec (defaults to 80/443 + based on scheme when port is omitted).' + - 'Gateway API: Improved regex handling for route matching.' + - 'Gateway API: Gateway status hostname is normalized to lowercase for consistency.' + - 'AWS Global Accelerator (AGA): Cross-namespace reference support for more + flexible multi-namespace setups.' breaking_changes: [] chart_version: 3.1.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.1.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.1.0 - version: 3.0.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 3.0.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.0.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v3.0.0 - version: 2.9.9 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 2.9.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1415,40 +2569,67 @@ addons: \ `region`, `vpcId`.\n - `runtimeClassName` support.\n - `--load-balancer-class`\ \ support in chart.\n - More customization options for the service mutator\ \ webhook." - chart_updates: ['Chart: allow disabling ingress validation via Helm flag (2.9.0).', - 'Chart: HPA template uses `.Capabilities.KubeVersion.Version` (compat/templating - change).', (From 2.8.0 line) Additional ServiceMonitor functionality., '(From - 2.8.0 line) Allow templating for `clusterName`, `region`, `vpcId` values.', - (From 2.8.0 line) Add `runtimeClassName` support., (From 2.8.0 line) Support - `--load-balancer-class` in Helm chart., (From 2.8.0 line) More customization - options for the service mutator webhook.] - features: ['Controller migrates to **AWS SDK for Go v2**, improving API efficiency - and retry/backoff behavior (2.9.0).', Adds `listenerAttributes` plumbing - (via `IngressClassParams`) to support listener attributes on load balancers; - ALB has none yet (2.9.0)., NLB now supports configurable **TCP idle timeout** - (2.9.0)., 'Fix/feature: allow resolving/attaching **multiple security groups - with the same Name tag** (2.9.0).', New runtime option to **identify VPC - by tags** when metadata is blocked / VPC ID unknown at deploy time (2.9.0)., - (From 2.8.0 line) IngressClass-level `certificateArn` defaults for ingresses., - (From 2.8.0 line) New IP address type `dualstack-without-public-ipv4` to disable - public IPv4 on dualstack LBs., (From 2.8.0 line) Optional enforcement of - NLB security groups on PrivateLink traffic via annotation., (From 2.8.0 - line) TargetGroupBinding can target resources outside cluster VPC via `vpcID`., - (From 2.8.0 line) Managed Prefix List annotations for SG-based access control.] - breaking_changes: ['**Do not deploy v2.9.0 if AWS Shield Advanced is enabled**: - it can crash the controller; use **v2.9.2+** if Shield Advanced is subscribed - and Shield is enabled on the controller (action-required note).', CRD schema - changes require **manual CRD apply** during Helm upgrade; skipping can break - reconciliation or future compatibility (2.8.0 and 2.9.0 action-required - notes)., 'IAM policy updates may be required depending on features used: - China mTLS needs `elasticloadbalancing:DescribeTrustStores` (2.8.0); NLB - TCP idle timeout/listener attribute management needs `DescribeListenerAttributes`/`ModifyListenerAttributes` - (2.9.0).'] + chart_updates: + - 'Chart: allow disabling ingress validation via Helm flag (2.9.0).' + - 'Chart: HPA template uses `.Capabilities.KubeVersion.Version` (compat/templating + change).' + - (From 2.8.0 line) Additional ServiceMonitor functionality. + - (From 2.8.0 line) Allow templating for `clusterName`, `region`, `vpcId` values. + - (From 2.8.0 line) Add `runtimeClassName` support. + - (From 2.8.0 line) Support `--load-balancer-class` in Helm chart. + - (From 2.8.0 line) More customization options for the service mutator webhook. + features: + - Controller migrates to **AWS SDK for Go v2**, improving API efficiency and + retry/backoff behavior (2.9.0). + - Adds `listenerAttributes` plumbing (via `IngressClassParams`) to support listener + attributes on load balancers; ALB has none yet (2.9.0). + - NLB now supports configurable **TCP idle timeout** (2.9.0). + - 'Fix/feature: allow resolving/attaching **multiple security groups with the + same Name tag** (2.9.0).' + - New runtime option to **identify VPC by tags** when metadata is blocked / + VPC ID unknown at deploy time (2.9.0). + - (From 2.8.0 line) IngressClass-level `certificateArn` defaults for ingresses. + - (From 2.8.0 line) New IP address type `dualstack-without-public-ipv4` to disable + public IPv4 on dualstack LBs. + - (From 2.8.0 line) Optional enforcement of NLB security groups on PrivateLink + traffic via annotation. + - (From 2.8.0 line) TargetGroupBinding can target resources outside cluster + VPC via `vpcID`. + - (From 2.8.0 line) Managed Prefix List annotations for SG-based access control. + breaking_changes: + - '**Do not deploy v2.9.0 if AWS Shield Advanced is enabled**: it can crash + the controller; use **v2.9.2+** if Shield Advanced is subscribed and Shield + is enabled on the controller (action-required note).' + - CRD schema changes require **manual CRD apply** during Helm upgrade; skipping + can break reconciliation or future compatibility (2.8.0 and 2.9.0 action-required + notes). + - 'IAM policy updates may be required depending on features used: China mTLS + needs `elasticloadbalancing:DescribeTrustStores` (2.8.0); NLB TCP idle timeout/listener + attribute management needs `DescribeListenerAttributes`/`ModifyListenerAttributes` + (2.9.0).' chart_version: 1.9.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0 - version: 2.8.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1469,35 +2650,59 @@ addons: \ support**: chart supports `--load-balancer-class`.\n- **Service mutator\ \ webhook customization**: more knobs to tune webhook behavior (review webhook-related\ \ values if you previously customized it).\n" - chart_updates: ['CRDs changed in v2.8.0: IngressClassParams adds `certificateArn` - and updates `ipAddressType`; TargetGroupBinding adds `vpcID` (manual CRD - apply required when upgrading via Helm).', 'Chart enhancements: additional - ServiceMonitor functionality.', 'Chart enhancements: allow templated values - for `clusterName`, `region`, `vpcId`.', 'Chart enhancements: add `runtimeClassName` - support.', 'Chart enhancements: add support for `--load-balancer-class`.', - 'Controller/webhook: more customization options for the service mutator webhook.', - 'Controller behavior: preserve `loadBalancerClass` on Service updates.'] - features: ['IngressClass-level default certificate configuration: `certificateArn` - can be set in IngressClassParams to apply certificates across ingresses - in that class.', New ALB `ipAddressType` option `dualstack-without-public-ipv4` - to create dualstack LBs without public IPv4 addresses (IPv6-only public - clients). Can be set via ingress annotation or at IngressClassParams., Optional - enforcement of NLB security groups on AWS PrivateLink traffic via annotation - `aws-load-balancer-inbound-sg-rules-on-private-link-traffic`., TargetGroupBinding - can register targets in a different VPC by setting `spec.vpcID` (defaults - to the cluster VPC if omitted)., Allow access control via AWS Managed Prefix - Lists using new annotations for ALB ingresses and NLB services; ignored - if explicit security groups are set.] - breaking_changes: [CRD schema changes in v2.8.0 mean you must update CRDs before/alongside - the Helm upgrade; otherwise the controller may fail to reconcile resources - or validation may reject new fields., '(Regional/IAM) Using ALB mTLS in - China now requires IAM policy permission `elasticloadbalancing:DescribeTrustStores`; - without it, mTLS-related reconciliation will fail.'] + chart_updates: + - 'CRDs changed in v2.8.0: IngressClassParams adds `certificateArn` and updates + `ipAddressType`; TargetGroupBinding adds `vpcID` (manual CRD apply required + when upgrading via Helm).' + - 'Chart enhancements: additional ServiceMonitor functionality.' + - 'Chart enhancements: allow templated values for `clusterName`, `region`, `vpcId`.' + - 'Chart enhancements: add `runtimeClassName` support.' + - 'Chart enhancements: add support for `--load-balancer-class`.' + - 'Controller/webhook: more customization options for the service mutator webhook.' + - 'Controller behavior: preserve `loadBalancerClass` on Service updates.' + features: + - 'IngressClass-level default certificate configuration: `certificateArn` can + be set in IngressClassParams to apply certificates across ingresses in that + class.' + - New ALB `ipAddressType` option `dualstack-without-public-ipv4` to create dualstack + LBs without public IPv4 addresses (IPv6-only public clients). Can be set via + ingress annotation or at IngressClassParams. + - Optional enforcement of NLB security groups on AWS PrivateLink traffic via + annotation `aws-load-balancer-inbound-sg-rules-on-private-link-traffic`. + - TargetGroupBinding can register targets in a different VPC by setting `spec.vpcID` + (defaults to the cluster VPC if omitted). + - Allow access control via AWS Managed Prefix Lists using new annotations for + ALB ingresses and NLB services; ignored if explicit security groups are set. + breaking_changes: + - CRD schema changes in v2.8.0 mean you must update CRDs before/alongside the + Helm upgrade; otherwise the controller may fail to reconcile resources or + validation may reject new fields. + - (Regional/IAM) Using ALB mTLS in China now requires IAM policy permission + `elasticloadbalancing:DescribeTrustStores`; without it, mTLS-related reconciliation + will fail. chart_version: 1.8.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0 - version: 2.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1512,44 +2717,86 @@ addons: - **Chart knobs added:**\n - Webhook readiness check enabled in the chart.\n\ \ - `revisionHistoryLimit` override.\n - Field to **enable HPA** for the\ \ controller (intended to help during load spikes on `aws-load-balancer-webhook-service`)." - chart_updates: [Introduced chart-level webhook readiness check and default controller - readiness probe wiring., Added `revisionHistoryLimit` configurability for - controller Deployment., Added an option to enable HorizontalPodAutoscaler - (HPA) for the controller., General Helm chart and documentation enhancements.] - features: [Ingress mTLS support via integration with ELBv2 trust stores; configure - mTLS mode and trust store name/ARN via new Ingress annotations (requires - new IAM permission)., EKS Pod Identity support (enables using EKS Pod Identity - for AWS auth instead of/alongside IRSA depending on cluster setup)., NLB - target security-group discovery can now consider additional tags via `--service-target-eni-security-group-tags` - for more flexible environments.] - breaking_changes: ['If you upgrade the Helm chart (>=1.7.0) but keep an older - controller image, installation may fail due to the newly added readiness - probe expecting endpoints not present in older images.', 'IAM permissions - must be updated to include `elasticloadbalancing:DescribeTrustStores` if - you want to use (or avoid errors when enabling) the new Ingress mTLS feature.'] + chart_updates: + - Introduced chart-level webhook readiness check and default controller readiness + probe wiring. + - Added `revisionHistoryLimit` configurability for controller Deployment. + - Added an option to enable HorizontalPodAutoscaler (HPA) for the controller. + - General Helm chart and documentation enhancements. + features: + - Ingress mTLS support via integration with ELBv2 trust stores; configure mTLS + mode and trust store name/ARN via new Ingress annotations (requires new IAM + permission). + - EKS Pod Identity support (enables using EKS Pod Identity for AWS auth instead + of/alongside IRSA depending on cluster setup). + - NLB target security-group discovery can now consider additional tags via `--service-target-eni-security-group-tags` + for more flexible environments. + breaking_changes: + - If you upgrade the Helm chart (>=1.7.0) but keep an older controller image, + installation may fail due to the newly added readiness probe expecting endpoints + not present in older images. + - IAM permissions must be updated to include `elasticloadbalancing:DescribeTrustStores` + if you want to use (or avoid errors when enabling) the new Ingress mTLS feature. chart_version: 1.7.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.7.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v2.7.0 - version: 2.6.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['NLB security group support: controller can now create/attach a frontend - SG to NLBs and manage a backend SG to control NLB->node/ENI traffic, enabling - tighter instance exposure controls. You can optionally attach existing frontend - SGs via annotation and optionally enable/disable backend rule management - via a new annotation.', Improved ACM certificate auto-discovery for Ingress - to recognize more key algorithms (RSA 1024/2048/3072/4096 and multiple EC - curves).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'NLB security group support: controller can now create/attach a frontend SG + to NLBs and manage a backend SG to control NLB->node/ENI traffic, enabling + tighter instance exposure controls. You can optionally attach existing frontend + SGs via annotation and optionally enable/disable backend rule management via + a new annotation.' + - Improved ACM certificate auto-discovery for Ingress to recognize more key + algorithms (RSA 1024/2048/3072/4096 and multiple EC curves). breaking_changes: [] chart_version: 1.6.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.6.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v2.6.0 - version: 2.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1564,35 +2811,60 @@ addons: \ (`subnets`, `InboundCIDRs`, `SSLPolicy`). You must **manually apply updated\ \ CRDs**:\n ```bash\n kubectl apply -k \"http://github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master\"\ \n ```\n" - chart_updates: [Controller is now intended to be upgraded via updated manifests/helm - because of webhook/mutating webhook additions; old manifests are considered - incompatible., Adds a mutating webhook so the controller can claim/own Service - type LoadBalancer by default (sets `spec.loadBalancerClass`)., Helm chart - supports setting default target type (`defaultTargetType`)., 'IngressClassParams - CRD schema expanded with `subnets`, `InboundCIDRs`, and `SSLPolicy`.', Leader - election moved/migrated toward ConfigMap leases., Ingress/service annotation - validation tightened (notably ssl-ports and ingress condition annotations).] - features: ['Controller provides a **Service mutator webhook** that sets `spec.loadBalancerClass` - on newly created Services of type `LoadBalancer`, making AWS LBC the default - controller for them (can be disabled via `enableServiceMutatorWebhook=false`).', - You can configure a **default target type** for target groups (via helm `defaultTargetType` - or controller flag)., '`IngressClassParams` supports new configuration fields: - **`subnets`**, **`InboundCIDRs`**, and **`SSLPolicy`**.'] - breaking_changes: ['**Kubernetes 1.22+ required** in v2.5.0 due to reliance - on `spec.loadBalancerClass` support when making LBC the default Service - controller.', 'Behavior change: controller now **creates an internal NLB - by default** for Service type `LoadBalancer`; to get internet-facing you - must set `service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing`.', - 'If you leave the Service mutator webhook enabled, you **cannot provision - new Classic Load Balancers (CLB)** from Kubernetes Services (existing CLBs - continue to work).', 'Known issue/action required: v2.5.0 ingress validator - has a bug handling ingress rules without an HTTP path (issue #3158); **do - not upgrade** if you have such ingresses.'] + chart_updates: + - Controller is now intended to be upgraded via updated manifests/helm because + of webhook/mutating webhook additions; old manifests are considered incompatible. + - Adds a mutating webhook so the controller can claim/own Service type LoadBalancer + by default (sets `spec.loadBalancerClass`). + - Helm chart supports setting default target type (`defaultTargetType`). + - IngressClassParams CRD schema expanded with `subnets`, `InboundCIDRs`, and + `SSLPolicy`. + - Leader election moved/migrated toward ConfigMap leases. + - Ingress/service annotation validation tightened (notably ssl-ports and ingress + condition annotations). + features: + - Controller provides a **Service mutator webhook** that sets `spec.loadBalancerClass` + on newly created Services of type `LoadBalancer`, making AWS LBC the default + controller for them (can be disabled via `enableServiceMutatorWebhook=false`). + - You can configure a **default target type** for target groups (via helm `defaultTargetType` + or controller flag). + - '`IngressClassParams` supports new configuration fields: **`subnets`**, **`InboundCIDRs`**, + and **`SSLPolicy`**.' + breaking_changes: + - '**Kubernetes 1.22+ required** in v2.5.0 due to reliance on `spec.loadBalancerClass` + support when making LBC the default Service controller.' + - 'Behavior change: controller now **creates an internal NLB by default** for + Service type `LoadBalancer`; to get internet-facing you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: + internet-facing`.' + - If you leave the Service mutator webhook enabled, you **cannot provision new + Classic Load Balancers (CLB)** from Kubernetes Services (existing CLBs continue + to work). + - 'Known issue/action required: v2.5.0 ingress validator has a bug handling + ingress rules without an HTTP path (issue #3158); **do not upgrade** if you + have such ingresses.' chart_version: 1.5.0 - images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.5.0'] + images: + - public.ecr.aws/eks/aws-load-balancer-controller:v2.5.0 - version: 2.4.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -1616,32 +2888,47 @@ addons: you may have relied on it being false to allow rotation/recreation). ' - chart_updates: [Chart now creates `IngressClass` and `IngressClassParams` resources - by default (including default naming of `alb`)., Chart adds optional `ServiceMonitor` - resource for metrics scraping via Prometheus Operator., Chart defaults `keepTLSSecret=true` - (TLS secret reuse behavior changes)., Chart removed use of `admissionregistration.k8s.io/v1beta1` - (aligns with newer Kubernetes APIs).] - features: [Ingress objects now use/support the stable `networking.k8s.io/v1` - Ingress API (Kubernetes 1.19+)., Supports `Service.spec.loadBalancerClass` - to bind Services to a specific load balancer implementation., Adds an option - to disable security group rule management for NLBs (useful if rules are - managed externally)., Merges tags defined on Kubernetes Ingress/Service - with controller-managed AWS resource tags for more consistent tagging., - Introduces feature gate `ServiceTypeLoadBalancerOnly` to optionally limit - reconciliation to `Service` objects of type `LoadBalancer`., Helm chart - can create `IngressClass`/`IngressClassParams` and a `ServiceMonitor` out - of the box.] - breaking_changes: ['**Kubernetes 1.18 and older are no longer supported** starting - with v2.4.0 due to the move to `networking.k8s.io/v1` Ingress.', '**Webhook - resources changed**; upgrades require applying the complete updated manifest - or performing the upgrade via Helm to ensure webhook configuration/CA bundles - are correct.', 'Helm now creates `IngressClass`/`IngressClassParams` by - default, which can conflict with pre-existing resources or other controllers - if you were managing these manually.'] + chart_updates: + - Chart now creates `IngressClass` and `IngressClassParams` resources by default + (including default naming of `alb`). + - Chart adds optional `ServiceMonitor` resource for metrics scraping via Prometheus + Operator. + - Chart defaults `keepTLSSecret=true` (TLS secret reuse behavior changes). + - Chart removed use of `admissionregistration.k8s.io/v1beta1` (aligns with newer + Kubernetes APIs). + features: + - Ingress objects now use/support the stable `networking.k8s.io/v1` Ingress + API (Kubernetes 1.19+). + - Supports `Service.spec.loadBalancerClass` to bind Services to a specific load + balancer implementation. + - Adds an option to disable security group rule management for NLBs (useful + if rules are managed externally). + - Merges tags defined on Kubernetes Ingress/Service with controller-managed + AWS resource tags for more consistent tagging. + - Introduces feature gate `ServiceTypeLoadBalancerOnly` to optionally limit + reconciliation to `Service` objects of type `LoadBalancer`. + - Helm chart can create `IngressClass`/`IngressClassParams` and a `ServiceMonitor` + out of the box. + breaking_changes: + - '**Kubernetes 1.18 and older are no longer supported** starting with v2.4.0 + due to the move to `networking.k8s.io/v1` Ingress.' + - '**Webhook resources changed**; upgrades require applying the complete updated + manifest or performing the upgrade via Helm to ensure webhook configuration/CA + bundles are correct.' + - Helm now creates `IngressClass`/`IngressClassParams` by default, which can + conflict with pre-existing resources or other controllers if you were managing + these manually. chart_version: 1.4.0 - images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.4.0'] + images: + - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.4.0 - version: 2.3.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -1660,32 +2947,48 @@ addons: - **IngressClass creation parameter**: chart adds an option/parameter to create\ \ the `IngressClass` resource (verify and set if you rely on chart-managed\ \ IngressClass)." - chart_updates: [Helm chart moved to **Helm v3** packaging/structure., Manifests/chart - updated to use `admissionregistration.k8s.io/v1` (webhooks) and cert-manager - `v1` resources., Chart now prefers `policy/v1` PodDisruptionBudget when - the cluster supports it., Chart supports reusing existing webhook TLS secrets - and optionally providing custom TLS cert/key., Chart adds optional `serviceAnnotations` - and a parameter to create an `IngressClass` resource.] - features: ['Optimized/improved security group management for ALBs (shared backend - SG model, with port-range restriction options).', 'Support for **ALB IPv6 - target groups** (notably for IPv6 clusters, plus new IAM perms).', Support - for **EndpointSlice** as a backend discovery source for IP target groups., - 'Ability to specify NLB attributes via annotations, including **NLB deletion - protection**.', 'Improved subnet discovery behavior (only on new LB creation; - can consider available IP addresses) and additional filtering (e.g., by - VPC ID).'] - breaking_changes: ["Controller upgrade can **reconfigure existing ALBs' security\ - \ groups** due to the new shared backend SG behavior; there may be a brief\ - \ traffic impact window during reconciliation\u2014plan a maintenance window\ - \ or pin behavior via `enableBackendSecurityGroup=false` / `--enable-backend-security-group=false`\ - \ or set an explicit backend SG.", 'If you use cert-manager integration/manifests, - you must be on **cert-manager v1.5.3+** because resources now use the `cert-manager.io/v1` - API.', New IAM permissions are required for **IPv6 clusters**; failing to - update policy may break reconciliation for IPv6-related features.] + chart_updates: + - Helm chart moved to **Helm v3** packaging/structure. + - Manifests/chart updated to use `admissionregistration.k8s.io/v1` (webhooks) + and cert-manager `v1` resources. + - Chart now prefers `policy/v1` PodDisruptionBudget when the cluster supports + it. + - Chart supports reusing existing webhook TLS secrets and optionally providing + custom TLS cert/key. + - Chart adds optional `serviceAnnotations` and a parameter to create an `IngressClass` + resource. + features: + - Optimized/improved security group management for ALBs (shared backend SG model, + with port-range restriction options). + - Support for **ALB IPv6 target groups** (notably for IPv6 clusters, plus new + IAM perms). + - Support for **EndpointSlice** as a backend discovery source for IP target + groups. + - Ability to specify NLB attributes via annotations, including **NLB deletion + protection**. + - Improved subnet discovery behavior (only on new LB creation; can consider + available IP addresses) and additional filtering (e.g., by VPC ID). + breaking_changes: + - "Controller upgrade can **reconfigure existing ALBs' security groups** due\ + \ to the new shared backend SG behavior; there may be a brief traffic impact\ + \ window during reconciliation\u2014plan a maintenance window or pin behavior\ + \ via `enableBackendSecurityGroup=false` / `--enable-backend-security-group=false`\ + \ or set an explicit backend SG." + - If you use cert-manager integration/manifests, you must be on **cert-manager + v1.5.3+** because resources now use the `cert-manager.io/v1` API. + - New IAM permissions are required for **IPv6 clusters**; failing to update + policy may break reconciliation for IPv6-related features. chart_version: 1.3.2 - images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.3.0'] + images: + - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.3.0 - version: 2.2.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -1704,39 +3007,67 @@ addons: \ certificate locations** and **default SSL policy**.\n\n> No specific Helm\ \ values keys were provided in the notes you pasted; treat the above as **behavioral/manifest\ \ requirements** rather than guaranteed `values.yaml` key changes." - chart_updates: ['Controller image moves to `docker.io/amazon/aws-alb-ingress-controller:v2.2.0` - (and corresponding ECR mirrors).', 'Manifests updated to newer Kubernetes - APIs: webhook + CRDs upgraded to `v1` APIs; deprecated apiVersions removed.', - 'Admission webhooks improved: pod mutator webhook now uses `objectSelector`; - webhook cert/key locations are configurable via flags.', 'New CRD introduced: - **IngressClassParams** (plus validating webhook) and RBAC added to read - it.'] - features: [Adds **NLB instance mode** support., 'Adds annotation to set **private - static IPv4 addresses** for internal NLBs: `service.beta.kubernetes.io/aws-load-balancer-private-ipv4-addresses`.', - Introduces **IngressClassParams** to constrain/standardize LB settings across - multiple Ingresses., "Adds `alb.ingress.kubernetes.io/ssl-redirect` to simplify\ - \ HTTP\u2192HTTPS redirects.", Supports Ingress **PathType**., Supports - resource tagging for **ALB listeners and listener rules**., Allows specifying - a **custom load balancer name** for ALB/NLB., Allows selecting backend nodes - by **node labels** for Ingress/Service/TargetGroupBinding., Supports provisioning - ALB on **Local Zones**., Adds ability to opt out management for certain - tags via controller flags., Adds ability to customize webhook certificate - locations via controller flags., Adds ability to specify a default **SSL - policy** via controller flags.] - breaking_changes: ['**NLB scheme default changed**: new NLBs are **internal - by default**. To create an internet-facing NLB you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: - internet-facing` on the Service (existing NLBs are not affected).', Ingress - rules that reference a **non-existent Service/Action** no longer block reconcile; - they will be replaced with **fixed 503 responses** (changes failure mode/traffic - behavior)., 'Tag precedence change: tags specified via the controller flag - `--default-tags` now take **highest priority**, which can override tags - set elsewhere.'] + chart_updates: + - Controller image moves to `docker.io/amazon/aws-alb-ingress-controller:v2.2.0` + (and corresponding ECR mirrors). + - 'Manifests updated to newer Kubernetes APIs: webhook + CRDs upgraded to `v1` + APIs; deprecated apiVersions removed.' + - 'Admission webhooks improved: pod mutator webhook now uses `objectSelector`; + webhook cert/key locations are configurable via flags.' + - 'New CRD introduced: **IngressClassParams** (plus validating webhook) and + RBAC added to read it.' + features: + - Adds **NLB instance mode** support. + - 'Adds annotation to set **private static IPv4 addresses** for internal NLBs: + `service.beta.kubernetes.io/aws-load-balancer-private-ipv4-addresses`.' + - Introduces **IngressClassParams** to constrain/standardize LB settings across + multiple Ingresses. + - "Adds `alb.ingress.kubernetes.io/ssl-redirect` to simplify HTTP\u2192HTTPS\ + \ redirects." + - Supports Ingress **PathType**. + - Supports resource tagging for **ALB listeners and listener rules**. + - Allows specifying a **custom load balancer name** for ALB/NLB. + - Allows selecting backend nodes by **node labels** for Ingress/Service/TargetGroupBinding. + - Supports provisioning ALB on **Local Zones**. + - Adds ability to opt out management for certain tags via controller flags. + - Adds ability to customize webhook certificate locations via controller flags. + - Adds ability to specify a default **SSL policy** via controller flags. + breaking_changes: + - '**NLB scheme default changed**: new NLBs are **internal by default**. To + create an internet-facing NLB you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: + internet-facing` on the Service (existing NLBs are not affected).' + - Ingress rules that reference a **non-existent Service/Action** no longer block + reconcile; they will be replaced with **fixed 503 responses** (changes failure + mode/traffic behavior). + - 'Tag precedence change: tags specified via the controller flag `--default-tags` + now take **highest priority**, which can override tags set elsewhere.' chart_version: 1.2.2 - images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.2.0'] + images: + - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.2.0 - version: 2.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', - '1.17', '1.16', '1.15'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: @@ -1748,32 +3079,60 @@ addons: - No other helm values changes were called out in the provided notes. (You may still want to diff your chart values between versions to catch defaults changes, but nothing is explicitly mentioned here.)' - chart_updates: [RBAC roles/manifests updated to include permissions for `IngressClass` - (required when using `IngressClass`).] - features: [IngressClass support (Kubernetes 1.18+) so the controller can select/manage - ingresses via `IngressClass` instead of only the legacy `kubernetes.io/ingress.class` - annotation., 'gRPC end-to-end HTTP/2 support for ALB workloads, improving - compatibility for gRPC services behind ALB.', Customer Owned IP (COIP) pool - configuration support for ALB on AWS Outposts., NLB IPv6 support for dual-stack/IPv6-facing - services., NLB ALPN policy configuration support (useful for TLS negotiation - behavior)., 'NLB target group attributes can be configured via annotations, - allowing tuning of target group behavior.', 'Ability to explicitly configure - subnets for NLB, rather than relying solely on discovery.', Default AWS - tags support so all AWS resources created/managed by the controller can - receive a standard tag set.] - breaking_changes: ['If you use `IngressClass`, the controller will fail to watch/operate - correctly until RBAC is updated to allow reading `IngressClass` resources.'] + chart_updates: + - RBAC roles/manifests updated to include permissions for `IngressClass` (required + when using `IngressClass`). + features: + - IngressClass support (Kubernetes 1.18+) so the controller can select/manage + ingresses via `IngressClass` instead of only the legacy `kubernetes.io/ingress.class` + annotation. + - gRPC end-to-end HTTP/2 support for ALB workloads, improving compatibility + for gRPC services behind ALB. + - Customer Owned IP (COIP) pool configuration support for ALB on AWS Outposts. + - NLB IPv6 support for dual-stack/IPv6-facing services. + - NLB ALPN policy configuration support (useful for TLS negotiation behavior). + - NLB target group attributes can be configured via annotations, allowing tuning + of target group behavior. + - Ability to explicitly configure subnets for NLB, rather than relying solely + on discovery. + - Default AWS tags support so all AWS resources created/managed by the controller + can receive a standard tag set. + breaking_changes: + - If you use `IngressClass`, the controller will fail to watch/operate correctly + until RBAC is updated to allow reading `IngressClass` resources. chart_version: 1.1.1 - images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.1.0'] + images: + - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.1.0 - version: 2.0.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', - '1.17', '1.16', '1.15'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null chart_version: 1.0.6 - images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.0.0'] + images: + - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.0.0 name: aws-load-balancer-controller - name: bigbang icon: https://artifacthub.io/image/0ca7dd5c-47ec-4d6a-87b7-2f2b74a3cca5 @@ -1781,7 +3140,8 @@ addons: release_url: https://repo1.dso.mil/big-bang/bigbang/-/releases/{vsn} versions: - version: 3.32.0 - kube: ['1.36'] + kube: + - '1.36' requirements: - name: Alloy version: 4.3.2-bb.0 @@ -1876,24 +3236,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [BigBang 3.32.0 adds Cert Manager (v1.20.3-bb.2) and removes - bbctl from the stack., Most other components receive patch/minor bumps; - expect chart/package version alignment but review per-package changelogs - for values changes.] - features: ['Cert Manager is now included, enabling in-cluster certificate issuance/renewal - workflows without separate installation.', 'Various components updated for - bugfixes/security patches (e.g., Authservice, ESO, Keycloak, Kyverno, Thanos, - Twistlock).'] - breaking_changes: [bbctl is removed; any CI/CD or operational workflows depending - on bbctl need migration., Introducing Cert Manager may overlap with an existing - cert-manager installation/CRDs; reconcile ownership to avoid CRD/namespace - conflicts.] + chart_updates: + - BigBang 3.32.0 adds Cert Manager (v1.20.3-bb.2) and removes bbctl from the + stack. + - Most other components receive patch/minor bumps; expect chart/package version + alignment but review per-package changelogs for values changes. + features: + - Cert Manager is now included, enabling in-cluster certificate issuance/renewal + workflows without separate installation. + - Various components updated for bugfixes/security patches (e.g., Authservice, + ESO, Keycloak, Kyverno, Thanos, Twistlock). + breaking_changes: + - bbctl is removed; any CI/CD or operational workflows depending on bbctl need + migration. + - Introducing Cert Manager may overlap with an existing cert-manager installation/CRDs; + reconcile ownership to avoid CRD/namespace conflicts. chart_version: 3.32.0 - images: ['registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner:v18.11.3', - 'registry1.dso.mil/gitlab/gitlab-org/gitlab-runner:ubi-fips-v19.2.2', 'registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner-helper:v18.11.3', - 'registry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper:ubi-fips-x86_64-v19.2.2'] + images: + - registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner:v18.11.3 + - registry1.dso.mil/gitlab/gitlab-org/gitlab-runner:ubi-fips-v19.2.2 + - registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner-helper:v18.11.3 + - registry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper:ubi-fips-x86_64-v19.2.2 - version: 3.31.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.3.2-bb.0 @@ -1988,25 +3354,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang umbrella upgrade 3.30.0 \u2192 3.31.0 with multiple\ - \ subchart bumps across platform services (GitLab, Argo CD, Monitoring,\ - \ Gatekeeper, ESO, Vault, etc.).", "Largest dependency jumps include GitLab\ - \ 9.11.8-bb.0 \u2192 10.2.4-bb.0, Argo CD 10.1.4-bb.1 \u2192 10.2.1-bb.0,\ - \ Monitoring 87.10.1-bb.3 \u2192 88.3.0-bb.0, and Renovate 46.31.6-bb.5\ - \ \u2192 46.251.0-bb.0.", "CRD bundle bump: prometheus-operator-crds 30.0.1-bb.0\ - \ \u2192 31.0.1-bb.0 (implies CRD updates during upgrade)."] - features: ['Updated component versions across the Big Bang stack, bringing in - upstream fixes and minor feature updates for GitOps (Argo CD), policy (Gatekeeper/Kyverno), - secrets (External Secrets), observability (Monitoring), and core services - (GitLab, Vault).'] - breaking_changes: ["Potential breaking changes may exist in major/minor bumps\ - \ (notably GitLab 9.x \u2192 10.x chart and Monitoring/Prometheus CRDs).\ - \ Review each component\u2019s release notes and upgrade guides before applying\ - \ in production."] + chart_updates: + - "Big Bang umbrella upgrade 3.30.0 \u2192 3.31.0 with multiple subchart bumps\ + \ across platform services (GitLab, Argo CD, Monitoring, Gatekeeper, ESO,\ + \ Vault, etc.)." + - "Largest dependency jumps include GitLab 9.11.8-bb.0 \u2192 10.2.4-bb.0, Argo\ + \ CD 10.1.4-bb.1 \u2192 10.2.1-bb.0, Monitoring 87.10.1-bb.3 \u2192 88.3.0-bb.0,\ + \ and Renovate 46.31.6-bb.5 \u2192 46.251.0-bb.0." + - "CRD bundle bump: prometheus-operator-crds 30.0.1-bb.0 \u2192 31.0.1-bb.0\ + \ (implies CRD updates during upgrade)." + features: + - Updated component versions across the Big Bang stack, bringing in upstream + fixes and minor feature updates for GitOps (Argo CD), policy (Gatekeeper/Kyverno), + secrets (External Secrets), observability (Monitoring), and core services + (GitLab, Vault). + breaking_changes: + - "Potential breaking changes may exist in major/minor bumps (notably GitLab\ + \ 9.x \u2192 10.x chart and Monitoring/Prometheus CRDs). Review each component\u2019\ + s release notes and upgrade guides before applying in production." chart_version: 3.31.0 images: [] - version: 3.30.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.3.1-bb.1 @@ -2101,19 +3471,23 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [BigBang 3.30.0 primarily updates bundled component chart versions - (patch/minor bumps across most packages)., "Notable minor bumps include:\ - \ Mimir 6.0.6\u21926.1.0, Kyverno 3.8.1\u21923.8.2, Kyverno Reporter 3.7.4\u2192\ - 3.9.0, NeuVector 2.10.3\u21922.11.0, Elastic/Kibana 1.39\u21921.40, Alloy\ - \ 4.2.2\u21924.3.1, and Istio 1.30.2\u21921.30.3."] - features: ['General dependency refresh: newer upstream component versions with - bugfixes and security patches.', Observability stack refresh via Alloy and - Mimir bumps; policy/reporting refresh via Kyverno and Kyverno Reporter bumps.] + chart_updates: + - BigBang 3.30.0 primarily updates bundled component chart versions (patch/minor + bumps across most packages). + - "Notable minor bumps include: Mimir 6.0.6\u21926.1.0, Kyverno 3.8.1\u2192\ + 3.8.2, Kyverno Reporter 3.7.4\u21923.9.0, NeuVector 2.10.3\u21922.11.0, Elastic/Kibana\ + \ 1.39\u21921.40, Alloy 4.2.2\u21924.3.1, and Istio 1.30.2\u21921.30.3." + features: + - 'General dependency refresh: newer upstream component versions with bugfixes + and security patches.' + - Observability stack refresh via Alloy and Mimir bumps; policy/reporting refresh + via Kyverno and Kyverno Reporter bumps. breaking_changes: [] chart_version: 3.30.0 images: [] - version: 3.29.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.2.2-bb.0 @@ -2208,20 +3582,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang upgraded from 3.28.0 to 3.29.0 (now the currently supported - version per release notes)., 'Multiple component chart version bumps across - the stack (ArgoCD, External Secrets Operator, Monitoring stack, Prometheus - Operator CRDs, etc.).'] - features: [Support baseline moved to Big Bang 3.29.0 (3.28.0 no longer the currently - supported version).] - breaking_changes: ["Potential breaking changes likely in major/minor jumps for\ - \ ArgoCD (9.x \u2192 10.x), External Secrets Operator (1.x \u2192 2.x),\ - \ Monitoring (85.x \u2192 87.x), and Prometheus Operator CRDs (28 \u2192\ - \ 30); review those components\u2019 upstream/bb chart notes before upgrading."] + chart_updates: + - Big Bang upgraded from 3.28.0 to 3.29.0 (now the currently supported version + per release notes). + - Multiple component chart version bumps across the stack (ArgoCD, External + Secrets Operator, Monitoring stack, Prometheus Operator CRDs, etc.). + features: + - Support baseline moved to Big Bang 3.29.0 (3.28.0 no longer the currently + supported version). + breaking_changes: + - "Potential breaking changes likely in major/minor jumps for ArgoCD (9.x \u2192\ + \ 10.x), External Secrets Operator (1.x \u2192 2.x), Monitoring (85.x \u2192\ + \ 87.x), and Prometheus Operator CRDs (28 \u2192 30); review those components\u2019\ + \ upstream/bb chart notes before upgrading." chart_version: 3.29.0 images: [] - version: 3.28.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.1.7-bb.0 @@ -2316,29 +3694,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["BigBang 3.28.0 bumps a wide set of packaged components; use\ - \ this as an upgrade checklist and validate each component\u2019s own release\ - \ notes for additional required value changes or migrations.", 'Backstage - is removed in 3.28.0; you must remove/disable any Backstage-related values, - namespaces, and dependent integrations before or during the upgrade.', 'Most - changes are patch-level bumps, but some are minor releases (e.g., Argo CD, - Kiali, Vault, Velero, Fortify, Twistlock) and may include behavior changes; - run in a staging cluster and verify RBAC, CRDs, and webhook behavior.'] - features: ['Updated platform component bundle with newer versions of Argo CD, - Istio 1.30.2, Vault 0.33.x, Velero 12.1.x, and other supporting services.', - 'Security and bugfix updates across multiple components (Kyverno, Harbor, - NeuVector, monitoring stack, etc.) via chart bumps.', Backstage is no longer - included in the default BigBang package set.] - breaking_changes: ['Backstage component removed: existing Backstage deployments - managed by BigBang will no longer be upgraded/maintained; you must migrate - or manage it separately if still needed.', 'Potential minor-version behavior - changes in Argo CD, Vault, Velero, Fortify, and Twistlock may require config - validation and post-upgrade testing (SSO/OIDC, policies, CRDs, backups/restores, - scanners).'] + chart_updates: + - "BigBang 3.28.0 bumps a wide set of packaged components; use this as an upgrade\ + \ checklist and validate each component\u2019s own release notes for additional\ + \ required value changes or migrations." + - Backstage is removed in 3.28.0; you must remove/disable any Backstage-related + values, namespaces, and dependent integrations before or during the upgrade. + - Most changes are patch-level bumps, but some are minor releases (e.g., Argo + CD, Kiali, Vault, Velero, Fortify, Twistlock) and may include behavior changes; + run in a staging cluster and verify RBAC, CRDs, and webhook behavior. + features: + - Updated platform component bundle with newer versions of Argo CD, Istio 1.30.2, + Vault 0.33.x, Velero 12.1.x, and other supporting services. + - Security and bugfix updates across multiple components (Kyverno, Harbor, NeuVector, + monitoring stack, etc.) via chart bumps. + - Backstage is no longer included in the default BigBang package set. + breaking_changes: + - 'Backstage component removed: existing Backstage deployments managed by BigBang + will no longer be upgraded/maintained; you must migrate or manage it separately + if still needed.' + - Potential minor-version behavior changes in Argo CD, Vault, Velero, Fortify, + and Twistlock may require config validation and post-upgrade testing (SSO/OIDC, + policies, CRDs, backups/restores, scanners). chart_version: 3.28.0 images: [] - version: 3.27.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.0.1-bb.0 @@ -2435,26 +3817,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["BigBang 3.26.0 \u2192 3.27.0 is primarily a dependency bump\ - \ release across multiple components (Argo CD, Authservice, Backstage, Istio\ - \ stack including ztunnel, Keycloak, Kyverno Reporter, Mattermost + operator,\ - \ Mimir, SonarQube, Velero).", "Istio stack moves from 1.29.2 to 1.30.1\ - \ (and ztunnel 1.29.1 \u2192 1.30.1), which is the most operationally significant\ - \ change and may require special upgrade sequencing/validation."] - features: ["Argo CD receives patch updates (9.5.15-bb.0 \u2192 9.5.21-bb.0)\ - \ likely including bugfixes and security fixes.", "Backstage receives a\ - \ minor version bump (2.6.3-bb.3 \u2192 2.8.1-bb.0) adding upstream features/bugfixes.", - Istio moves to 1.30.1 which likely includes performance and security fixes - plus behavior changes relative to 1.29.x., "Velero patch bump (12.0.1 \u2192\ - \ 12.0.2-bb.1) likely includes backup/restore fixes."] - breaking_changes: ["No explicit breaking changes were provided in the notes\ - \ you shared; assume none are known from this input, but treat the Istio\ - \ 1.29 \u2192 1.30 upgrade as potentially introducing behavioral changes\ - \ and re-validate traffic management, mTLS, and ambient/ztunnel behavior."] + chart_updates: + - "BigBang 3.26.0 \u2192 3.27.0 is primarily a dependency bump release across\ + \ multiple components (Argo CD, Authservice, Backstage, Istio stack including\ + \ ztunnel, Keycloak, Kyverno Reporter, Mattermost + operator, Mimir, SonarQube,\ + \ Velero)." + - "Istio stack moves from 1.29.2 to 1.30.1 (and ztunnel 1.29.1 \u2192 1.30.1),\ + \ which is the most operationally significant change and may require special\ + \ upgrade sequencing/validation." + features: + - "Argo CD receives patch updates (9.5.15-bb.0 \u2192 9.5.21-bb.0) likely including\ + \ bugfixes and security fixes." + - "Backstage receives a minor version bump (2.6.3-bb.3 \u2192 2.8.1-bb.0) adding\ + \ upstream features/bugfixes." + - Istio moves to 1.30.1 which likely includes performance and security fixes + plus behavior changes relative to 1.29.x. + - "Velero patch bump (12.0.1 \u2192 12.0.2-bb.1) likely includes backup/restore\ + \ fixes." + breaking_changes: + - "No explicit breaking changes were provided in the notes you shared; assume\ + \ none are known from this input, but treat the Istio 1.29 \u2192 1.30 upgrade\ + \ as potentially introducing behavioral changes and re-validate traffic management,\ + \ mTLS, and ambient/ztunnel behavior." chart_version: 3.27.0 images: [] - version: 3.26.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.0.1-bb.0 @@ -2552,15 +3941,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Component bundle updates in this release (Anchore Enterprise, Argo - CD, Elastic/Kibana, GitLab, Harbor, Keycloak, Kiali, Kyverno, Kyverno Reporter, - Loki, Mattermost, Monitoring, NeuVector, Thanos, Twistlock, Velero) to the - versions listed in the notes.'] + features: + - Component bundle updates in this release (Anchore Enterprise, Argo CD, Elastic/Kibana, + GitLab, Harbor, Keycloak, Kiali, Kyverno, Kyverno Reporter, Loki, Mattermost, + Monitoring, NeuVector, Thanos, Twistlock, Velero) to the versions listed in + the notes. breaking_changes: [] chart_version: 3.26.0 images: [] - version: 3.25.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 4.0.1-bb.0 @@ -2658,14 +4049,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No new features were provided in the pasted release notes; both entries - only state that the currently supported Big Bang version is 3.25.0.] - breaking_changes: [No breaking changes were provided in the pasted release notes; - the content shown does not include upgrade-impacting changes.] + features: + - No new features were provided in the pasted release notes; both entries only + state that the currently supported Big Bang version is 3.25.0. + breaking_changes: + - No breaking changes were provided in the pasted release notes; the content + shown does not include upgrade-impacting changes. chart_version: 3.25.0 images: [] - version: 3.24.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 3.8.4-bb.1 @@ -2762,26 +4156,31 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang umbrella chart version bump from 3.23.0 to 3.24.0 with - multiple component chart version updates (see below)., Adds Renovate as - a new packaged component (Renovate chart introduced at 46.31.6-bb.5)., "Several\ - \ components receive patch/minor updates; a few have notable minor/major\ - \ jumps (Tempo 1.26.5 \u2192 2.1.0, Mimir 5.8.0 \u2192 6.0.6, Loki 6.46.0\ - \ \u2192 6.55.0)."] - features: [Renovate is now included as a managed component (enables automated - dependency/Helm update PRs when configured)., 'Observability stack updates: - Tempo 2.1.0, Mimir 6.0.6, Loki 6.55.0 bring improvements and fixes from - upstream releases (review component-specific changelogs if you rely on advanced - features).'] - breaking_changes: ["Potential breaking changes due to major/minor jumps: Tempo\ - \ 1.x \u2192 2.x and Mimir 5.x \u2192 6.x may include config or API behavior\ - \ changes; verify values and migration notes before upgrade.", Big Bang - 3.24.0 is not the currently supported release per the admin message (supported - is 3.25.0); confirm your upgrade path/support policy before proceeding.] + chart_updates: + - Big Bang umbrella chart version bump from 3.23.0 to 3.24.0 with multiple component + chart version updates (see below). + - Adds Renovate as a new packaged component (Renovate chart introduced at 46.31.6-bb.5). + - "Several components receive patch/minor updates; a few have notable minor/major\ + \ jumps (Tempo 1.26.5 \u2192 2.1.0, Mimir 5.8.0 \u2192 6.0.6, Loki 6.46.0\ + \ \u2192 6.55.0)." + features: + - Renovate is now included as a managed component (enables automated dependency/Helm + update PRs when configured). + - 'Observability stack updates: Tempo 2.1.0, Mimir 6.0.6, Loki 6.55.0 bring + improvements and fixes from upstream releases (review component-specific changelogs + if you rely on advanced features).' + breaking_changes: + - "Potential breaking changes due to major/minor jumps: Tempo 1.x \u2192 2.x\ + \ and Mimir 5.x \u2192 6.x may include config or API behavior changes; verify\ + \ values and migration notes before upgrade." + - Big Bang 3.24.0 is not the currently supported release per the admin message + (supported is 3.25.0); confirm your upgrade path/support policy before proceeding. chart_version: 3.24.0 - images: ['registry1.dso.mil/ironbank/opensource/apache/kafka-native:4.2.0'] + images: + - registry1.dso.mil/ironbank/opensource/apache/kafka-native:4.2.0 - version: 3.23.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 3.8.4-bb.1 @@ -2877,15 +4276,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No actionable application release notes were provided beyond an admin - message indicating the currently supported Big Bang version is 3.25.0.] - breaking_changes: ["Release note details for 3.23.0 (and 3.22.0) were not included,\ - \ so breaking changes between 3.22.0 \u2192 3.23.0 cannot be determined\ - \ from the provided text."] + features: + - No actionable application release notes were provided beyond an admin message + indicating the currently supported Big Bang version is 3.25.0. + breaking_changes: + - "Release note details for 3.23.0 (and 3.22.0) were not included, so breaking\ + \ changes between 3.22.0 \u2192 3.23.0 cannot be determined from the provided\ + \ text." chart_version: 3.23.0 - images: ['registry1.dso.mil/ironbank/big-bang/base:2.1.0'] + images: + - registry1.dso.mil/ironbank/big-bang/base:2.1.0 - version: 3.22.0 - kube: ['1.35'] + kube: + - '1.35' requirements: - name: Alloy version: 3.8.4-bb.1 @@ -2981,14 +4384,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No actionable feature details were provided in the pasted notes; - only an admin notice about currently supported Big Bang versions.] - breaking_changes: [No breaking change details were provided in the pasted notes; - only an admin notice about supported versions.] + features: + - No actionable feature details were provided in the pasted notes; only an admin + notice about currently supported Big Bang versions. + breaking_changes: + - No breaking change details were provided in the pasted notes; only an admin + notice about supported versions. chart_version: 3.22.0 images: [] - version: 3.21.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.8.4-bb.1 @@ -3082,14 +4488,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No application-level changes were provided in the notes you shared; - only an 'Admin message' indicating the currently supported Big Bang version - for each release.] - breaking_changes: [No breaking changes were listed in the notes you provided.] + features: + - No application-level changes were provided in the notes you shared; only an + 'Admin message' indicating the currently supported Big Bang version for each + release. + breaking_changes: + - No breaking changes were listed in the notes you provided. chart_version: 3.21.0 images: [] - version: 3.20.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.8.4-bb.0 @@ -3181,18 +4590,21 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Component bundle update for Big Bang 3.20.0: upgrades across observability - (Alloy, Fluent Bit, Grafana, Monitoring/Prometheus stack, Tempo, Thanos), - security/policy (Gatekeeper), service mesh (Istio), CI/dev platforms (GitLab), - and various supporting apps (Anchore, ECK, Keycloak, Mattermost, MinIO, - Kyverno Reporter).'] - breaking_changes: [Nexus Repository Manager is removed in 3.20.0; any deployments - depending on the Big Bang-managed Nexus component must be migrated or managed - separately before/at upgrade.] + features: + - 'Component bundle update for Big Bang 3.20.0: upgrades across observability + (Alloy, Fluent Bit, Grafana, Monitoring/Prometheus stack, Tempo, Thanos), + security/policy (Gatekeeper), service mesh (Istio), CI/dev platforms (GitLab), + and various supporting apps (Anchore, ECK, Keycloak, Mattermost, MinIO, Kyverno + Reporter).' + breaking_changes: + - Nexus Repository Manager is removed in 3.20.0; any deployments depending on + the Big Bang-managed Nexus component must be migrated or managed separately + before/at upgrade. chart_version: 3.20.0 images: [] - version: 3.19.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.7.2-bb.4 @@ -3285,26 +4697,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang umbrella chart upgraded from 3.18.0 to 3.19.0, primarily - by bumping pinned versions of multiple sub-charts/components (see lists - below).'] - features: ['Istio stack updated to 1.29.0/1.29.0-bb.1, bringing upstream Istio - improvements and fixes.', 'Anchore Enterprise updated to 3.21.0-bb.0, bringing - new security scanning features/fixes from Anchore 3.21 line.', 'Argo CD - updated to 9.4.2-bb.0, bringing UI/UX and sync/health fixes from the upstream - chart/app.', Headlamp updated to 0.40.0-bb.0 with general UI and integration - improvements., Kiali updated to 2.22.0-bb.0 with updated Istio observability - features/compatibility.] - breaking_changes: ["Prometheus Operator CRDs bumped 26.0.0-bb.0 \u2192 27.0.0-bb.0;\ - \ CRD changes can be breaking and may require applying updated CRDs before/with\ - \ the upgrade and verifying any custom PrometheusRule/ServiceMonitor/PodMonitor\ - \ resources against the new schemas.", "Istio upgrade 1.28.x \u2192 1.29.0\ - \ can introduce behavioral changes; validate sidecar injection, gateways,\ - \ and CNI compatibility during a staged rollout."] + chart_updates: + - Big Bang umbrella chart upgraded from 3.18.0 to 3.19.0, primarily by bumping + pinned versions of multiple sub-charts/components (see lists below). + features: + - Istio stack updated to 1.29.0/1.29.0-bb.1, bringing upstream Istio improvements + and fixes. + - Anchore Enterprise updated to 3.21.0-bb.0, bringing new security scanning + features/fixes from Anchore 3.21 line. + - Argo CD updated to 9.4.2-bb.0, bringing UI/UX and sync/health fixes from the + upstream chart/app. + - Headlamp updated to 0.40.0-bb.0 with general UI and integration improvements. + - Kiali updated to 2.22.0-bb.0 with updated Istio observability features/compatibility. + breaking_changes: + - "Prometheus Operator CRDs bumped 26.0.0-bb.0 \u2192 27.0.0-bb.0; CRD changes\ + \ can be breaking and may require applying updated CRDs before/with the upgrade\ + \ and verifying any custom PrometheusRule/ServiceMonitor/PodMonitor resources\ + \ against the new schemas." + - "Istio upgrade 1.28.x \u2192 1.29.0 can introduce behavioral changes; validate\ + \ sidecar injection, gateways, and CNI compatibility during a staged rollout." chart_version: 3.19.0 images: [] - version: 3.18.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.7.2-bb.3 @@ -3397,26 +4813,31 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang version bump from 3.17.0 to 3.18.0., 'Large stack expansion: - many optional/managed components are introduced as new packages (e.g., Argo - CD, GitLab, Harbor, Grafana, Loki/Tempo/Mimir updates, Vault update, etc.).', - 'Minor version bumps for existing packages: Backstage, Gatekeeper, Keycloak, - Loki, Mattermost Operator, Mimir, Nexus, Tempo, Vault.'] - features: ['Introduces numerous additional integrated packages (Alloy, Anchore - Enterprise, Argo CD, GitLab, GitLab Runner, Harbor, Grafana, Kyverno suite, - Velero, and more) available for enablement under Big Bang 3.18.0.', 'Adds - broader observability/logging options via new packages like Fluent Bit, - Grafana, Elasticsearch/Kibana, Thanos, and Alloy.'] - breaking_changes: ['Potential operational change: many new packages are now - available/templated; enabling them may require additional cluster resources, - new namespaces, credentials, and network policies.', "One component entry\ - \ indicates a version was removed (\"updated: 11.3.2-bb.1 \u2192 removed\"\ - ), suggesting a previously-present package or chart reference is no longer\ - \ included and may require cleanup if it was in use."] + chart_updates: + - Big Bang version bump from 3.17.0 to 3.18.0. + - 'Large stack expansion: many optional/managed components are introduced as + new packages (e.g., Argo CD, GitLab, Harbor, Grafana, Loki/Tempo/Mimir updates, + Vault update, etc.).' + - 'Minor version bumps for existing packages: Backstage, Gatekeeper, Keycloak, + Loki, Mattermost Operator, Mimir, Nexus, Tempo, Vault.' + features: + - Introduces numerous additional integrated packages (Alloy, Anchore Enterprise, + Argo CD, GitLab, GitLab Runner, Harbor, Grafana, Kyverno suite, Velero, and + more) available for enablement under Big Bang 3.18.0. + - Adds broader observability/logging options via new packages like Fluent Bit, + Grafana, Elasticsearch/Kibana, Thanos, and Alloy. + breaking_changes: + - 'Potential operational change: many new packages are now available/templated; + enabling them may require additional cluster resources, new namespaces, credentials, + and network policies.' + - "One component entry indicates a version was removed (\"updated: 11.3.2-bb.1\ + \ \u2192 removed\"), suggesting a previously-present package or chart reference\ + \ is no longer included and may require cleanup if it was in use." chart_version: 3.18.0 images: [] - version: 3.17.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: updated version: 3.7.2-bb.3 @@ -3503,25 +4924,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 3.17.0 release notes indicate a major packaging change - where nearly all previously included components (Istio, ArgoCD, GitLab, - Harbor, Grafana, etc.) are listed as removed.', "A new component entry appears:\ - \ `new` at version `11.3.2-bb.1` (the notes you provided don\u2019t identify\ - \ what this maps to\u2014treat as an unknown/placeholder component name)."] - features: [No explicit new features were included in the text you provided beyond - a new/added component at `11.3.2-bb.1` (identity unclear).] - breaking_changes: ['Large breaking change: many Big Bang-managed components - are removed in 3.17.0 according to the provided notes. Upgrading without - planning will uninstall/stop managing those components unless they are now - installed/managed differently (e.g., separate charts, different repos, or - different package structure).', Expect values schema and GitOps workflows - to change because component toggles/values for removed charts may no longer - exist; Helm upgrade may fail or prune resources if those subcharts are no - longer rendered.] + chart_updates: + - Big Bang 3.17.0 release notes indicate a major packaging change where nearly + all previously included components (Istio, ArgoCD, GitLab, Harbor, Grafana, + etc.) are listed as removed. + - "A new component entry appears: `new` at version `11.3.2-bb.1` (the notes\ + \ you provided don\u2019t identify what this maps to\u2014treat as an unknown/placeholder\ + \ component name)." + features: + - No explicit new features were included in the text you provided beyond a new/added + component at `11.3.2-bb.1` (identity unclear). + breaking_changes: + - 'Large breaking change: many Big Bang-managed components are removed in 3.17.0 + according to the provided notes. Upgrading without planning will uninstall/stop + managing those components unless they are now installed/managed differently + (e.g., separate charts, different repos, or different package structure).' + - Expect values schema and GitOps workflows to change because component toggles/values + for removed charts may no longer exist; Helm upgrade may fail or prune resources + if those subcharts are no longer rendered. chart_version: 3.17.0 images: [] - version: 3.16.0 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.7.2-bb.2 @@ -3614,27 +5039,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang umbrella chart version bump from 3.15.0 to 3.16.0 with - a large set of component chart version updates., 'Adds several new optional - packages/components to the stack (Backstage, bbctl, Gatekeeper, GitLab, - Grafana, Headlamp, Istio CNI/CRDs, Keycloak, Loki, Mimir, Monitoring, Prometheus - Operator CRDs, Sonarqube).', Removes the `updated` component/package (2025.6.1-bb.0).] - features: ['Introduces multiple new packages that can now be enabled in Big - Bang 3.16.0 (e.g., Backstage, GitLab, Grafana, Keycloak, Loki/Mimir/Monitoring, - Gatekeeper, Sonarqube).', 'Updates core platform components (Istio, Argo - CD, Authservice, Harbor, Kiali, Mattermost, Tempo, Velero, Vault, etc.) - to newer patch/minor versions.'] - breaking_changes: ['Potential operational impact: enabling newly-added components - may introduce new CRDs, namespaces, resource requirements, and RBAC/Policy - constraints; plan for cluster capacity and access changes.', 'Istio packaging - changes: new Istio CNI and Istio CRDs charts are introduced alongside Istio - upgrades; this may require validating CNI behavior and CRD installation/ownership - in your cluster.'] + chart_updates: + - Big Bang umbrella chart version bump from 3.15.0 to 3.16.0 with a large set + of component chart version updates. + - Adds several new optional packages/components to the stack (Backstage, bbctl, + Gatekeeper, GitLab, Grafana, Headlamp, Istio CNI/CRDs, Keycloak, Loki, Mimir, + Monitoring, Prometheus Operator CRDs, Sonarqube). + - Removes the `updated` component/package (2025.6.1-bb.0). + features: + - Introduces multiple new packages that can now be enabled in Big Bang 3.16.0 + (e.g., Backstage, GitLab, Grafana, Keycloak, Loki/Mimir/Monitoring, Gatekeeper, + Sonarqube). + - Updates core platform components (Istio, Argo CD, Authservice, Harbor, Kiali, + Mattermost, Tempo, Velero, Vault, etc.) to newer patch/minor versions. + breaking_changes: + - 'Potential operational impact: enabling newly-added components may introduce + new CRDs, namespaces, resource requirements, and RBAC/Policy constraints; + plan for cluster capacity and access changes.' + - 'Istio packaging changes: new Istio CNI and Istio CRDs charts are introduced + alongside Istio upgrades; this may require validating CNI behavior and CRD + installation/ownership in your cluster.' chart_version: 3.16.0 - images: ['registry1.dso.mil/ironbank/opensource/redis/redis8-slim:8.4.0', 'registry1.dso.mil/bigbang-ci/devops-tester:1.1.2', - 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] + images: + - registry1.dso.mil/ironbank/opensource/redis/redis8-slim:8.4.0 + - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 + - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 - version: 3.15.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.6 @@ -3727,18 +5159,21 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: ['Most bundled components (Backstage, bbctl, Gatekeeper, GitLab, - Grafana, Headlamp, Istio CNI/CRDs, Loki, Mimir, Monitoring, Prometheus Operator - CRDs, SonarQube, etc.) are removed in 3.15.0 compared to 3.14.1; any deployments - relying on Big Bang to install/manage these must be migrated to standalone - charts/operators or removed before/with the upgrade.', 'Big Bang core version - jumps from 7.1.5-bb.0 to 2025.6.1-bb.0, indicating a major packaging/versioning - change; expect potential breaking changes in defaults, values, and component - enablement paths, and validate all custom values against the new chart schema.'] + breaking_changes: + - Most bundled components (Backstage, bbctl, Gatekeeper, GitLab, Grafana, Headlamp, + Istio CNI/CRDs, Loki, Mimir, Monitoring, Prometheus Operator CRDs, SonarQube, + etc.) are removed in 3.15.0 compared to 3.14.1; any deployments relying on + Big Bang to install/manage these must be migrated to standalone charts/operators + or removed before/with the upgrade. + - Big Bang core version jumps from 7.1.5-bb.0 to 2025.6.1-bb.0, indicating a + major packaging/versioning change; expect potential breaking changes in defaults, + values, and component enablement paths, and validate all custom values against + the new chart schema. chart_version: 3.15.0 images: [] - version: 3.14.1 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.2.1-bb.6 @@ -3831,16 +5266,19 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Keycloak removed from the Big Bang release composition., 'A - new component/version was introduced: `new` at `7.1.5-bb.0` (added).'] - features: [Introduces a new component (named `new`) pinned at version `7.1.5-bb.0`.] - breaking_changes: [Keycloak is removed (previously `7.1.4-bb.5`); any workloads - relying on the Keycloak package must migrate/disable related configuration - before upgrading.] + chart_updates: + - Keycloak removed from the Big Bang release composition. + - 'A new component/version was introduced: `new` at `7.1.5-bb.0` (added).' + features: + - Introduces a new component (named `new`) pinned at version `7.1.5-bb.0`. + breaking_changes: + - Keycloak is removed (previously `7.1.4-bb.5`); any workloads relying on the + Keycloak package must migrate/disable related configuration before upgrading. chart_version: 3.14.1 images: [] - version: 3.14.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.6 @@ -3933,26 +5371,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Bump/introduce multiple packaged components for Big Bang 3.14.0; - see component version list for exact chart version deltas., Add **Keycloak** - as a new packaged component (introduced at `7.1.4-bb.5`)., 'Update/refresh - Big Bang-managed components: Gatekeeper, GitLab, GitLab Runner, Kyverno, - Loki, Monitoring stack, Nexus Repository Manager, Prometheus Operator CRDs, - Tempo, Thanos, Twistlock, and others.', "Remove package/version labeled\ - \ `updated: 7.1.5-bb.0` (component name not provided in notes\u2014confirm\ - \ what was removed in upstream release notes before upgrading)."] - features: ['Keycloak is now available as a first-class Big Bang component, enabling - bundled identity/auth capabilities out of the box.'] - breaking_changes: ["Potential breaking changes may come from the Monitoring\ - \ stack upgrade (79.11.0 \u2192 80.4.1) and Prometheus Operator CRDs bump\ - \ (24.0.0 \u2192 25.0.0); verify CRD/application compatibility and perform\ - \ CRD upgrade steps as recommended.", "A component labeled `updated: 7.1.5-bb.0`\ - \ was removed\u2014identify which package this refers to and ensure you\ - \ are not depending on it before upgrading."] + chart_updates: + - Bump/introduce multiple packaged components for Big Bang 3.14.0; see component + version list for exact chart version deltas. + - Add **Keycloak** as a new packaged component (introduced at `7.1.4-bb.5`). + - 'Update/refresh Big Bang-managed components: Gatekeeper, GitLab, GitLab Runner, + Kyverno, Loki, Monitoring stack, Nexus Repository Manager, Prometheus Operator + CRDs, Tempo, Thanos, Twistlock, and others.' + - "Remove package/version labeled `updated: 7.1.5-bb.0` (component name not\ + \ provided in notes\u2014confirm what was removed in upstream release notes\ + \ before upgrading)." + features: + - Keycloak is now available as a first-class Big Bang component, enabling bundled + identity/auth capabilities out of the box. + breaking_changes: + - "Potential breaking changes may come from the Monitoring stack upgrade (79.11.0\ + \ \u2192 80.4.1) and Prometheus Operator CRDs bump (24.0.0 \u2192 25.0.0);\ + \ verify CRD/application compatibility and perform CRD upgrade steps as recommended." + - "A component labeled `updated: 7.1.5-bb.0` was removed\u2014identify which\ + \ package this refers to and ensure you are not depending on it before upgrading." chart_version: 3.14.0 images: [] - version: 3.13.1 - kube: ['1.34'] + kube: + - '1.34' requirements: - name: Alloy version: 3.2.1-bb.5 @@ -4045,33 +5487,38 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["This Big Bang patch release (3.13.0 \u2192 3.13.1) introduces\ - \ a large set of components as newly managed by Big Bang (e.g., Argo CD,\ - \ GitLab, Istio, monitoring/logging stack, security tools).", "One component\ - \ entry is listed as an update from `0.31.0-bb.6` to `7.1.5-bb.0`, but the\ - \ component name is missing in the provided notes\u2014verify in the upstream\ - \ Big Bang 3.13.1 release notes/changelog."] - features: [Adds Argo CD as a managed component (9.1.4-bb.0)., Adds GitLab and - GitLab Runner as managed components (9.6.1-bb.0 and 0.82.0-bb.4)., 'Adds - Istio (base CRDs, gateway, CNI, istiod) managed components (1.28.0-bb.0).', - 'Adds an observability stack: Monitoring (79.11.0-bb.0), Grafana (10.2.0-bb.1), - Loki (6.46.0-bb.0), Thanos (17.3.3-bb.0), Fluent Bit (0.54.0-bb.1).', 'Adds - security/policy components: Kyverno Reporter (3.7.0-bb.0) and Twistlock - (0.23.0-bb.4).', 'Adds Elastic stack operators/charts: ECK Operator (3.2.0-bb.0) - and Elasticsearch/Kibana (1.34.0-bb.0).', 'Adds Authservice (1.1.1-bb.5), - Kiali (2.19.0-bb.0), Mattermost (11.1.1-bb.1), and Vault (0.31.0-bb.6) as - managed components.'] - breaking_changes: ["This upgrade effectively changes scope: many components\ - \ become newly installed/managed by Big Bang, which can create new namespaces,\ - \ CRDs, webhooks, and controllers\u2014treat as a substantial platform change\ - \ even though it is a patch release.", "Potential conflicts if you already\ - \ run any of these components independently (Argo CD, Istio, GitLab, monitoring/logging,\ - \ Elastic, Vault, etc.); you may need to disable Big Bang\u2019s versions\ - \ or plan migrations to avoid duplicate CRDs/controllers/services."] + chart_updates: + - "This Big Bang patch release (3.13.0 \u2192 3.13.1) introduces a large set\ + \ of components as newly managed by Big Bang (e.g., Argo CD, GitLab, Istio,\ + \ monitoring/logging stack, security tools)." + - "One component entry is listed as an update from `0.31.0-bb.6` to `7.1.5-bb.0`,\ + \ but the component name is missing in the provided notes\u2014verify in the\ + \ upstream Big Bang 3.13.1 release notes/changelog." + features: + - Adds Argo CD as a managed component (9.1.4-bb.0). + - Adds GitLab and GitLab Runner as managed components (9.6.1-bb.0 and 0.82.0-bb.4). + - Adds Istio (base CRDs, gateway, CNI, istiod) managed components (1.28.0-bb.0). + - 'Adds an observability stack: Monitoring (79.11.0-bb.0), Grafana (10.2.0-bb.1), + Loki (6.46.0-bb.0), Thanos (17.3.3-bb.0), Fluent Bit (0.54.0-bb.1).' + - 'Adds security/policy components: Kyverno Reporter (3.7.0-bb.0) and Twistlock + (0.23.0-bb.4).' + - 'Adds Elastic stack operators/charts: ECK Operator (3.2.0-bb.0) and Elasticsearch/Kibana + (1.34.0-bb.0).' + - Adds Authservice (1.1.1-bb.5), Kiali (2.19.0-bb.0), Mattermost (11.1.1-bb.1), + and Vault (0.31.0-bb.6) as managed components. + breaking_changes: + - "This upgrade effectively changes scope: many components become newly installed/managed\ + \ by Big Bang, which can create new namespaces, CRDs, webhooks, and controllers\u2014\ + treat as a substantial platform change even though it is a patch release." + - "Potential conflicts if you already run any of these components independently\ + \ (Argo CD, Istio, GitLab, monitoring/logging, Elastic, Vault, etc.); you\ + \ may need to disable Big Bang\u2019s versions or plan migrations to avoid\ + \ duplicate CRDs/controllers/services." chart_version: 3.13.1 images: [] - version: 3.13.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.5 @@ -4158,27 +5605,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang 3.13.0 release notes indicate a major packaging change - where nearly all previously bundled components are now listed as removed - compared to 3.12.0., "A new/updated component entry is shown as \u201Cupdated:\ - \ new (added at 0.31.0-bb.6)\u201D, but the component name is not provided\ - \ in the supplied notes (needs verification from the upstream changelog)."] - features: ['Possible introduction of a new component (added at version 0.31.0-bb.6), - but the name and function are not included in the provided notes and must - be confirmed.'] - breaking_changes: ['Big Bang 3.13.0 appears to remove a large set of previously - included/managed components (Argo CD, Istio, GitLab, Monitoring stack, Loki, - Vault, etc.). This is a major breaking change for upgrade plans because - ownership/installation of these components would shift away from Big Bang - or require separate installation/management.'] + chart_updates: + - Big Bang 3.13.0 release notes indicate a major packaging change where nearly + all previously bundled components are now listed as removed compared to 3.12.0. + - "A new/updated component entry is shown as \u201Cupdated: new (added at 0.31.0-bb.6)\u201D\ + , but the component name is not provided in the supplied notes (needs verification\ + \ from the upstream changelog)." + features: + - Possible introduction of a new component (added at version 0.31.0-bb.6), but + the name and function are not included in the provided notes and must be confirmed. + breaking_changes: + - Big Bang 3.13.0 appears to remove a large set of previously included/managed + components (Argo CD, Istio, GitLab, Monitoring stack, Loki, Vault, etc.). + This is a major breaking change for upgrade plans because ownership/installation + of these components would shift away from Big Bang or require separate installation/management. chart_version: 3.13.0 - images: ['registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.1', 'registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.7', - 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.32.6', 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5', - 'registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.1', - 'registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.4', - 'registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.1', 'registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.5'] + images: + - registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.1 + - registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.7 + - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.32.6 + - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5 + - registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.1 + - registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.4 + - registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.1 + - registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.5 - version: 3.12.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.5 @@ -4273,22 +5726,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang umbrella chart release from 3.11.0 to 3.12.0 primarily - bumps component (subchart) versions; no explicit chart template changes - were provided in the notes you shared.] - features: [Backstage bumped to 2.6.3-bb.0 (may include new Backstage features/fixes - vs 2.5.3)., Kyverno bumped to 3.6.0-bb.1 (new policy engine features/fixes - vs 3.5.2)., Mattermost bumped to 11.1.0-bb.0 (new Mattermost features/fixes - vs 11.0.4).] - breaking_changes: ["No explicit breaking changes were included in the release\ - \ notes excerpt you provided; treat component minor bumps (e.g., Kyverno\ - \ 3.5\u21923.6, Mattermost 11.0\u219211.1, Headlamp 0.36\u21920.37) as potential\ - \ behavior changes and review each component\u2019s upstream/bb release\ - \ notes before upgrading."] + chart_updates: + - Big Bang umbrella chart release from 3.11.0 to 3.12.0 primarily bumps component + (subchart) versions; no explicit chart template changes were provided in the + notes you shared. + features: + - Backstage bumped to 2.6.3-bb.0 (may include new Backstage features/fixes vs + 2.5.3). + - Kyverno bumped to 3.6.0-bb.1 (new policy engine features/fixes vs 3.5.2). + - Mattermost bumped to 11.1.0-bb.0 (new Mattermost features/fixes vs 11.0.4). + breaking_changes: + - "No explicit breaking changes were included in the release notes excerpt you\ + \ provided; treat component minor bumps (e.g., Kyverno 3.5\u21923.6, Mattermost\ + \ 11.0\u219211.1, Headlamp 0.36\u21920.37) as potential behavior changes and\ + \ review each component\u2019s upstream/bb release notes before upgrading." chart_version: 3.12.0 - images: ['registry1.dso.mil/bigbang-ci/devops-tester:1.1.2', 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] + images: + - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 + - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 - version: 3.11.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.5 @@ -4384,17 +5842,20 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No concrete feature details were provided in the pasted release notes; - only an admin message about currently supported Big Bang versions appears - for 3.10.0 and 3.11.0.] - breaking_changes: [No breaking-change information was provided in the pasted - release notes.] + features: + - No concrete feature details were provided in the pasted release notes; only + an admin message about currently supported Big Bang versions appears for 3.10.0 + and 3.11.0. + breaking_changes: + - No breaking-change information was provided in the pasted release notes. chart_version: 3.11.0 - images: ['registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-09-07T16-13-09Z', - 'registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-10-15T17-29-55Z', - 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] + images: + - registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-09-07T16-13-09Z + - registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-10-15T17-29-55Z + - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 - version: 3.10.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.4 @@ -4489,26 +5950,32 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang platform release bump from **3.9.0 \u2192 3.10.0**\ - \ with multiple packaged component chart version updates.", "Notable chart\ - \ version jumps include **Argo CD 8.5.8-bb.2 \u2192 9.0.3-bb.0** (major\ - \ chart upgrade) and **Mattermost 10.12.0-bb.1 \u2192 11.0.2-bb.0** (major\ - \ app/chart upgrade).", "Istio stack patched **1.27.1 \u2192 1.27.3** across\ - \ CNI/CRDs/Gateway/Istiod.", 'Various bb patch bumps across components (e.g., - Alloy, Anchore, GitLab, Harbor, Velero) indicating Big Bang-specific fixes - rather than upstream major changes.'] - features: [No explicit new features were provided in the notes excerpt; this - release primarily appears to be a roll-up of component version updates and - Big Bang packaging fixes.] - breaking_changes: ["Potential breaking change risk due to **Argo CD chart major\ - \ version upgrade (8.x \u2192 9.x)**; verify Argo CD values compatibility\ - \ and CRD/app-of-apps behavior before upgrade.", "Potential breaking change\ - \ risk due to **Mattermost major upgrade (10.x \u2192 11.x)**; confirm database/schema\ - \ upgrade requirements and any config deprecations."] + chart_updates: + - "Big Bang platform release bump from **3.9.0 \u2192 3.10.0** with multiple\ + \ packaged component chart version updates." + - "Notable chart version jumps include **Argo CD 8.5.8-bb.2 \u2192 9.0.3-bb.0**\ + \ (major chart upgrade) and **Mattermost 10.12.0-bb.1 \u2192 11.0.2-bb.0**\ + \ (major app/chart upgrade)." + - "Istio stack patched **1.27.1 \u2192 1.27.3** across CNI/CRDs/Gateway/Istiod." + - Various bb patch bumps across components (e.g., Alloy, Anchore, GitLab, Harbor, + Velero) indicating Big Bang-specific fixes rather than upstream major changes. + features: + - No explicit new features were provided in the notes excerpt; this release + primarily appears to be a roll-up of component version updates and Big Bang + packaging fixes. + breaking_changes: + - "Potential breaking change risk due to **Argo CD chart major version upgrade\ + \ (8.x \u2192 9.x)**; verify Argo CD values compatibility and CRD/app-of-apps\ + \ behavior before upgrade." + - "Potential breaking change risk due to **Mattermost major upgrade (10.x \u2192\ + \ 11.x)**; confirm database/schema upgrade requirements and any config deprecations." chart_version: 3.10.0 - images: ['registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5', 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33'] + images: + - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5 + - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33 - version: 3.9.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.3 @@ -4603,25 +6070,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang minor release from 3.8.0 to 3.9.0 with component chart - version bumps across multiple packages (Argo CD, Authservice, ESO, Gatekeeper, - Grafana, Harbor, Keycloak, Vault, etc.).', "No explicit helm values migrations\ - \ or chart structure changes were provided in the supplied notes; treat\ - \ as a dependency refresh and review each package\u2019s own CHANGELOG for\ - \ required values updates."] - features: ['Various component updates bring incremental fixes and improvements - (e.g., Argo CD, External Secrets Operator, Gatekeeper, Grafana, Harbor, - Keycloak, Vault), but no specific new Big Bang-level features were listed - in the provided excerpt.'] - breaking_changes: ["Potential breaking changes may come from major/minor bumps\ - \ in included components (notably Grafana 9.x \u2192 10.0, Authservice 1.0\ - \ \u2192 1.1, ESO 0.19 \u2192 0.20, Gatekeeper 3.19 \u2192 3.20, Vault 0.30\ - \ \u2192 0.31, Keycloak chart 7.0 \u2192 7.1). Verify each component\u2019\ - s release notes for deprecations and value changes before upgrading."] + chart_updates: + - Big Bang minor release from 3.8.0 to 3.9.0 with component chart version bumps + across multiple packages (Argo CD, Authservice, ESO, Gatekeeper, Grafana, + Harbor, Keycloak, Vault, etc.). + - "No explicit helm values migrations or chart structure changes were provided\ + \ in the supplied notes; treat as a dependency refresh and review each package\u2019\ + s own CHANGELOG for required values updates." + features: + - Various component updates bring incremental fixes and improvements (e.g., + Argo CD, External Secrets Operator, Gatekeeper, Grafana, Harbor, Keycloak, + Vault), but no specific new Big Bang-level features were listed in the provided + excerpt. + breaking_changes: + - "Potential breaking changes may come from major/minor bumps in included components\ + \ (notably Grafana 9.x \u2192 10.0, Authservice 1.0 \u2192 1.1, ESO 0.19 \u2192\ + \ 0.20, Gatekeeper 3.19 \u2192 3.20, Vault 0.30 \u2192 0.31, Keycloak chart\ + \ 7.0 \u2192 7.1). Verify each component\u2019s release notes for deprecations\ + \ and value changes before upgrading." chart_version: 3.9.0 images: [] - version: 3.8.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.2 @@ -4717,15 +6188,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No actionable application release notes were provided beyond the - header and an admin message stating the currently supported Big Bang version - is 3.25.0.] - breaking_changes: ['Release notes content for 3.7.0 and 3.8.0 was not included, - so breaking changes (if any) cannot be determined from the provided text.'] + features: + - No actionable application release notes were provided beyond the header and + an admin message stating the currently supported Big Bang version is 3.25.0. + breaking_changes: + - Release notes content for 3.7.0 and 3.8.0 was not included, so breaking changes + (if any) cannot be determined from the provided text. chart_version: 3.8.0 - images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6'] + images: + - registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6 - version: 3.7.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.1 @@ -4821,13 +6295,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Big Bang 3.7.0 indicates the supported Big Bang Version in the admin - message is 3.25.0 (up from 3.23.0 in 3.6.0).] + features: + - Big Bang 3.7.0 indicates the supported Big Bang Version in the admin message + is 3.25.0 (up from 3.23.0 in 3.6.0). breaking_changes: [] chart_version: 3.7.0 images: [] - version: 3.6.0 - kube: ['1.33'] + kube: + - '1.33' requirements: - name: Alloy version: 3.2.1-bb.1 @@ -4923,14 +6399,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Release notes provided only show an 'Admin message' about the currently - supported Big Bang version; no feature details were included in the excerpts.] - breaking_changes: [Cannot determine breaking changes from the provided excerpts; - only the supported-version notice is shown.] + features: + - Release notes provided only show an 'Admin message' about the currently supported + Big Bang version; no feature details were included in the excerpts. + breaking_changes: + - Cannot determine breaking changes from the provided excerpts; only the supported-version + notice is shown. chart_version: 3.6.0 images: [] - version: 3.5.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 3.2.1-bb.1 @@ -5023,23 +6502,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Component version bumps across multiple packages (Anchore, - GitLab, Grafana, Harbor, Headlamp, Istiod, Keycloak, Kiali, Loki, Mattermost, - Minio, Monitoring, NeuVector, Velero, External Secrets Operator).', Added - `prometheus-operator-crds` package (22.0.1-bb.0)., Removed `promtail` package., - Removed package labeled `New` (22.0.1-bb.0) that existed in 3.4.0 context.] - features: ['Introduces Prometheus Operator CRDs as a dedicated package, which - can simplify CRD lifecycle management and reduce CRD-related upgrade issues.'] - breaking_changes: ['Removal of Promtail means any log shipping previously handled - by Promtail must be replaced/disabled in values and validated (e.g., ensure - Loki ingestion still has an agent such as Grafana Agent/Alloy/Fluent Bit - if required).', 'If `New` package was deployed/relied upon, it is no longer - available; confirm no values reference it and migrate any functionality - accordingly.'] + chart_updates: + - Component version bumps across multiple packages (Anchore, GitLab, Grafana, + Harbor, Headlamp, Istiod, Keycloak, Kiali, Loki, Mattermost, Minio, Monitoring, + NeuVector, Velero, External Secrets Operator). + - Added `prometheus-operator-crds` package (22.0.1-bb.0). + - Removed `promtail` package. + - Removed package labeled `New` (22.0.1-bb.0) that existed in 3.4.0 context. + features: + - Introduces Prometheus Operator CRDs as a dedicated package, which can simplify + CRD lifecycle management and reduce CRD-related upgrade issues. + breaking_changes: + - Removal of Promtail means any log shipping previously handled by Promtail + must be replaced/disabled in values and validated (e.g., ensure Loki ingestion + still has an agent such as Grafana Agent/Alloy/Fluent Bit if required). + - If `New` package was deployed/relied upon, it is no longer available; confirm + no values reference it and migrate any functionality accordingly. chart_version: 3.5.0 - images: ['registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.12.1'] + images: + - registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.12.1 - version: 3.4.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 3.2.1-bb.1 @@ -5134,29 +6618,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang umbrella chart upgraded from 3.3.0 to 3.4.0, pulling - newer versions of many packaged components (Argo CD, GitLab, Istio, Kiali, - Thanos, etc.).', "Component bumps include several patch-level bb revisions\ - \ (e.g., Anchore, ESO, Harbor, Monitoring, Vault) and some minor/feature\ - \ bumps (e.g., Argo CD 8.0.10\u21928.2.5, GitLab 9.1.2\u21929.2.1, Kiali\ - \ 2.10\u21922.12, Thanos 16.0.2\u219217.2.2, Nexus 81.1.0\u219282.0.0).", - A new component (listed as "New" version 22.0.1-bb.0) is introduced in 3.4.0; - validate what it is and whether it is enabled by default in your values.] - features: ['Introduces a new packaged component ("New" at 22.0.1-bb.0); confirm - its purpose, defaults, and required configuration before enabling.', 'Updates - observability stack components (Alloy, Fluentbit, Thanos) which may bring - new metrics/logging behavior and configuration options.', 'Upgrades delivery - and platform tooling (Argo CD, GitLab, GitLab Runner, Headlamp, Kiali) bringing - incremental features and fixes from upstream charts.'] - breaking_changes: ["No explicit breaking changes were provided in the notes\ - \ you shared; treat major/minor bumps (Thanos 16\u219217, Nexus 81\u2192\ - 82, Kiali 2.10\u21922.12, Argo CD 8.0\u21928.2) as potential sources of\ - \ behavioral changes and review each component\u2019s upstream upgrade notes\ - \ before production rollout."] + chart_updates: + - Big Bang umbrella chart upgraded from 3.3.0 to 3.4.0, pulling newer versions + of many packaged components (Argo CD, GitLab, Istio, Kiali, Thanos, etc.). + - "Component bumps include several patch-level bb revisions (e.g., Anchore,\ + \ ESO, Harbor, Monitoring, Vault) and some minor/feature bumps (e.g., Argo\ + \ CD 8.0.10\u21928.2.5, GitLab 9.1.2\u21929.2.1, Kiali 2.10\u21922.12, Thanos\ + \ 16.0.2\u219217.2.2, Nexus 81.1.0\u219282.0.0)." + - A new component (listed as "New" version 22.0.1-bb.0) is introduced in 3.4.0; + validate what it is and whether it is enabled by default in your values. + features: + - Introduces a new packaged component ("New" at 22.0.1-bb.0); confirm its purpose, + defaults, and required configuration before enabling. + - Updates observability stack components (Alloy, Fluentbit, Thanos) which may + bring new metrics/logging behavior and configuration options. + - Upgrades delivery and platform tooling (Argo CD, GitLab, GitLab Runner, Headlamp, + Kiali) bringing incremental features and fixes from upstream charts. + breaking_changes: + - "No explicit breaking changes were provided in the notes you shared; treat\ + \ major/minor bumps (Thanos 16\u219217, Nexus 81\u219282, Kiali 2.10\u2192\ + 2.12, Argo CD 8.0\u21928.2) as potential sources of behavioral changes and\ + \ review each component\u2019s upstream upgrade notes before production rollout." chart_version: 3.4.0 - images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.10', 'registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6'] + images: + - registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.10 + - registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6 - version: 3.3.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 3.0.2-bb.0 @@ -5249,27 +6738,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang umbrella chart upgraded from 3.2.0 to 3.3.0, updating - and adding multiple packaged components (see version list below).', 'New - optional packages introduced in this release include: GitLab, Harbor, Grafana, - Loki, Vault, Mattermost, Nexus Repository Manager, SonarQube, External Secrets - Operator, Headlamp, Kiali, Kyverno Reporter, Istio Gateway, Elasticsearch - Kibana, and bbctl.'] - features: ["Introduces several new built-in packages (e.g., GitLab, Harbor,\ - \ Grafana/Loki stack, Vault, Mattermost, Nexus, SonarQube) that can be enabled\ - \ to expand the platform\u2019s CI/CD, artifact, observability, and secrets\ - \ capabilities.", Adds External Secrets Operator as an available integration - for syncing secrets from external backends., Adds bbctl as a new component - to assist with Big Bang operations (packaged starting 2.0.0-bb.3).] - breaking_changes: ["No explicit breaking changes were provided in the notes\ - \ you supplied; however, multiple major version bumps (e.g., Alloy 2\u2192\ - 3, Anchore 3.7\u21923.10, Kyverno 3.3\u21923.4, Monitoring 73\u219275, Istio\ - \ 1.26.1\u21921.26.2) may include behavior changes and should be treated\ - \ as potential breaking changes pending upstream component release notes."] + chart_updates: + - Big Bang umbrella chart upgraded from 3.2.0 to 3.3.0, updating and adding + multiple packaged components (see version list below). + - 'New optional packages introduced in this release include: GitLab, Harbor, + Grafana, Loki, Vault, Mattermost, Nexus Repository Manager, SonarQube, External + Secrets Operator, Headlamp, Kiali, Kyverno Reporter, Istio Gateway, Elasticsearch + Kibana, and bbctl.' + features: + - "Introduces several new built-in packages (e.g., GitLab, Harbor, Grafana/Loki\ + \ stack, Vault, Mattermost, Nexus, SonarQube) that can be enabled to expand\ + \ the platform\u2019s CI/CD, artifact, observability, and secrets capabilities." + - Adds External Secrets Operator as an available integration for syncing secrets + from external backends. + - Adds bbctl as a new component to assist with Big Bang operations (packaged + starting 2.0.0-bb.3). + breaking_changes: + - "No explicit breaking changes were provided in the notes you supplied; however,\ + \ multiple major version bumps (e.g., Alloy 2\u21923, Anchore 3.7\u21923.10,\ + \ Kyverno 3.3\u21923.4, Monitoring 73\u219275, Istio 1.26.1\u21921.26.2) may\ + \ include behavior changes and should be treated as potential breaking changes\ + \ pending upstream component release notes." chart_version: 3.3.0 - images: ['registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-mailroom:18.1.0'] + images: + - registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-mailroom:18.1.0 - version: 3.2.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 2.0.27-bb.3 @@ -5362,22 +6857,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang 3.2.0 release removes a large set of previously bundled - components from the umbrella chart., A new component entry appears as `new` - at version `0.30.0-bb.7` (exact identity unclear from provided notes).] - features: ['Slimmer Big Bang bundle: many optional add-ons are no longer included - by default and must be deployed separately if needed.'] - breaking_changes: ['Removal of bundled components (bbctl, GitLab, Harbor, Grafana, - Loki, Vault, Istio Gateway, Kiali, etc.) is a breaking change: existing - installations relying on these being managed by Big Bang will no longer - be upgraded/managed and may be removed depending on your Helm values and - existing releases.', Any values previously set under removed components - in `values.yaml` will become unused/invalid; you must migrate those components - to separate charts/operators or alternative deployment methods.] + chart_updates: + - Big Bang 3.2.0 release removes a large set of previously bundled components + from the umbrella chart. + - A new component entry appears as `new` at version `0.30.0-bb.7` (exact identity + unclear from provided notes). + features: + - 'Slimmer Big Bang bundle: many optional add-ons are no longer included by + default and must be deployed separately if needed.' + breaking_changes: + - 'Removal of bundled components (bbctl, GitLab, Harbor, Grafana, Loki, Vault, + Istio Gateway, Kiali, etc.) is a breaking change: existing installations relying + on these being managed by Big Bang will no longer be upgraded/managed and + may be removed depending on your Helm values and existing releases.' + - Any values previously set under removed components in `values.yaml` will become + unused/invalid; you must migrate those components to separate charts/operators + or alternative deployment methods. chart_version: 3.2.0 images: [] - version: 3.1.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 2.0.27-bb.3 @@ -5470,25 +6970,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang meta-chart updated from 3.0.0 to 3.1.0, updating bundled\ - \ component charts to the listed versions (notable jumps: ArgoCD 7.9.0-bb.0\u2192\ - 8.0.10-bb.0, Istio 1.25.3\u21921.26.1, Monitoring 72.2.0\u219273.2.0, Velero\ - \ 8.7.1\u219210.0.1, External Secrets 0.16.2\u21920.17.0, Twistlock 0.20.1\u2192\ - 0.21.0, Headlamp 0.30.1\u21920.31.1)."] - features: ['Component refresh across the distribution, including newer ArgoCD - (major chart bump), Istio 1.26, and Monitoring chart update.', 'Velero upgraded - to the 10.x chart series, bringing in upstream changes and potentially new - CRDs/backup flow behavior.'] - breaking_changes: ["Potential breaking changes due to major version bumps in\ - \ ArgoCD chart (7.x\u21928.x) and Velero chart (8.x\u219210.x); review each\ - \ component\u2019s upgrade notes for required CRD/application changes and\ - \ value deprecations.", "Istio upgrade 1.25\u21921.26 may require API/CRD\ - \ and mesh behavior validation; ensure CRDs and gateways are upgraded in\ - \ correct order (CRDs before control plane/gateways)."] + chart_updates: + - "Big Bang meta-chart updated from 3.0.0 to 3.1.0, updating bundled component\ + \ charts to the listed versions (notable jumps: ArgoCD 7.9.0-bb.0\u21928.0.10-bb.0,\ + \ Istio 1.25.3\u21921.26.1, Monitoring 72.2.0\u219273.2.0, Velero 8.7.1\u2192\ + 10.0.1, External Secrets 0.16.2\u21920.17.0, Twistlock 0.20.1\u21920.21.0,\ + \ Headlamp 0.30.1\u21920.31.1)." + features: + - Component refresh across the distribution, including newer ArgoCD (major chart + bump), Istio 1.26, and Monitoring chart update. + - Velero upgraded to the 10.x chart series, bringing in upstream changes and + potentially new CRDs/backup flow behavior. + breaking_changes: + - "Potential breaking changes due to major version bumps in ArgoCD chart (7.x\u2192\ + 8.x) and Velero chart (8.x\u219210.x); review each component\u2019s upgrade\ + \ notes for required CRD/application changes and value deprecations." + - "Istio upgrade 1.25\u21921.26 may require API/CRD and mesh behavior validation;\ + \ ensure CRDs and gateways are upgraded in correct order (CRDs before control\ + \ plane/gateways)." chart_version: 3.1.0 images: [] - version: 3.0.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 2.0.27-bb.0 @@ -5582,16 +7086,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No detailed Big Bang 3.0.0 release notes were provided in the excerpt - beyond the admin message indicating the currently supported Big Bang version - (3.22.1).] - breaking_changes: ["Upgrade crosses a major version boundary (2.x \u2192 3.x),\ - \ so assume breaking changes exist; review the full 3.0.0 release notes\ - \ and Big Bang upgrade guides before proceeding."] + features: + - No detailed Big Bang 3.0.0 release notes were provided in the excerpt beyond + the admin message indicating the currently supported Big Bang version (3.22.1). + breaking_changes: + - "Upgrade crosses a major version boundary (2.x \u2192 3.x), so assume breaking\ + \ changes exist; review the full 3.0.0 release notes and Big Bang upgrade\ + \ guides before proceeding." chart_version: 3.0.0 images: [] - version: 2.54.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Alloy version: 2.0.27-bb.0 @@ -5693,18 +7199,20 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided only include the \u201CAdmin message\u201D\ - \ about the currently supported Big Bang version; no other feature details\ - \ were included."] - breaking_changes: ["Potential compatibility/support break: the \u201Ccurrently\ - \ supported Big Bang version\u201D differs between 2.53.0 (3.23.0) and 2.54.0\ - \ (3.20.0) per the provided notes; verify intended support matrix and whether\ - \ this indicates a documentation/error or a change in supported upstream\ - \ dependencies."] + features: + - "Release notes provided only include the \u201CAdmin message\u201D about the\ + \ currently supported Big Bang version; no other feature details were included." + breaking_changes: + - "Potential compatibility/support break: the \u201Ccurrently supported Big\ + \ Bang version\u201D differs between 2.53.0 (3.23.0) and 2.54.0 (3.20.0) per\ + \ the provided notes; verify intended support matrix and whether this indicates\ + \ a documentation/error or a change in supported upstream dependencies." chart_version: 2.54.0 - images: ['registry1.dso.mil/bigbang/istio-gateway:1.25.2-bb.1'] + images: + - registry1.dso.mil/bigbang/istio-gateway:1.25.2-bb.1 - version: 2.53.0 - kube: ['1.32'] + kube: + - '1.32' requirements: - name: Updated version: 2.0.27-bb.0 @@ -5805,25 +7313,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang core version updated from 2.52.0 to 2.53.0., 'Large - component set reshuffle: multiple components newly added and many removed - (see breaking changes).'] - features: ['Adds/introduces several components to the Big Bang bundle: bbctl, - ECK Operator, Elasticsearch/Kibana, Istio CRDs and Gateway, Jaeger, Kyverno - Policies, MinIO and MinIO Operator, Nexus, Thanos, Twistlock.', Updates - some existing component versions (notably one component from 0.30.0-bb.1 - to 0.4.15 and another from 2.5.1-bb.0 to 0.30.1-bb.1).] - breaking_changes: ['Removes many previously-included components (Alloy, Anchore - Enterprise, Authservice, External Secrets, Fluentbit, Gitlab Runner, Istio - Controlplane, Kiali, Mattermost Operator, Neuvector, Promtail, Tempo, Wrapper). - This can break deployments relying on those charts/CRDs/values or related - integrations.', 'Istio packaging changes: Istio Controlplane is removed - and replaced by separate Istio CRDs and Istio Gateway components, requiring - review of Istio-related values and manifests.'] + chart_updates: + - Big Bang core version updated from 2.52.0 to 2.53.0. + - 'Large component set reshuffle: multiple components newly added and many removed + (see breaking changes).' + features: + - 'Adds/introduces several components to the Big Bang bundle: bbctl, ECK Operator, + Elasticsearch/Kibana, Istio CRDs and Gateway, Jaeger, Kyverno Policies, MinIO + and MinIO Operator, Nexus, Thanos, Twistlock.' + - Updates some existing component versions (notably one component from 0.30.0-bb.1 + to 0.4.15 and another from 2.5.1-bb.0 to 0.30.1-bb.1). + breaking_changes: + - Removes many previously-included components (Alloy, Anchore Enterprise, Authservice, + External Secrets, Fluentbit, Gitlab Runner, Istio Controlplane, Kiali, Mattermost + Operator, Neuvector, Promtail, Tempo, Wrapper). This can break deployments + relying on those charts/CRDs/values or related integrations. + - 'Istio packaging changes: Istio Controlplane is removed and replaced by separate + Istio CRDs and Istio Gateway components, requiring review of Istio-related + values and manifests.' chart_version: 2.53.0 - images: ['docker.io/grafana/grafana-image-renderer:latest'] + images: + - docker.io/grafana/grafana-image-renderer:latest - version: 2.52.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Alloy version: 2.0.23-bb.0 @@ -5924,13 +7437,15 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: ["Release notes provided only include an admin message about\ - \ the currently supported Big Bang version; no functional changes, features,\ - \ or breaking changes were listed for 2.51.0 \u2192 2.52.0."] + breaking_changes: + - "Release notes provided only include an admin message about the currently\ + \ supported Big Bang version; no functional changes, features, or breaking\ + \ changes were listed for 2.51.0 \u2192 2.52.0." chart_version: 2.52.0 images: [] - version: 2.51.0 - kube: ['1.31'] + kube: + - '1.31' requirements: - name: Updated version: 2.0.23-bb.0 @@ -6024,14 +7539,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Admin message indicates the 'Currently supported Big Bang Version' - increased from 3.20.0 (in 2.50.0 notes) to 3.25.0 (in 2.51.0 notes).] + features: + - Admin message indicates the 'Currently supported Big Bang Version' increased + from 3.20.0 (in 2.50.0 notes) to 3.25.0 (in 2.51.0 notes). breaking_changes: [] chart_version: 2.51.0 - images: ['registry-1.docker.io/bitnamicharts/postgresql:16.6.0', 'registry1.dso.mil/ironbank/big-bang/base:2.1.0', - 'registry1.dso.mil/ironbank/stedolan/jq:1.7.1', 'registry1.dso.mil/bigbang-ci/devops-tester:1.1.2'] + images: + - registry-1.docker.io/bitnamicharts/postgresql:16.6.0 + - registry1.dso.mil/ironbank/big-bang/base:2.1.0 + - registry1.dso.mil/ironbank/stedolan/jq:1.7.1 + - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 - version: 2.50.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 2.0.16-bb.2 @@ -6123,16 +7643,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No functional changes identified from the provided notes; only an - 'Admin message' about the currently supported Big Bang version is shown.] - breaking_changes: ['Potential support/policy change: the ''Currently supported - Big Bang Version'' message changes between 2.49.0 (3.22.1) and 2.50.0 (3.20.0). - This may indicate a documentation/support statement change rather than a - breaking runtime change, but verify before upgrading.'] + features: + - No functional changes identified from the provided notes; only an 'Admin message' + about the currently supported Big Bang version is shown. + breaking_changes: + - 'Potential support/policy change: the ''Currently supported Big Bang Version'' + message changes between 2.49.0 (3.22.1) and 2.50.0 (3.20.0). This may indicate + a documentation/support statement change rather than a breaking runtime change, + but verify before upgrading.' chart_version: 2.50.0 images: [] - version: 2.49.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 2.0.16-bb.0 @@ -6223,24 +7746,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang chart version updated from `0.29.1-bb.8` to `0.29.1-bb.9`., - 'Large component set change: multiple packages removed and multiple new packages - added (see features/breaking changes).'] - features: ['Adds several new optional/managed packages to the Big Bang release - (Elasticsearch Kibana, Fluentbit, Grafana, Holocron, Istio Controlplane/Operator, - Kyverno, Kyverno Reporter, Minio, Promtail, Tempo).', Introduces an updated - Big Bang chart build (`0.29.1-bb.9`).] - breaking_changes: ['Removes multiple previously-included packages from the distribution - (Anchore Enterprise, Gatekeeper, Gitlab Runner, Jaeger, Kiali, Kyverno Policies, - Metrics Server, Monitoring, Twistlock). Upgrade may require disabling/migrating - these workloads and adjusting values, CRDs, and dependencies accordingly.', - 'If you relied on removed observability/security components (Monitoring stack, - Jaeger, Kiali, Twistlock, Anchore), you must plan replacements (e.g., Grafana/Tempo/Promtail/Fluentbit) - and ensure data/alerting/tracing continuity.'] + chart_updates: + - Big Bang chart version updated from `0.29.1-bb.8` to `0.29.1-bb.9`. + - 'Large component set change: multiple packages removed and multiple new packages + added (see features/breaking changes).' + features: + - Adds several new optional/managed packages to the Big Bang release (Elasticsearch + Kibana, Fluentbit, Grafana, Holocron, Istio Controlplane/Operator, Kyverno, + Kyverno Reporter, Minio, Promtail, Tempo). + - Introduces an updated Big Bang chart build (`0.29.1-bb.9`). + breaking_changes: + - Removes multiple previously-included packages from the distribution (Anchore + Enterprise, Gatekeeper, Gitlab Runner, Jaeger, Kiali, Kyverno Policies, Metrics + Server, Monitoring, Twistlock). Upgrade may require disabling/migrating these + workloads and adjusting values, CRDs, and dependencies accordingly. + - If you relied on removed observability/security components (Monitoring stack, + Jaeger, Kiali, Twistlock, Anchore), you must plan replacements (e.g., Grafana/Tempo/Promtail/Fluentbit) + and ensure data/alerting/tracing continuity. chart_version: 2.49.0 images: [] - version: 2.48.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 2.0.4-bb.0 @@ -6330,14 +7857,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Admin message updates the \u201CCurrently supported Big Bang Version\u201D\ - \ from 3.23.0 (in 2.47.0 notes) to 3.22.1 (in 2.48.0 notes)."] + features: + - "Admin message updates the \u201CCurrently supported Big Bang Version\u201D\ + \ from 3.23.0 (in 2.47.0 notes) to 3.22.1 (in 2.48.0 notes)." breaking_changes: [] chart_version: 2.48.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:3.0.0'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:3.0.0 - version: 2.47.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Alloy version: 1.6.18-bb.0 @@ -6426,19 +7956,23 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang version bump: 2.46.0 \u2192 2.47.0.", 'Large component - set change: multiple packages added and multiple packages removed (see lists).'] - features: ['Adds several new optional packages to the Big Bang bundle (Anchore - Enterprise, ECK Operator, Elasticsearch/Kibana, GitLab Runner, Kyverno, - Mimir, Nexus, Sonarqube, Twistlock, Velero).'] - breaking_changes: ['Removes multiple previously-included packages (Authservice, - HAProxy, Keycloak, Neuvector, Promtail and others listed), which can break - clusters relying on those components for auth, ingress, security scanning, - or logging.'] + chart_updates: + - "Big Bang version bump: 2.46.0 \u2192 2.47.0." + - 'Large component set change: multiple packages added and multiple packages + removed (see lists).' + features: + - Adds several new optional packages to the Big Bang bundle (Anchore Enterprise, + ECK Operator, Elasticsearch/Kibana, GitLab Runner, Kyverno, Mimir, Nexus, + Sonarqube, Twistlock, Velero). + breaking_changes: + - Removes multiple previously-included packages (Authservice, HAProxy, Keycloak, + Neuvector, Promtail and others listed), which can break clusters relying on + those components for auth, ingress, security scanning, or logging. chart_version: 2.47.0 images: [] - version: 2.46.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Alloy version: 1.6.18-bb.0 @@ -6527,32 +8061,37 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.46.0 is a large platform composition change: many - components are newly introduced while several previously bundled components - are removed.', GitLab is upgraded from 8.6.2-bb.0 to 8.8.1-bb.0., "A major\ - \ version jump is indicated for one component (0.4.12 \u2192 8.3.0-bb.0),\ - \ suggesting significant underlying changes; confirm which subchart this\ - \ refers to in the official release notes/values docs before upgrading."] - features: [Adds Alloy (1.6.18-bb.0) as a new component., 'Adds policy/security/controls - components Gatekeeper (3.18.2-bb.0), Kyverno Policies (3.3.4-bb.1), and - Kyverno Reporter (2.24.2-bb.2).', 'Adds developer and platform services - Harbor (1.16.1-bb.0), Keycloak (2.5.1-bb.5), Mattermost (10.4.2-bb.0), Thanos - (15.9.1-bb.0), Promtail (6.16.6-bb.0), Istio Operator and Controlplane (1.23.4-bb.0).', - Adds Fortify (1.1.2320154-bb.22) as a new component.] - breaking_changes: ['Multiple previously deployed components are removed from - the Big Bang bundle (ECK Operator, Elasticsearch/Kibana, Fluentbit, Gitlab - Runner, Jaeger, Kyverno, Minio, Monitoring, Nexus, Twistlock). If you relied - on any of these, you must plan replacements/migrations and ensure dependent - apps are reconfigured.', 'Logging/monitoring stack changes (e.g., removal - of Fluentbit/Monitoring and addition of Promtail/Alloy/Thanos) can break - log and metric pipelines; expect config and data-path changes.', 'Kyverno - is removed while Kyverno Policies/Reporter are added; if you used Kyverno - admission controls, verify the intended replacement/architecture and update - policy deployment approach.'] + chart_updates: + - 'Big Bang 2.46.0 is a large platform composition change: many components are + newly introduced while several previously bundled components are removed.' + - GitLab is upgraded from 8.6.2-bb.0 to 8.8.1-bb.0. + - "A major version jump is indicated for one component (0.4.12 \u2192 8.3.0-bb.0),\ + \ suggesting significant underlying changes; confirm which subchart this refers\ + \ to in the official release notes/values docs before upgrading." + features: + - Adds Alloy (1.6.18-bb.0) as a new component. + - Adds policy/security/controls components Gatekeeper (3.18.2-bb.0), Kyverno + Policies (3.3.4-bb.1), and Kyverno Reporter (2.24.2-bb.2). + - Adds developer and platform services Harbor (1.16.1-bb.0), Keycloak (2.5.1-bb.5), + Mattermost (10.4.2-bb.0), Thanos (15.9.1-bb.0), Promtail (6.16.6-bb.0), Istio + Operator and Controlplane (1.23.4-bb.0). + - Adds Fortify (1.1.2320154-bb.22) as a new component. + breaking_changes: + - Multiple previously deployed components are removed from the Big Bang bundle + (ECK Operator, Elasticsearch/Kibana, Fluentbit, Gitlab Runner, Jaeger, Kyverno, + Minio, Monitoring, Nexus, Twistlock). If you relied on any of these, you must + plan replacements/migrations and ensure dependent apps are reconfigured. + - Logging/monitoring stack changes (e.g., removal of Fluentbit/Monitoring and + addition of Promtail/Alloy/Thanos) can break log and metric pipelines; expect + config and data-path changes. + - Kyverno is removed while Kyverno Policies/Reporter are added; if you used + Kyverno admission controls, verify the intended replacement/architecture and + update policy deployment approach. chart_version: 2.46.0 images: [] - version: 2.45.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.6.18-bb.0 @@ -6639,28 +8178,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang release 2.45.0 updates the umbrella chart to version - 0.4.12 (from 0.4.11)., A large number of previously bundled/managed packages - are removed from the Big Bang bundle in 2.45.0., 'Several packages are introduced - as new managed components: ECK Operator, Elasticsearch/Kibana, Fluent Bit, - and GitLab Runner.'] - features: [Adds first-class support for ECK Operator as a managed package (enabling - Elastic stack operator-based deployments)., Adds managed Elasticsearch/Kibana - package to provide an Elastic stack option within the Big Bang bundle., - Adds Fluent Bit as a managed log forwarder/collector option within the bundle., - Adds GitLab Runner as a managed component for executing CI jobs within the - cluster.] - breaking_changes: ['Removes many previously included packages (e.g., Istio controlplane/operator, - Argo CD, Gatekeeper, Harbor, Vault, Kyverno, External Secrets, etc.); any - deployments relying on Big Bang to install/upgrade these will no longer - be managed and may be removed during upgrade depending on your configuration.', - 'Logging and observability stack expectations may change due to removal of - Promtail/Thanos and addition of Fluent Bit/Elastic components; dashboards, - outputs, and pipelines may need rework.'] + chart_updates: + - Big Bang release 2.45.0 updates the umbrella chart to version 0.4.12 (from + 0.4.11). + - A large number of previously bundled/managed packages are removed from the + Big Bang bundle in 2.45.0. + - 'Several packages are introduced as new managed components: ECK Operator, + Elasticsearch/Kibana, Fluent Bit, and GitLab Runner.' + features: + - Adds first-class support for ECK Operator as a managed package (enabling Elastic + stack operator-based deployments). + - Adds managed Elasticsearch/Kibana package to provide an Elastic stack option + within the Big Bang bundle. + - Adds Fluent Bit as a managed log forwarder/collector option within the bundle. + - Adds GitLab Runner as a managed component for executing CI jobs within the + cluster. + breaking_changes: + - Removes many previously included packages (e.g., Istio controlplane/operator, + Argo CD, Gatekeeper, Harbor, Vault, Kyverno, External Secrets, etc.); any + deployments relying on Big Bang to install/upgrade these will no longer be + managed and may be removed during upgrade depending on your configuration. + - Logging and observability stack expectations may change due to removal of + Promtail/Thanos and addition of Fluent Bit/Elastic components; dashboards, + outputs, and pipelines may need rework. chart_version: 2.45.0 images: [] - version: 2.44.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.6.16-bb.0 @@ -6750,14 +8295,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Release notes content not provided beyond admin message; need the - full 2.44.0 notes diff vs 2.43.0 to extract features.] - breaking_changes: [Release notes content not provided beyond admin message; - need the full 2.44.0 notes diff vs 2.43.0 to identify breaking changes.] + features: + - Release notes content not provided beyond admin message; need the full 2.44.0 + notes diff vs 2.43.0 to extract features. + breaking_changes: + - Release notes content not provided beyond admin message; need the full 2.44.0 + notes diff vs 2.43.0 to identify breaking changes. chart_version: 2.44.0 images: [] - version: 2.43.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Alloy version: 1.6.13-bb.0 @@ -6847,14 +8395,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No concrete release-note content for 2.43.0 was provided beyond headings; - cannot extract features from the text shared.] - breaking_changes: [No concrete breaking-change information for 2.43.0 was provided; - treat as unknown until the actual 2.43.0 notes are reviewed.] + features: + - No concrete release-note content for 2.43.0 was provided beyond headings; + cannot extract features from the text shared. + breaking_changes: + - No concrete breaking-change information for 2.43.0 was provided; treat as + unknown until the actual 2.43.0 notes are reviewed. chart_version: 2.43.0 images: [] - version: 2.42.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.6.13-bb.0 @@ -6942,15 +8493,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No application-level changes were provided in the notes you shared - beyond an admin message indicating the currently supported Big Bang version - is 3.23.0 (appears unchanged between 2.41.0 and 2.42.0).] - breaking_changes: [No breaking changes were included in the release notes you - provided.] + features: + - No application-level changes were provided in the notes you shared beyond + an admin message indicating the currently supported Big Bang version is 3.23.0 + (appears unchanged between 2.41.0 and 2.42.0). + breaking_changes: + - No breaking changes were included in the release notes you provided. chart_version: 2.42.0 images: [] - version: 2.41.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Alloy version: 1.6.4-bb.0 @@ -7039,29 +8592,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.41.0 changes appear to be primarily a component - set reshuffle: several components were removed from the default bundle and - several new components were added.', "One component listed as \"Updated:\ - \ 7.2.2-bb.0 \u2192 7.2.2-bb.3\" (component name not provided in notes you\ - \ pasted) received a patch-level bump."] - features: [Adds Alloy (1.6.4-bb.0) as a new component in the Big Bang bundle., - Adds Gatekeeper (3.17.1-bb.2) as a new component in the Big Bang bundle., - Adds Holocron (1.0.12) as a new component in the Big Bang bundle., Adds Minio - (6.0.4-bb.2) as a new component in the Big Bang bundle., Adds Monitoring - (62.4.0-bb.1) as a new component in the Big Bang bundle.] - breaking_changes: [Removes Argo CD from the Big Bang bundle; existing Argo CD - installs must be managed separately or migrated to an alternative deployment - approach., 'Removes External Secrets from the bundle; any workloads depending - on it will need a replacement (e.g., ESO installed independently) before/after - upgrade.', 'Removes Fluent Bit from the bundle; log collection/forwarding - will need an alternative (e.g., Alloy, another agent) to avoid losing logs.', - 'Removes Fortify, Grafana, Harbor, Istio Operator, Keycloak, Kiali, Kyverno - Policies, and Mattermost from the bundle; clusters using these must pin - to 2.40.0, install them independently, or plan migrations prior to upgrading.'] + chart_updates: + - 'Big Bang 2.41.0 changes appear to be primarily a component set reshuffle: + several components were removed from the default bundle and several new components + were added.' + - "One component listed as \"Updated: 7.2.2-bb.0 \u2192 7.2.2-bb.3\" (component\ + \ name not provided in notes you pasted) received a patch-level bump." + features: + - Adds Alloy (1.6.4-bb.0) as a new component in the Big Bang bundle. + - Adds Gatekeeper (3.17.1-bb.2) as a new component in the Big Bang bundle. + - Adds Holocron (1.0.12) as a new component in the Big Bang bundle. + - Adds Minio (6.0.4-bb.2) as a new component in the Big Bang bundle. + - Adds Monitoring (62.4.0-bb.1) as a new component in the Big Bang bundle. + breaking_changes: + - Removes Argo CD from the Big Bang bundle; existing Argo CD installs must be + managed separately or migrated to an alternative deployment approach. + - Removes External Secrets from the bundle; any workloads depending on it will + need a replacement (e.g., ESO installed independently) before/after upgrade. + - Removes Fluent Bit from the bundle; log collection/forwarding will need an + alternative (e.g., Alloy, another agent) to avoid losing logs. + - Removes Fortify, Grafana, Harbor, Istio Operator, Keycloak, Kiali, Kyverno + Policies, and Mattermost from the bundle; clusters using these must pin to + 2.40.0, install them independently, or plan migrations prior to upgrading. chart_version: 2.41.0 images: [] - version: 2.40.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.6.4-bb.0 @@ -7150,28 +8707,32 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.40.0 introduces several new optional components - (Fluentbit, Grafana, Istio Operator, Kyverno Policies, Mattermost, Metrics - Server, Minio Operator).', 'Big Bang 2.40.0 removes multiple previously - available components (Anchore Enterprise, Authservice, Gatekeeper, Holocron, - Monitoring, Neuvector, Tempo, Thanos, Twistlock, Vault).', Core component - bumped from 7.2.1-bb.3 to 7.2.2-bb.0 (component name not specified in notes - provided).] - features: [Adds support for deploying Fluentbit as a managed package (0.47.10-bb.1)., - Adds support for deploying Grafana as a managed package (8.5.5-bb.0)., Adds - support for deploying Istio Operator as a managed package (1.23.2-bb.0)., - Adds Kyverno Policies package (3.2.6-bb.0) for cluster policy management., - Adds Mattermost package (10.1.2-bb.0)., Adds Metrics Server package (3.12.2-bb.1)., - Adds Minio Operator package (6.0.4-bb.0).] - breaking_changes: ['Removes multiple packages that were previously available/managed - by Big Bang (Anchore Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, - Neuvector, Tempo, Thanos, Twistlock, Vault). Any existing deployments of - these must be migrated off Big Bang management or decommissioned prior to/with - the upgrade.'] + chart_updates: + - Big Bang 2.40.0 introduces several new optional components (Fluentbit, Grafana, + Istio Operator, Kyverno Policies, Mattermost, Metrics Server, Minio Operator). + - Big Bang 2.40.0 removes multiple previously available components (Anchore + Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, Neuvector, Tempo, + Thanos, Twistlock, Vault). + - Core component bumped from 7.2.1-bb.3 to 7.2.2-bb.0 (component name not specified + in notes provided). + features: + - Adds support for deploying Fluentbit as a managed package (0.47.10-bb.1). + - Adds support for deploying Grafana as a managed package (8.5.5-bb.0). + - Adds support for deploying Istio Operator as a managed package (1.23.2-bb.0). + - Adds Kyverno Policies package (3.2.6-bb.0) for cluster policy management. + - Adds Mattermost package (10.1.2-bb.0). + - Adds Metrics Server package (3.12.2-bb.1). + - Adds Minio Operator package (6.0.4-bb.0). + breaking_changes: + - Removes multiple packages that were previously available/managed by Big Bang + (Anchore Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, Neuvector, + Tempo, Thanos, Twistlock, Vault). Any existing deployments of these must be + migrated off Big Bang management or decommissioned prior to/with the upgrade. chart_version: 2.40.0 images: [] - version: 2.39.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.5.4-bb.1 @@ -7256,24 +8817,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang version bump: 2.38.0 \u2192 2.39.0 (release notes\ - \ not fully provided in the prompt).", 'Major component set reshuffle: several - packages are newly added to the default Big Bang bundle and several previously-included - packages are removed.'] - features: ['Adds/introduces support for multiple security/ops/observability - and platform components as part of the Big Bang bundle: Anchore Enterprise, - ArgoCD, Gatekeeper, Harbor, Jaeger, Keycloak, Kiali, Kyverno, Kyverno Reporter, - Mattermost Operator, Sonarqube, Twistlock.'] - breaking_changes: ['Removes several previously-delivered components from the - bundle: Istio Controlplane, Istio Operator, Metrics Server, Nexus, Velero, - and a component shown as ''New: 1.5.4-bb.0'' (name not provided).', "Large\ - \ component version jump (0.16.0-bb.2 \u2192 7.2.1-bb.3) indicates a potentially\ - \ breaking major upgrade for that specific component (component name not\ - \ provided in the notes)."] + chart_updates: + - "Big Bang version bump: 2.38.0 \u2192 2.39.0 (release notes not fully provided\ + \ in the prompt)." + - 'Major component set reshuffle: several packages are newly added to the default + Big Bang bundle and several previously-included packages are removed.' + features: + - 'Adds/introduces support for multiple security/ops/observability and platform + components as part of the Big Bang bundle: Anchore Enterprise, ArgoCD, Gatekeeper, + Harbor, Jaeger, Keycloak, Kiali, Kyverno, Kyverno Reporter, Mattermost Operator, + Sonarqube, Twistlock.' + breaking_changes: + - 'Removes several previously-delivered components from the bundle: Istio Controlplane, + Istio Operator, Metrics Server, Nexus, Velero, and a component shown as ''New: + 1.5.4-bb.0'' (name not provided).' + - "Large component version jump (0.16.0-bb.2 \u2192 7.2.1-bb.3) indicates a\ + \ potentially breaking major upgrade for that specific component (component\ + \ name not provided in the notes)." chart_version: 2.39.0 images: [] - version: 2.38.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: New version: 1.5.4-bb.0 @@ -7362,24 +8927,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang release 2.38.0 introduces a large component set change: - many components are newly added, and several previously-included components - are removed.', "Velero appears to move from being listed as an update (7.2.1-bb.1\ - \ \u2192 0.16.0-bb.2) to being included as a new component at 7.2.1-bb.1;\ - \ verify actual component mapping and versions in the official Big Bang\ - \ 2.38.0 release notes/changelog to avoid confusion."] - features: ['Adds several platform components by default (or makes them available) - including Istio control plane/operator, External Secrets, Metrics Server, - Neuvector, Nexus, Promtail, Vault, Velero, Authservice, and Cluster Auditor.'] - breaking_changes: ['Removes multiple previously-shipped components (Anchore - Enterprise, Grafana, Harbor, Mattermost Operator, Sonarqube, Twistlock). - This can break existing workflows and dependencies if you were relying on - Big Bang to deploy/upgrade/manage them.'] + chart_updates: + - 'Big Bang release 2.38.0 introduces a large component set change: many components + are newly added, and several previously-included components are removed.' + - "Velero appears to move from being listed as an update (7.2.1-bb.1 \u2192\ + \ 0.16.0-bb.2) to being included as a new component at 7.2.1-bb.1; verify\ + \ actual component mapping and versions in the official Big Bang 2.38.0 release\ + \ notes/changelog to avoid confusion." + features: + - Adds several platform components by default (or makes them available) including + Istio control plane/operator, External Secrets, Metrics Server, Neuvector, + Nexus, Promtail, Vault, Velero, Authservice, and Cluster Auditor. + breaking_changes: + - Removes multiple previously-shipped components (Anchore Enterprise, Grafana, + Harbor, Mattermost Operator, Sonarqube, Twistlock). This can break existing + workflows and dependencies if you were relying on Big Bang to deploy/upgrade/manage + them. chart_version: 2.38.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2 - version: 2.37.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Anchore Enterprise version: 2.10.0-bb.0 @@ -7464,27 +9034,32 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.37.0 is primarily a composition change: many previously - bundled components are removed, and several new components are added.', - One component shows a major version jump from `0.28.1-bb.6` to `7.2.1-bb.1` - (component name not provided in the notes); treat this as potentially breaking - and review its upstream release notes., 'Support notice in the release notes - indicates the currently supported Big Bang version is 3.25.0, meaning 2.37.0 - is outside the current supported line.'] - features: ['Adds multiple optional/platform components (Anchore Enterprise, - Fortify, Gitlab Runner, Grafana, Monitoring, Sonarqube, Tempo, Thanos) as - part of the Big Bang bundle in 2.37.0.'] - breaking_changes: ['Removes many previously included components (ArgoCD, Authservice, - Cluster Auditor, Istio control plane/operator, Jaeger, Keycloak, Kyverno - + reporter, Metrics Server, Minio + operator, NeuVector, Nexus, Promtail, - Velero). If your deployment relied on any of these, you must keep them deployed - separately or migrate to replacements before/at upgrade time.', The unspecified - component jump from `0.28.1-bb.6` to `7.2.1-bb.1` suggests significant behavior/config - changes; validate values/schema compatibility and plan a staged upgrade/rollback.] + chart_updates: + - 'Big Bang 2.37.0 is primarily a composition change: many previously bundled + components are removed, and several new components are added.' + - One component shows a major version jump from `0.28.1-bb.6` to `7.2.1-bb.1` + (component name not provided in the notes); treat this as potentially breaking + and review its upstream release notes. + - Support notice in the release notes indicates the currently supported Big + Bang version is 3.25.0, meaning 2.37.0 is outside the current supported line. + features: + - Adds multiple optional/platform components (Anchore Enterprise, Fortify, Gitlab + Runner, Grafana, Monitoring, Sonarqube, Tempo, Thanos) as part of the Big + Bang bundle in 2.37.0. + breaking_changes: + - Removes many previously included components (ArgoCD, Authservice, Cluster + Auditor, Istio control plane/operator, Jaeger, Keycloak, Kyverno + reporter, + Metrics Server, Minio + operator, NeuVector, Nexus, Promtail, Velero). If + your deployment relied on any of these, you must keep them deployed separately + or migrate to replacements before/at upgrade time. + - The unspecified component jump from `0.28.1-bb.6` to `7.2.1-bb.1` suggests + significant behavior/config changes; validate values/schema compatibility + and plan a staged upgrade/rollback. chart_version: 2.37.0 images: [] - version: 2.36.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 2.10.0-bb.0 @@ -7571,23 +9146,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang version bump from 2.35.0 to 2.36.0., 'Major component - lineup change: multiple new components added and several previously-included - components removed.'] - features: ['Introduces several new packaged components (Argo CD, Authservice, - ECK Operator, HAProxy, Istio controlplane/operator, Jaeger, Keycloak, MinIO - + MinIO Operator, NeuVector, Velero) as part of the default Big Bang distribution.'] - breaking_changes: ['Removal of previously-included components (Gatekeeper, Kyverno - Policies, Elasticsearch Kibana, Loki, Sonarqube, External Secrets) will - break installs that relied on Big Bang to deploy/upgrade/manage them; you - must provide replacements or manage them separately.', "Component version\ - \ jump noted as \u201C15.7.20-bb.0 \u2192 0.28.1-bb.6\u201D suggests a renaming/mapping\ - \ or major chart refactor; validate which component this refers to in your\ - \ environment before upgrading."] + chart_updates: + - Big Bang version bump from 2.35.0 to 2.36.0. + - 'Major component lineup change: multiple new components added and several + previously-included components removed.' + features: + - Introduces several new packaged components (Argo CD, Authservice, ECK Operator, + HAProxy, Istio controlplane/operator, Jaeger, Keycloak, MinIO + MinIO Operator, + NeuVector, Velero) as part of the default Big Bang distribution. + breaking_changes: + - Removal of previously-included components (Gatekeeper, Kyverno Policies, Elasticsearch + Kibana, Loki, Sonarqube, External Secrets) will break installs that relied + on Big Bang to deploy/upgrade/manage them; you must provide replacements or + manage them separately. + - "Component version jump noted as \u201C15.7.20-bb.0 \u2192 0.28.1-bb.6\u201D\ + \ suggests a renaming/mapping or major chart refactor; validate which component\ + \ this refers to in your environment before upgrading." chart_version: 2.36.0 images: [] - version: 2.35.0 - kube: ['1.30'] + kube: + - '1.30' requirements: - name: Updated version: 1.22.4-bb.1 @@ -7675,19 +9254,22 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Big Bang 2.35.0 updates the bundled platform components; notably - the core (15.7.x) version is bumped from 15.7.17-bb.0 to 15.7.20-bb.0., - 'Several new optional/managed add-ons are introduced in the bundle: Kyverno - Policies, Kyverno Reporter, Elasticsearch Kibana, Promtail, Loki, Twistlock, - Nexus, Sonarqube, Mattermost Operator, Metrics Server, and Harbor.'] - breaking_changes: ['Multiple components are removed from the bundle in 2.35.0: - Istio Controlplane/Operator, Tempo, ArgoCD, Authservice, Gitlab Runner, - and Haproxy. If you were relying on Big Bang to deploy/upgrade these, you - must manage them separately or migrate to the replacement pattern in 2.35.0.'] + features: + - Big Bang 2.35.0 updates the bundled platform components; notably the core + (15.7.x) version is bumped from 15.7.17-bb.0 to 15.7.20-bb.0. + - 'Several new optional/managed add-ons are introduced in the bundle: Kyverno + Policies, Kyverno Reporter, Elasticsearch Kibana, Promtail, Loki, Twistlock, + Nexus, Sonarqube, Mattermost Operator, Metrics Server, and Harbor.' + breaking_changes: + - 'Multiple components are removed from the bundle in 2.35.0: Istio Controlplane/Operator, + Tempo, ArgoCD, Authservice, Gitlab Runner, and Haproxy. If you were relying + on Big Bang to deploy/upgrade these, you must manage them separately or migrate + to the replacement pattern in 2.35.0.' chart_version: 2.35.0 images: [] - version: 2.34.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Istio Controlplane version: 1.22.3-bb.1 @@ -7772,29 +9354,37 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang version bump from **2.33.0 \u2192 2.34.0**.", "Core\ - \ platform component update: **15.7.9-bb.6 \u2192 15.7.17-bb.0** (as listed\ - \ in notes).", 'Adds several new packaged components: Cluster Auditor, Gatekeeper, - Kyverno, Tempo, Argo CD.', 'Removes several previously packaged components: - Jaeger, Kiali, ECK Operator, Promtail, Loki, Minio, Sonarqube, Fortify, - Vault, Metrics Server, Harbor.'] - features: [Introduces built-in support for Cluster Auditor (1.5.0-bb.21)., Introduces - policy enforcement components Gatekeeper (3.16.3-bb.1) and Kyverno (3.2.6-bb.0)., - Adds distributed tracing/observability via Tempo (1.10.1-bb.0)., Adds GitOps - tooling via Argo CD (7.3.11-bb.0).] - breaking_changes: ['Multiple components are removed from the bundle (Jaeger, - Kiali, ECK Operator, Promtail/Loki, Minio, Sonarqube, Fortify, Vault, Metrics - Server, Harbor); any workloads depending on them must be migrated or managed - externally before/with the upgrade.', Observability stack changes (Tempo - added while Jaeger/Loki/Promtail removed) may require updating tracing/logging - integrations and dashboards/agents., Security/policy changes from introducing - Gatekeeper/Kyverno can block workloads if default constraints/policies are - enabled; review and stage enforcement carefully.] + chart_updates: + - "Big Bang version bump from **2.33.0 \u2192 2.34.0**." + - "Core platform component update: **15.7.9-bb.6 \u2192 15.7.17-bb.0** (as listed\ + \ in notes)." + - 'Adds several new packaged components: Cluster Auditor, Gatekeeper, Kyverno, + Tempo, Argo CD.' + - 'Removes several previously packaged components: Jaeger, Kiali, ECK Operator, + Promtail, Loki, Minio, Sonarqube, Fortify, Vault, Metrics Server, Harbor.' + features: + - Introduces built-in support for Cluster Auditor (1.5.0-bb.21). + - Introduces policy enforcement components Gatekeeper (3.16.3-bb.1) and Kyverno + (3.2.6-bb.0). + - Adds distributed tracing/observability via Tempo (1.10.1-bb.0). + - Adds GitOps tooling via Argo CD (7.3.11-bb.0). + breaking_changes: + - Multiple components are removed from the bundle (Jaeger, Kiali, ECK Operator, + Promtail/Loki, Minio, Sonarqube, Fortify, Vault, Metrics Server, Harbor); + any workloads depending on them must be migrated or managed externally before/with + the upgrade. + - Observability stack changes (Tempo added while Jaeger/Loki/Promtail removed) + may require updating tracing/logging integrations and dashboards/agents. + - Security/policy changes from introducing Gatekeeper/Kyverno can block workloads + if default constraints/policies are enabled; review and stage enforcement + carefully. chart_version: 2.34.0 - images: ['registry1.dso.mil/ironbank/opensource/minio/operator-sidecar:v6.0.2', - 'registry1.dso.mil/ironbank/hashicorp/vault/vault-k8s:v1.4.1'] + images: + - registry1.dso.mil/ironbank/opensource/minio/operator-sidecar:v6.0.2 + - registry1.dso.mil/ironbank/hashicorp/vault/vault-k8s:v1.4.1 - version: 2.33.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Istio Controlplane version: 1.22.3-bb.1 @@ -7882,15 +9472,20 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Release notes provided only include an admin message about the currently - supported Big Bang version.] - breaking_changes: [No breaking changes were included in the provided release - notes; additional changelog details are needed to assess upgrade impact.] + features: + - Release notes provided only include an admin message about the currently supported + Big Bang version. + breaking_changes: + - No breaking changes were included in the provided release notes; additional + changelog details are needed to assess upgrade impact. chart_version: 2.33.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1', 'registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.2.1'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1 + - registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.2.1 - version: 2.32.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Updated version: 1.22.3-bb.1 @@ -7977,27 +9572,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Component set changed significantly between 2.31.0 and 2.32.0: - several packages were removed (Jaeger, Kyverno, Kyverno Reporter, Neuvector, - Tempo, Wrapper, Authservice, Haproxy, Mattermost Operator, Vault, Metrics - Server, Harbor).', 'New packages introduced: Cluster Auditor, ECK Operator, - Promtail, Fortify, and a package labeled "New" (0.9.18-bb.7).', "One component\ - \ was updated in place: 15.7.9-bb.2 \u2192 15.7.9-bb.4 (exact component\ - \ name not provided in notes)."] - features: ['Adds new built-in packages: Cluster Auditor, ECK Operator, Promtail, - Fortify, and an additional new package (0.9.18-bb.7).'] - breaking_changes: ['Multiple previously-installed components are removed in - 2.32.0; upgrades will uninstall these unless you manage them separately - (Jaeger, Kyverno, Kyverno Reporter, Neuvector, Tempo, Wrapper, Authservice, - Haproxy, Mattermost Operator, Vault, Metrics Server, Harbor).', 'Operational - impact: any workloads depending on the removed components (policy enforcement - via Kyverno, tracing via Jaeger/Tempo, registry via Harbor, secrets via - Vault, etc.) must be migrated or replaced before/with the upgrade.'] + chart_updates: + - 'Component set changed significantly between 2.31.0 and 2.32.0: several packages + were removed (Jaeger, Kyverno, Kyverno Reporter, Neuvector, Tempo, Wrapper, + Authservice, Haproxy, Mattermost Operator, Vault, Metrics Server, Harbor).' + - 'New packages introduced: Cluster Auditor, ECK Operator, Promtail, Fortify, + and a package labeled "New" (0.9.18-bb.7).' + - "One component was updated in place: 15.7.9-bb.2 \u2192 15.7.9-bb.4 (exact\ + \ component name not provided in notes)." + features: + - 'Adds new built-in packages: Cluster Auditor, ECK Operator, Promtail, Fortify, + and an additional new package (0.9.18-bb.7).' + breaking_changes: + - Multiple previously-installed components are removed in 2.32.0; upgrades will + uninstall these unless you manage them separately (Jaeger, Kyverno, Kyverno + Reporter, Neuvector, Tempo, Wrapper, Authservice, Haproxy, Mattermost Operator, + Vault, Metrics Server, Harbor). + - 'Operational impact: any workloads depending on the removed components (policy + enforcement via Kyverno, tracing via Jaeger/Tempo, registry via Harbor, secrets + via Vault, etc.) must be migrated or replaced before/with the upgrade.' chart_version: 2.32.0 - images: ['registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.5.0', 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0'] + images: + - registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.5.0 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0 - version: 2.31.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Updated version: 1.22.2-bb.0 @@ -8080,31 +9681,36 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang version bump from **2.30.0** to **2.31.0**., "Only\ - \ a minor update is listed for an existing component: **15.7.9-bb.1 \u2192\ - \ 15.7.9-bb.2** (component name not specified in the notes provided).", - 'Adds several new packaged components/charts: **Jaeger, Kyverno Reporter, - Neuvector, Tempo, Wrapper, Authservice, Haproxy, Vault, Metrics Server**.', - 'Removes multiple previously packaged components/charts: **Cluster Auditor, - Kyverno Policies, Elasticsearch Kibana, Promtail, Twistlock, Minio Operator, - Minio, Gitlab Runner, Sonarqube, Anchore Enterprise, Holocron**.'] - features: ['Multiple observability and security components are newly included - by default in the Big Bang bundle (e.g., Jaeger/Tempo for tracing, Neuvector - for container security, Metrics Server for resource metrics).', 'Additional - platform plumbing components are introduced (e.g., Authservice, Haproxy, - Vault, Wrapper), which may expand optional capabilities but also increase - what can be installed/enabled.'] - breaking_changes: ['Several components are removed from the distribution (e.g., - Elasticsearch/Kibana, Promtail, Minio, Gitlab Runner, Sonarqube, Anchore - Enterprise). If you relied on Big Bang to deploy or manage these, you must - migrate to alternative deployment methods or supported replacements before/at - upgrade.', 'Policy/auditing components are removed (Kyverno Policies, Cluster - Auditor); any workloads depending on those policies/reports may change behavior - post-upgrade unless you replace them with your own policy management.'] + chart_updates: + - Big Bang version bump from **2.30.0** to **2.31.0**. + - "Only a minor update is listed for an existing component: **15.7.9-bb.1 \u2192\ + \ 15.7.9-bb.2** (component name not specified in the notes provided)." + - 'Adds several new packaged components/charts: **Jaeger, Kyverno Reporter, + Neuvector, Tempo, Wrapper, Authservice, Haproxy, Vault, Metrics Server**.' + - 'Removes multiple previously packaged components/charts: **Cluster Auditor, + Kyverno Policies, Elasticsearch Kibana, Promtail, Twistlock, Minio Operator, + Minio, Gitlab Runner, Sonarqube, Anchore Enterprise, Holocron**.' + features: + - Multiple observability and security components are newly included by default + in the Big Bang bundle (e.g., Jaeger/Tempo for tracing, Neuvector for container + security, Metrics Server for resource metrics). + - Additional platform plumbing components are introduced (e.g., Authservice, + Haproxy, Vault, Wrapper), which may expand optional capabilities but also + increase what can be installed/enabled. + breaking_changes: + - Several components are removed from the distribution (e.g., Elasticsearch/Kibana, + Promtail, Minio, Gitlab Runner, Sonarqube, Anchore Enterprise). If you relied + on Big Bang to deploy or manage these, you must migrate to alternative deployment + methods or supported replacements before/at upgrade. + - Policy/auditing components are removed (Kyverno Policies, Cluster Auditor); + any workloads depending on those policies/reports may change behavior post-upgrade + unless you replace them with your own policy management. chart_version: 2.31.0 - images: ['registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.4.0'] + images: + - registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.4.0 - version: 2.30.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Updated version: 1.22.1-bb.0 @@ -8187,22 +9793,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.30.0 introduces significant component set changes - relative to 2.29.0: multiple new packages are added and several previously - included packages are removed.', A core component version is updated from - 15.4.3-bb.0 to 15.7.9-bb.1 (exact component name not provided in the notes).] - features: ['Adds several new optional/included packages: Cluster Auditor, Gatekeeper, - Elasticsearch Kibana, Minio, GitLab Runner, Sonarqube, Anchore Enterprise, - and Holocron.', Refreshes at least one component from 15.4.3-bb.0 to 15.7.9-bb.1.] - breaking_changes: ['Removes multiple previously available packages from the - Big Bang bundle: Istio Operator, Jaeger, Fluentbit, Neuvector, Grafana, - Gitlab, Nexus, Haproxy, and Metrics Server.', Upgrade may require migrating - workloads/config that depended on removed packages to alternatives or external - deployments.] + chart_updates: + - 'Big Bang 2.30.0 introduces significant component set changes relative to + 2.29.0: multiple new packages are added and several previously included packages + are removed.' + - A core component version is updated from 15.4.3-bb.0 to 15.7.9-bb.1 (exact + component name not provided in the notes). + features: + - 'Adds several new optional/included packages: Cluster Auditor, Gatekeeper, + Elasticsearch Kibana, Minio, GitLab Runner, Sonarqube, Anchore Enterprise, + and Holocron.' + - Refreshes at least one component from 15.4.3-bb.0 to 15.7.9-bb.1. + breaking_changes: + - 'Removes multiple previously available packages from the Big Bang bundle: + Istio Operator, Jaeger, Fluentbit, Neuvector, Grafana, Gitlab, Nexus, Haproxy, + and Metrics Server.' + - Upgrade may require migrating workloads/config that depended on removed packages + to alternatives or external deployments. chart_version: 2.30.0 images: [] - version: 2.29.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Updated version: 1.21.2-bb.2 @@ -8287,27 +9899,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.29.0 is a major composition change versus 2.28.0: - multiple new components are introduced (Istio Operator, Kyverno Policies, - Fluent Bit, NeuVector, Twistlock, MinIO Operator, GitLab, Nexus, Harbor) - and multiple components are removed (Kiali, Cluster Auditor, ECK Operator, - Tempo, Wrapper, Authservice, Fortify).', "One component received a large\ - \ version bump: 13.2.2-bb.7 \u2192 15.4.3-bb.0 (component name not specified\ - \ in the notes you provided)."] - features: ['Adds several new optional/managed components in the Big Bang bundle: - Istio Operator, Kyverno Policies, Fluent Bit, NeuVector, Twistlock, MinIO - Operator, GitLab, Nexus, and Harbor.'] - breaking_changes: ['Removes several previously-included components (Kiali, Cluster - Auditor, ECK Operator, Tempo, Wrapper, Authservice, Fortify), which may - require you to disable/migrate workloads and update dashboards/logging/auditing/integration - dependencies.', 'Introduces new components that may require new namespaces, - CRDs, cluster-wide RBAC, and additional resources; plan for admission policies - (Kyverno) and service mesh operator changes (Istio Operator).'] + chart_updates: + - 'Big Bang 2.29.0 is a major composition change versus 2.28.0: multiple new + components are introduced (Istio Operator, Kyverno Policies, Fluent Bit, NeuVector, + Twistlock, MinIO Operator, GitLab, Nexus, Harbor) and multiple components + are removed (Kiali, Cluster Auditor, ECK Operator, Tempo, Wrapper, Authservice, + Fortify).' + - "One component received a large version bump: 13.2.2-bb.7 \u2192 15.4.3-bb.0\ + \ (component name not specified in the notes you provided)." + features: + - 'Adds several new optional/managed components in the Big Bang bundle: Istio + Operator, Kyverno Policies, Fluent Bit, NeuVector, Twistlock, MinIO Operator, + GitLab, Nexus, and Harbor.' + breaking_changes: + - Removes several previously-included components (Kiali, Cluster Auditor, ECK + Operator, Tempo, Wrapper, Authservice, Fortify), which may require you to + disable/migrate workloads and update dashboards/logging/auditing/integration + dependencies. + - Introduces new components that may require new namespaces, CRDs, cluster-wide + RBAC, and additional resources; plan for admission policies (Kyverno) and + service mesh operator changes (Istio Operator). chart_version: 2.29.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0 - version: 2.28.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Updated version: 1.21.2-bb.0 @@ -8389,19 +10007,22 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Large component set change: adds Kiali, Cluster Auditor, ECK Operator, - Promtail, Tempo, Grafana, Authservice, HAProxy, and Mattermost Operator - as new managed components in 2.28.0.'] - breaking_changes: ['Multiple components are removed in 2.28.0: Gatekeeper, Kyverno - Reporter, Twistlock, Minio Operator, Mattermost, Velero, and Thanos; workloads/config - depending on these will need migration or replacement.', "A component version\ - \ jump is indicated (1.0.6 \u2192 13.2.2-bb.7); validate what component\ - \ this refers to in your environment because it may introduce significant\ - \ config or CRD changes."] + features: + - 'Large component set change: adds Kiali, Cluster Auditor, ECK Operator, Promtail, + Tempo, Grafana, Authservice, HAProxy, and Mattermost Operator as new managed + components in 2.28.0.' + breaking_changes: + - 'Multiple components are removed in 2.28.0: Gatekeeper, Kyverno Reporter, + Twistlock, Minio Operator, Mattermost, Velero, and Thanos; workloads/config + depending on these will need migration or replacement.' + - "A component version jump is indicated (1.0.6 \u2192 13.2.2-bb.7); validate\ + \ what component this refers to in your environment because it may introduce\ + \ significant config or CRD changes." chart_version: 2.28.0 images: [] - version: 2.27.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.21.1-bb.1 @@ -8486,29 +10107,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang upgraded from 2.26.0 to 2.27.0; component inventory - changed significantly with multiple additions and removals., 'Added charts/components: - Jaeger, Gatekeeper, Kyverno, Kyverno Reporter, Twistlock, Fortify, Mattermost, - Velero, Metrics Server.', 'Removed charts/components: Istio Controlplane, - Kiali, Cluster Auditor, ECK Operator, Loki, Authservice, Gitlab, Haproxy, - Mattermost Operator.', "One component version bumped: 1.0.5 \u2192 1.0.6\ - \ (component name not provided in notes)."] - features: ['Introduces multiple new optional platform capabilities: distributed - tracing (Jaeger), policy enforcement (Gatekeeper, Kyverno), compliance reporting - (Kyverno Reporter), backup/restore (Velero), and cluster metrics (Metrics - Server).', 'Adds integrations for additional security/compliance tooling - (Twistlock, Fortify) and collaboration tooling (Mattermost).'] - breaking_changes: ['Several previously-included components are removed (Istio - control plane, Kiali, Loki, GitLab, Authservice, HAProxy, ECK operator, - Mattermost operator, Cluster Auditor). Any deployments relying on these - must migrate to alternative installations or disable corresponding Big Bang - configuration.', 'If you previously configured values for removed components, - those values will become invalid/no-ops and may cause Helm value schema/templating - issues depending on how your values are structured.'] + chart_updates: + - Big Bang upgraded from 2.26.0 to 2.27.0; component inventory changed significantly + with multiple additions and removals. + - 'Added charts/components: Jaeger, Gatekeeper, Kyverno, Kyverno Reporter, Twistlock, + Fortify, Mattermost, Velero, Metrics Server.' + - 'Removed charts/components: Istio Controlplane, Kiali, Cluster Auditor, ECK + Operator, Loki, Authservice, Gitlab, Haproxy, Mattermost Operator.' + - "One component version bumped: 1.0.5 \u2192 1.0.6 (component name not provided\ + \ in notes)." + features: + - 'Introduces multiple new optional platform capabilities: distributed tracing + (Jaeger), policy enforcement (Gatekeeper, Kyverno), compliance reporting (Kyverno + Reporter), backup/restore (Velero), and cluster metrics (Metrics Server).' + - Adds integrations for additional security/compliance tooling (Twistlock, Fortify) + and collaboration tooling (Mattermost). + breaking_changes: + - Several previously-included components are removed (Istio control plane, Kiali, + Loki, GitLab, Authservice, HAProxy, ECK operator, Mattermost operator, Cluster + Auditor). Any deployments relying on these must migrate to alternative installations + or disable corresponding Big Bang configuration. + - If you previously configured values for removed components, those values will + become invalid/no-ops and may cause Helm value schema/templating issues depending + on how your values are structured. chart_version: 2.27.0 images: [] - version: 2.26.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Istio Controlplane version: 1.20.4-bb.1 @@ -8593,28 +10219,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang meta-release 2.26.0 includes a large set of component - add/remove actions and version bumps as listed (several components newly - added; several previously bundled components removed).] - features: [Introduces Kiali as a bundled component (1.82.0-bb.3)., Introduces - Cluster Auditor as a bundled component (1.5.0-bb.15)., Adds Loki (5.47.2-bb.2) - and Thanos (13.2.2-bb.4) to expand observability options., Adds MinIO Operator - (5.0.14-bb.2) and GitLab (7.10.2-bb.0) as new packaged capabilities., 'Adds - a ''Wrapper'' component (0.4.7), likely to standardize or orchestrate deployments - across packages.'] - breaking_changes: [Removal of Istio Operator (was 1.20.4-bb.0) may require changing - how Istio is installed/managed during/after upgrade., Removal of Kyverno - Policies package means policy enforcement must be migrated/managed separately - if you relied on Big Bang-provided policies., 'Removal of Promtail, Grafana, - and Metrics Server indicates a monitoring/logging stack change; ensure alternative - components (e.g., Loki/Thanos) are configured and any dashboards/agents - are replaced.', 'Removal of Argo CD, Fortify, and Vault from the bundle - can break GitOps, SAST, and secrets workflows unless you deploy/maintain - them independently.'] + chart_updates: + - Big Bang meta-release 2.26.0 includes a large set of component add/remove + actions and version bumps as listed (several components newly added; several + previously bundled components removed). + features: + - Introduces Kiali as a bundled component (1.82.0-bb.3). + - Introduces Cluster Auditor as a bundled component (1.5.0-bb.15). + - Adds Loki (5.47.2-bb.2) and Thanos (13.2.2-bb.4) to expand observability options. + - Adds MinIO Operator (5.0.14-bb.2) and GitLab (7.10.2-bb.0) as new packaged + capabilities. + - Adds a 'Wrapper' component (0.4.7), likely to standardize or orchestrate deployments + across packages. + breaking_changes: + - Removal of Istio Operator (was 1.20.4-bb.0) may require changing how Istio + is installed/managed during/after upgrade. + - Removal of Kyverno Policies package means policy enforcement must be migrated/managed + separately if you relied on Big Bang-provided policies. + - Removal of Promtail, Grafana, and Metrics Server indicates a monitoring/logging + stack change; ensure alternative components (e.g., Loki/Thanos) are configured + and any dashboards/agents are replaced. + - Removal of Argo CD, Fortify, and Vault from the bundle can break GitOps, SAST, + and secrets workflows unless you deploy/maintain them independently. chart_version: 2.26.0 images: [] - version: 2.25.0 - kube: ['1.29'] + kube: + - '1.29' requirements: - name: Istio Controlplane version: 1.20.4-bb.1 @@ -8699,36 +10330,46 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.25.0 introduces several new packaged components - (Istio control plane/operator, Kyverno Policies, ECK Operator, Promtail, - Grafana, Authservice, Fortify, Mattermost Operator, Vault).', 'Big Bang - 2.25.0 removes multiple previously packaged components (Jaeger, Cluster - Auditor, Gatekeeper, Kyverno, Tempo, Wrapper, Sonarqube, Anchore Enterprise, - Keycloak, Harbor, Holocron).', One existing component was updated from 13.2.2-bb.2 - to 13.2.2-bb.4 (component name not provided in notes).] - features: [Adds first-class support for Istio via new Istio Operator and Istio - Controlplane packages (1.20.4-bb.*)., 'Introduces Kyverno Policies as a - standalone package (3.0.4-bb.28), separating policy content from the Kyverno - engine.', Adds Elastic Cloud on Kubernetes (ECK) Operator (2.12.1-bb.0) - to manage Elasticsearch/Kibana via CRDs., Adds logging/observability and - UI components (Promtail 6.15.5-bb.3 and Grafana 7.3.7-bb.1)., Adds Authservice - (1.0.0-bb.0) and Vault (0.25.0-bb.20) packages for auth and secrets management - options., Adds additional optional integrations/tools (Fortify 1.1.2320154-bb.3 - and Mattermost Operator 1.21.0-bb.0).] - breaking_changes: ['Multiple components are removed in 2.25.0 (Jaeger, Tempo, - Kyverno, Gatekeeper, Keycloak, Harbor, Anchore Enterprise, Sonarqube, etc.); - any clusters relying on these must migrate off them or pin/retain them outside - Big Bang before upgrading.', Kyverno engine is removed while Kyverno Policies - is added; policy enforcement will not function unless you deploy an alternative - policy engine or manage Kyverno separately., Removal of observability components - (Jaeger/Tempo) is disruptive if tracing depended on them; plan replacement/disable - tracing pipelines accordingly., Removal of identity/registry/scanning components - (Keycloak/Harbor/Anchore/Sonarqube) requires replacement solutions and updates - to any integrations referencing their services/URLs/secrets.] + chart_updates: + - Big Bang 2.25.0 introduces several new packaged components (Istio control + plane/operator, Kyverno Policies, ECK Operator, Promtail, Grafana, Authservice, + Fortify, Mattermost Operator, Vault). + - Big Bang 2.25.0 removes multiple previously packaged components (Jaeger, Cluster + Auditor, Gatekeeper, Kyverno, Tempo, Wrapper, Sonarqube, Anchore Enterprise, + Keycloak, Harbor, Holocron). + - One existing component was updated from 13.2.2-bb.2 to 13.2.2-bb.4 (component + name not provided in notes). + features: + - Adds first-class support for Istio via new Istio Operator and Istio Controlplane + packages (1.20.4-bb.*). + - Introduces Kyverno Policies as a standalone package (3.0.4-bb.28), separating + policy content from the Kyverno engine. + - Adds Elastic Cloud on Kubernetes (ECK) Operator (2.12.1-bb.0) to manage Elasticsearch/Kibana + via CRDs. + - Adds logging/observability and UI components (Promtail 6.15.5-bb.3 and Grafana + 7.3.7-bb.1). + - Adds Authservice (1.0.0-bb.0) and Vault (0.25.0-bb.20) packages for auth and + secrets management options. + - Adds additional optional integrations/tools (Fortify 1.1.2320154-bb.3 and + Mattermost Operator 1.21.0-bb.0). + breaking_changes: + - Multiple components are removed in 2.25.0 (Jaeger, Tempo, Kyverno, Gatekeeper, + Keycloak, Harbor, Anchore Enterprise, Sonarqube, etc.); any clusters relying + on these must migrate off them or pin/retain them outside Big Bang before + upgrading. + - Kyverno engine is removed while Kyverno Policies is added; policy enforcement + will not function unless you deploy an alternative policy engine or manage + Kyverno separately. + - Removal of observability components (Jaeger/Tempo) is disruptive if tracing + depended on them; plan replacement/disable tracing pipelines accordingly. + - Removal of identity/registry/scanning components (Keycloak/Harbor/Anchore/Sonarqube) + requires replacement solutions and updates to any integrations referencing + their services/URLs/secrets. chart_version: 2.25.0 images: [] - version: 2.24.0 - kube: ['1.28'] + kube: + - '1.28' requirements: - name: Updated version: 1.20.4-bb.1 @@ -8813,25 +10454,31 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.24.0 updates the umbrella chart to include several - new packaged components (Kyverno, Argo CD, SonarQube, HAProxy, Keycloak, - Metrics Server, Harbor, Holocron).', 'Several previously included components - are removed from the default bundle (Istio Controlplane, Elasticsearch/Kibana, - ECK Operator, GitLab Runner).', One existing component is patched from 13.2.2-bb.1 - to 13.2.2-bb.2 (component name not provided in notes).] - features: ['Adds first-class, bundled support for Kyverno policy engine.', Adds - Argo CD as a packaged GitOps deployment option., 'Adds packaged integrations - for Harbor, Keycloak, Metrics Server, HAProxy, SonarQube, and Holocron.'] - breaking_changes: [Removal of Istio Controlplane from the bundle can break clusters - relying on Big Bang-managed Istio; migration/ownership of Istio resources - may be required., Removal of Elasticsearch/Kibana and ECK Operator can break - logging/observability deployments depending on those charts; data retention/migration - planning needed., Removal of GitLab Runner from the bundle can break CI - jobs that relied on the in-cluster runner managed by Big Bang.] + chart_updates: + - Big Bang 2.24.0 updates the umbrella chart to include several new packaged + components (Kyverno, Argo CD, SonarQube, HAProxy, Keycloak, Metrics Server, + Harbor, Holocron). + - Several previously included components are removed from the default bundle + (Istio Controlplane, Elasticsearch/Kibana, ECK Operator, GitLab Runner). + - One existing component is patched from 13.2.2-bb.1 to 13.2.2-bb.2 (component + name not provided in notes). + features: + - Adds first-class, bundled support for Kyverno policy engine. + - Adds Argo CD as a packaged GitOps deployment option. + - Adds packaged integrations for Harbor, Keycloak, Metrics Server, HAProxy, + SonarQube, and Holocron. + breaking_changes: + - Removal of Istio Controlplane from the bundle can break clusters relying on + Big Bang-managed Istio; migration/ownership of Istio resources may be required. + - Removal of Elasticsearch/Kibana and ECK Operator can break logging/observability + deployments depending on those charts; data retention/migration planning needed. + - Removal of GitLab Runner from the bundle can break CI jobs that relied on + the in-cluster runner managed by Big Bang. chart_version: 2.24.0 images: [] - version: 2.23.0 - kube: ['1.28'] + kube: + - '1.28' requirements: - name: Istio Controlplane version: 1.19.7-bb.0 @@ -8916,28 +10563,36 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.23.0 introduces several new components (Istio Control - Plane, Elasticsearch Kibana, Tempo, Wrapper).', 'Multiple previously-included - components are removed from the Big Bang bundle in 2.23.0 (Kyverno, Kyverno - Reporter, Fluentbit, Promtail, Neuvector, Twistlock, ArgoCD, Minio Operator, - GitLab, Sonarqube, Fortify, HAProxy, Mattermost Operator, Keycloak, Holocron).', - One component is updated from 13.2.2-bb.0 to 13.2.2-bb.1 (component name not - specified in provided notes)., Anchore Enterprise is upgraded from 1.27.4-bb.7 - to 2.0.2-bb.1 (major version jump).] - features: [Adds Istio Control Plane to the Big Bang bundle (1.19.7-bb.0)., Adds - Elasticsearch Kibana to the Big Bang bundle (1.11.0-bb.0)., Adds Tempo to - the Big Bang bundle (1.7.1-bb.3)., Adds Wrapper chart/component (0.4.6).] - breaking_changes: ["Anchore Enterprise jumps from 1.x to 2.0.2, which likely\ - \ includes breaking configuration and API changes\u2014review Anchore 2.0\ - \ upgrade notes before proceeding.", Removal of many components means any - existing deployments/CRs/values for those packages will no longer be managed - by Big Bang after upgrade; plan migrations or independent lifecycle management - before upgrading.] + chart_updates: + - Big Bang 2.23.0 introduces several new components (Istio Control Plane, Elasticsearch + Kibana, Tempo, Wrapper). + - Multiple previously-included components are removed from the Big Bang bundle + in 2.23.0 (Kyverno, Kyverno Reporter, Fluentbit, Promtail, Neuvector, Twistlock, + ArgoCD, Minio Operator, GitLab, Sonarqube, Fortify, HAProxy, Mattermost Operator, + Keycloak, Holocron). + - One component is updated from 13.2.2-bb.0 to 13.2.2-bb.1 (component name not + specified in provided notes). + - Anchore Enterprise is upgraded from 1.27.4-bb.7 to 2.0.2-bb.1 (major version + jump). + features: + - Adds Istio Control Plane to the Big Bang bundle (1.19.7-bb.0). + - Adds Elasticsearch Kibana to the Big Bang bundle (1.11.0-bb.0). + - Adds Tempo to the Big Bang bundle (1.7.1-bb.3). + - Adds Wrapper chart/component (0.4.6). + breaking_changes: + - "Anchore Enterprise jumps from 1.x to 2.0.2, which likely includes breaking\ + \ configuration and API changes\u2014review Anchore 2.0 upgrade notes before\ + \ proceeding." + - Removal of many components means any existing deployments/CRs/values for those + packages will no longer be managed by Big Bang after upgrade; plan migrations + or independent lifecycle management before upgrading. chart_version: 2.23.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1 - version: 2.22.0 - kube: ['1.28'] + kube: + - '1.28' requirements: - name: Updated version: 1.19.7-bb.0 @@ -9022,26 +10677,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang meta-chart 2.21.0 \u2192 2.22.0 updates the component\ - \ set significantly (many new packages added; several previously-included\ - \ packages removed).", Argo CD packaged version updated from 5.53.1-bb.2 - to 6.1.0-bb.2., "One unnamed component shows a very large version jump:\ - \ 1.14.0-bb.2 \u2192 13.2.2-bb.0 (identify which package this is in your\ - \ values/previous release to validate migration steps)."] - features: ['Introduces multiple new platform and security packages (Cluster - Auditor, Gatekeeper, Kyverno, Kyverno Reporter, NeuVector, Twistlock).', - 'Adds several new ops/observability and app platform components (ECK Operator, - Promtail, MinIO Operator, GitLab, SonarQube, Mattermost Operator, Keycloak).'] - breaking_changes: ["Removes several previously-managed packages from the Big\ - \ Bang release (Istio Operator, Kyverno Policies, Tempo, Monitoring, Authservice,\ - \ Nexus, Velero, Thanos). Plan ownership/installation for these if you still\ - \ need them, and confirm dependent integrations don\u2019t break.", 'Because - many components are newly introduced, expect new CRDs/namespaces/cluster-scoped - resources; review cluster policy and RBAC impacts before upgrading.'] + chart_updates: + - "Big Bang meta-chart 2.21.0 \u2192 2.22.0 updates the component set significantly\ + \ (many new packages added; several previously-included packages removed)." + - Argo CD packaged version updated from 5.53.1-bb.2 to 6.1.0-bb.2. + - "One unnamed component shows a very large version jump: 1.14.0-bb.2 \u2192\ + \ 13.2.2-bb.0 (identify which package this is in your values/previous release\ + \ to validate migration steps)." + features: + - Introduces multiple new platform and security packages (Cluster Auditor, Gatekeeper, + Kyverno, Kyverno Reporter, NeuVector, Twistlock). + - Adds several new ops/observability and app platform components (ECK Operator, + Promtail, MinIO Operator, GitLab, SonarQube, Mattermost Operator, Keycloak). + breaking_changes: + - "Removes several previously-managed packages from the Big Bang release (Istio\ + \ Operator, Kyverno Policies, Tempo, Monitoring, Authservice, Nexus, Velero,\ + \ Thanos). Plan ownership/installation for these if you still need them, and\ + \ confirm dependent integrations don\u2019t break." + - Because many components are newly introduced, expect new CRDs/namespaces/cluster-scoped + resources; review cluster policy and RBAC impacts before upgrading. chart_version: 2.22.0 images: [] - version: 2.21.0 - kube: ['1.28'] + kube: + - '1.28' requirements: - name: Updated version: 1.19.6-bb.2 @@ -9126,30 +10785,35 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.21.0 includes major component set changes vs 2.20.0: - several new components were added (Jaeger, Kyverno Policies, Fluentbit, - Monitoring, Authservice, Gitlab Runner, Fortify, Velero, Holocron, Thanos) - and many were removed (Istio Controlplane, Cluster Auditor, Neuvector, Wrapper, - Minio Operator/Minio, Mattermost Operator/Mattermost, Keycloak, Vault, Metrics - Server, Harbor, and an entry labeled ''New 1.0.0'').', One existing component - appears to have a version change from `12.23.0-bb.2` to `1.14.0-bb.2` (the - component name is not provided in the notes you pasted).] - features: ['Adds observability/logging/monitoring stack components (Monitoring, - Thanos, Jaeger, Fluentbit) as first-class managed packages in Big Bang 2.21.0.', - 'Adds security/policy and platform services components (Kyverno Policies, - Authservice, Gitlab Runner, Velero, Fortify, Holocron) to the distribution.'] - breaking_changes: ['Removes multiple previously-managed components (Istio Controlplane, - Keycloak, Vault, Harbor, Minio, Mattermost, Metrics Server, Neuvector, Cluster - Auditor, etc.); existing deployments relying on Big Bang to install/upgrade - these must be migrated or managed separately before/after upgrade.', "Introduces\ - \ a potentially significant component version change (`12.23.0-bb.2` \u2192\ - \ `1.14.0-bb.2`) which may indicate a chart rename or a downgrade/renumbering;\ - \ validate the actual component and compatibility before upgrading."] + chart_updates: + - 'Big Bang 2.21.0 includes major component set changes vs 2.20.0: several new + components were added (Jaeger, Kyverno Policies, Fluentbit, Monitoring, Authservice, + Gitlab Runner, Fortify, Velero, Holocron, Thanos) and many were removed (Istio + Controlplane, Cluster Auditor, Neuvector, Wrapper, Minio Operator/Minio, Mattermost + Operator/Mattermost, Keycloak, Vault, Metrics Server, Harbor, and an entry + labeled ''New 1.0.0'').' + - One existing component appears to have a version change from `12.23.0-bb.2` + to `1.14.0-bb.2` (the component name is not provided in the notes you pasted). + features: + - Adds observability/logging/monitoring stack components (Monitoring, Thanos, + Jaeger, Fluentbit) as first-class managed packages in Big Bang 2.21.0. + - Adds security/policy and platform services components (Kyverno Policies, Authservice, + Gitlab Runner, Velero, Fortify, Holocron) to the distribution. + breaking_changes: + - Removes multiple previously-managed components (Istio Controlplane, Keycloak, + Vault, Harbor, Minio, Mattermost, Metrics Server, Neuvector, Cluster Auditor, + etc.); existing deployments relying on Big Bang to install/upgrade these must + be migrated or managed separately before/after upgrade. + - "Introduces a potentially significant component version change (`12.23.0-bb.2`\ + \ \u2192 `1.14.0-bb.2`) which may indicate a chart rename or a downgrade/renumbering;\ + \ validate the actual component and compatibility before upgrading." chart_version: 2.21.0 - images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.17.5', - 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0'] + images: + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.17.5 + - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0 - version: 2.20.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Istio Controlplane version: 1.19.6-bb.1 @@ -9234,26 +10898,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Adds multiple new components to the Big Bang bundle: Istio - Controlplane, Istio Operator, Tempo, Wrapper, Argo CD, Minio, Nexus, HAProxy, - Mattermost, Vault, Harbor, and a component labeled "New" (v1.0.0).', Updates - an existing component from 12.21.0-bb.1 to 12.23.0-bb.2 (component name - not provided in the notes you pasted)., 'Removes several previously-included - components: Kiali, Gatekeeper, Loki, GitLab Runner, Sonarqube, and Fortify.'] - features: [Introduces first-class support for deploying Istio via newly-added - Istio Operator and Istio Controlplane packages., Adds new observability - capability by bundling Tempo., 'Expands platform services by bundling Argo - CD, Minio, Nexus, HAProxy, Mattermost, Vault, and Harbor.'] - breaking_changes: ['Removal of previously-managed components (Kiali, Gatekeeper, - Loki, GitLab Runner, Sonarqube, Fortify) means Big Bang will no longer install/upgrade - these; existing installations may become orphaned and must be managed or - removed separately.', 'Adding many new components can change the rendered - manifests and required cluster resources; ensure namespaces, storage classes, - and ingress/gateway expectations still match your environment.'] + chart_updates: + - 'Adds multiple new components to the Big Bang bundle: Istio Controlplane, + Istio Operator, Tempo, Wrapper, Argo CD, Minio, Nexus, HAProxy, Mattermost, + Vault, Harbor, and a component labeled "New" (v1.0.0).' + - Updates an existing component from 12.21.0-bb.1 to 12.23.0-bb.2 (component + name not provided in the notes you pasted). + - 'Removes several previously-included components: Kiali, Gatekeeper, Loki, + GitLab Runner, Sonarqube, and Fortify.' + features: + - Introduces first-class support for deploying Istio via newly-added Istio Operator + and Istio Controlplane packages. + - Adds new observability capability by bundling Tempo. + - Expands platform services by bundling Argo CD, Minio, Nexus, HAProxy, Mattermost, + Vault, and Harbor. + breaking_changes: + - Removal of previously-managed components (Kiali, Gatekeeper, Loki, GitLab + Runner, Sonarqube, Fortify) means Big Bang will no longer install/upgrade + these; existing installations may become orphaned and must be managed or removed + separately. + - Adding many new components can change the rendered manifests and required + cluster resources; ensure namespaces, storage classes, and ingress/gateway + expectations still match your environment. chart_version: 2.20.0 images: [] - version: 2.19.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.19.6-bb.0 @@ -9335,14 +11006,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [No application release notes were provided beyond an admin/support - message indicating the currently supported Big Bang version is 3.25.0.] - breaking_changes: [No breaking changes were listed in the provided release note - excerpts; treat this as unknown until the full 2.19.0 changelog is reviewed.] + features: + - No application release notes were provided beyond an admin/support message + indicating the currently supported Big Bang version is 3.25.0. + breaking_changes: + - No breaking changes were listed in the provided release note excerpts; treat + this as unknown until the full 2.19.0 changelog is reviewed. chart_version: 2.19.0 images: [] - version: 2.18.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.19.5-bb.2 @@ -9425,23 +11099,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.18.0 updates the package set relative to 2.17.0, - including upgrading one component and adding/removing multiple components - (see breaking changes).'] - features: ['Adds new optional packages: Minio (5.0.11-bb.0), Sonarqube (8.0.3-bb.0), - and Velero (5.1.3-bb.2).', Upgrades one component from 12.13.12-bb.4 to - 12.16.1-bb.0.] - breaking_changes: ['Large package set removal: Istio Controlplane/Operator, - Cluster Auditor, Elasticsearch Kibana, Grafana, Twistlock, Wrapper, Authservice, - Gitlab Runner, Nexus, Fortify, Haproxy, Keycloak, Vault, and Harbor are - removed in 2.18.0 and will no longer be deployed/managed by Big Bang after - upgrade.', 'If your environment relied on any removed packages for auth, - ingress, observability, scanning, registry, secrets, or CI runners, you - must plan replacements or manage them outside Big Bang before upgrading.'] + chart_updates: + - Big Bang 2.18.0 updates the package set relative to 2.17.0, including upgrading + one component and adding/removing multiple components (see breaking changes). + features: + - 'Adds new optional packages: Minio (5.0.11-bb.0), Sonarqube (8.0.3-bb.0), + and Velero (5.1.3-bb.2).' + - Upgrades one component from 12.13.12-bb.4 to 12.16.1-bb.0. + breaking_changes: + - 'Large package set removal: Istio Controlplane/Operator, Cluster Auditor, + Elasticsearch Kibana, Grafana, Twistlock, Wrapper, Authservice, Gitlab Runner, + Nexus, Fortify, Haproxy, Keycloak, Vault, and Harbor are removed in 2.18.0 + and will no longer be deployed/managed by Big Bang after upgrade.' + - If your environment relied on any removed packages for auth, ingress, observability, + scanning, registry, secrets, or CI runners, you must plan replacements or + manage them outside Big Bang before upgrading. chart_version: 2.18.0 images: [] - version: 2.17.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Istio Controlplane version: 1.19.4-bb.0 @@ -9524,13 +11201,14 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: [Release notes not provided (only headings/links). Cannot - identify actual changes between Big Bang 2.16.0 and 2.17.0 from the supplied - text.] + breaking_changes: + - Release notes not provided (only headings/links). Cannot identify actual changes + between Big Bang 2.16.0 and 2.17.0 from the supplied text. chart_version: 2.17.0 images: [] - version: 2.16.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.19.4-bb.0 @@ -9614,14 +11292,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Big Bang 2.16.0 release notes link provided but no details included - in the pasted text.] - breaking_changes: [Unable to determine breaking changes from the provided snippet; - full 2.16.0 release notes content is needed.] + features: + - Big Bang 2.16.0 release notes link provided but no details included in the + pasted text. + breaking_changes: + - Unable to determine breaking changes from the provided snippet; full 2.16.0 + release notes content is needed. chart_version: 2.16.0 - images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.8'] + images: + - registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.8 - version: 2.15.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.19.3-bb.1 @@ -9704,24 +11386,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang release updated from 2.14.0 to 2.15.0; notable composition - change: several charts added and several removed (see features/breaking - changes).'] - features: ["Introduces several new optional/packaged components: Istio Operator,\ - \ Fluentbit, Promtail, Loki, Minio Operator, Sonarqube, Fortify, Haproxy,\ - \ and a chart listed as \u201CNew\u201D (version 12.13.12-bb.3).", Includes - a minor update of an existing component from 1.13.0-bb.3 to 1.13.1-bb.0 - (exact component name not provided in notes).] - breaking_changes: ['Removes multiple previously packaged components: ECK Operator, - Authservice, Gitlab Runner, Anchore Enterprise, Mattermost, and Metrics - Server; any existing values, overrides, or dependencies for these must be - removed or replaced.', 'If you relied on Authservice/GitLab Runner/etc. - from Big Bang, you must plan an external/alternate deployment or accept - loss of functionality during/after upgrade.'] + chart_updates: + - 'Big Bang release updated from 2.14.0 to 2.15.0; notable composition change: + several charts added and several removed (see features/breaking changes).' + features: + - "Introduces several new optional/packaged components: Istio Operator, Fluentbit,\ + \ Promtail, Loki, Minio Operator, Sonarqube, Fortify, Haproxy, and a chart\ + \ listed as \u201CNew\u201D (version 12.13.12-bb.3)." + - Includes a minor update of an existing component from 1.13.0-bb.3 to 1.13.1-bb.0 + (exact component name not provided in notes). + breaking_changes: + - 'Removes multiple previously packaged components: ECK Operator, Authservice, + Gitlab Runner, Anchore Enterprise, Mattermost, and Metrics Server; any existing + values, overrides, or dependencies for these must be removed or replaced.' + - If you relied on Authservice/GitLab Runner/etc. from Big Bang, you must plan + an external/alternate deployment or accept loss of functionality during/after + upgrade. chart_version: 2.15.0 images: [] - version: 2.14.0 - kube: ['1.27'] + kube: + - '1.27' requirements: - name: Updated version: 1.19.3-bb.0 @@ -9797,18 +11482,20 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['No concrete application-level release notes were provided beyond - the ''Admin message'' about supported Big Bang version, so features for - 2.14.0 cannot be determined from the supplied text.'] - breaking_changes: ['The ''Currently supported Big Bang Version'' message changes - from 3.25.0 (in 2.13.0 notes) to 3.23.0 (in 2.14.0 notes). Treat this as - a potential compatibility/support policy change and verify what ''supported - version'' refers to in your environment (K8s, Istio, underlying platform, - etc.).'] + features: + - No concrete application-level release notes were provided beyond the 'Admin + message' about supported Big Bang version, so features for 2.14.0 cannot be + determined from the supplied text. + breaking_changes: + - The 'Currently supported Big Bang Version' message changes from 3.25.0 (in + 2.13.0 notes) to 3.23.0 (in 2.14.0 notes). Treat this as a potential compatibility/support + policy change and verify what 'supported version' refers to in your environment + (K8s, Istio, underlying platform, etc.). chart_version: 2.14.0 images: [] - version: 2.13.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.19.0-bb.2 @@ -9890,14 +11577,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Big Bang 2.13.0 updates the supported upstream Big Bang version to - 3.25.0 (from 3.22.1 in 2.12.0).] - breaking_changes: [Release notes provided only contain the admin message about - supported version; no breaking changes are listed in the provided text.] + features: + - Big Bang 2.13.0 updates the supported upstream Big Bang version to 3.25.0 + (from 3.22.1 in 2.12.0). + breaking_changes: + - Release notes provided only contain the admin message about supported version; + no breaking changes are listed in the provided text. chart_version: 2.13.0 images: [] - version: 2.12.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.19.0-bb.0 @@ -9979,17 +11669,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided do not include specific changes between Big\ - \ Bang 2.11.0 and 2.12.0; only an admin message is visible: \u201CCurrently\ - \ supported Big Bang Version is 3.22.1.\u201D"] - breaking_changes: ['Potential support-policy breaking change: 2.12.0 appears - to be out of the currently supported window (admin message says supported - version is 3.22.1), which may impact upgrade assistance, security patches, - and compatibility expectations.'] + features: + - "Release notes provided do not include specific changes between Big Bang 2.11.0\ + \ and 2.12.0; only an admin message is visible: \u201CCurrently supported\ + \ Big Bang Version is 3.22.1.\u201D" + breaking_changes: + - 'Potential support-policy breaking change: 2.12.0 appears to be out of the + currently supported window (admin message says supported version is 3.22.1), + which may impact upgrade assistance, security patches, and compatibility expectations.' chart_version: 2.12.0 images: [] - version: 2.11.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Istio Controlplane version: 1.18.2-bb.1 @@ -10070,28 +11762,36 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang 2.11.0 introduces several new packaged components\ - \ (Cluster Auditor, Promtail, Loki, Grafana, Harbor, and an additional component\ - \ listed as \u201CNew\u201D).", 'Several previously bundled components are - removed in 2.11.0 (Kyverno Policies, Kyverno Reporter, Mattermost, Velero, - Vault).', One existing component shows a major version change from `1.12.4-bb.0` - to `0.25.0-bb.0` (component name not provided in notes; treat as a likely - breaking/packaging change and verify which chart this refers to).] - features: ['Adds log aggregation/visualization stack components (Loki, Promtail, - Grafana) as first-class packages in Big Bang 2.11.0.', Adds Cluster Auditor - as a new component to improve cluster auditing/compliance visibility., Adds - Harbor as a packaged registry component (if enabled) in this Big Bang release.] - breaking_changes: [Removes Kyverno Policies and Kyverno Reporter packages; any - prior policy/reporting functionality must be replaced or managed outside - Big Bang., 'Removes Mattermost, Velero, and Vault packages; upgrades must - account for data migration/backup/restore and secrets management continuity - if those were in use.', A component version changing from `1.12.4-bb.0` - to `0.25.0-bb.0` suggests a potentially breaking rename/replacement; confirm - the component/chart mapping before upgrading.] + chart_updates: + - "Big Bang 2.11.0 introduces several new packaged components (Cluster Auditor,\ + \ Promtail, Loki, Grafana, Harbor, and an additional component listed as \u201C\ + New\u201D)." + - Several previously bundled components are removed in 2.11.0 (Kyverno Policies, + Kyverno Reporter, Mattermost, Velero, Vault). + - One existing component shows a major version change from `1.12.4-bb.0` to + `0.25.0-bb.0` (component name not provided in notes; treat as a likely breaking/packaging + change and verify which chart this refers to). + features: + - Adds log aggregation/visualization stack components (Loki, Promtail, Grafana) + as first-class packages in Big Bang 2.11.0. + - Adds Cluster Auditor as a new component to improve cluster auditing/compliance + visibility. + - Adds Harbor as a packaged registry component (if enabled) in this Big Bang + release. + breaking_changes: + - Removes Kyverno Policies and Kyverno Reporter packages; any prior policy/reporting + functionality must be replaced or managed outside Big Bang. + - Removes Mattermost, Velero, and Vault packages; upgrades must account for + data migration/backup/restore and secrets management continuity if those were + in use. + - A component version changing from `1.12.4-bb.0` to `0.25.0-bb.0` suggests + a potentially breaking rename/replacement; confirm the component/chart mapping + before upgrading. chart_version: 2.11.0 images: [] - version: 2.10.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Istio Controlplane version: 1.18.2-bb.1 @@ -10170,30 +11870,35 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.10.0 introduces a major package composition change: - many optional packages are removed from the umbrella chart and several new - packages are added (Istio control plane, observability stack pieces, etc.).', - One component shows a large version jump from `0.24.1-bb.3` to `1.12.4-bb.0` - (component name not provided in notes); treat this as high-risk and review - its specific chart/app changelog before upgrading.] - features: [Adds Istio Controlplane package (1.18.2-bb.1)., Adds Jaeger (2.46.0-bb.2) - plus an Elasticsearch/Kibana stack (1.3.1-bb.1) for tracing/log analytics., - Adds Fluent Bit (0.37.0-bb.0) and Monitoring (48.3.1-bb.0)., 'Adds several - app packages: Sonarqube (8.0.1-bb.4), Haproxy (1.12.0-bb.1), Mattermost - (8.0.1-bb.1), and Vault (0.24.1-bb.3).'] - breaking_changes: ['Removes multiple previously-available packages from Big - Bang: Cluster Auditor, Promtail, Loki, Tempo, Grafana, Twistlock, ArgoCD, - Authservice, Gitlab Runner, Keycloak, and Harbor. If you depended on any - of these being deployed/managed by Big Bang, you must migrate to external - installs or new replacement packages before/at upgrade.', 'Observability - stack changes are significant (Loki/Promtail/Grafana/Tempo removed; new - Monitoring/Jaeger/Elasticsearch/Kibana/Fluent Bit added). Expect changes - in dashboards, log shipping, tracing endpoints, and storage backends; plan - data migration/retention impacts.'] + chart_updates: + - 'Big Bang 2.10.0 introduces a major package composition change: many optional + packages are removed from the umbrella chart and several new packages are + added (Istio control plane, observability stack pieces, etc.).' + - One component shows a large version jump from `0.24.1-bb.3` to `1.12.4-bb.0` + (component name not provided in notes); treat this as high-risk and review + its specific chart/app changelog before upgrading. + features: + - Adds Istio Controlplane package (1.18.2-bb.1). + - Adds Jaeger (2.46.0-bb.2) plus an Elasticsearch/Kibana stack (1.3.1-bb.1) + for tracing/log analytics. + - Adds Fluent Bit (0.37.0-bb.0) and Monitoring (48.3.1-bb.0). + - 'Adds several app packages: Sonarqube (8.0.1-bb.4), Haproxy (1.12.0-bb.1), + Mattermost (8.0.1-bb.1), and Vault (0.24.1-bb.3).' + breaking_changes: + - 'Removes multiple previously-available packages from Big Bang: Cluster Auditor, + Promtail, Loki, Tempo, Grafana, Twistlock, ArgoCD, Authservice, Gitlab Runner, + Keycloak, and Harbor. If you depended on any of these being deployed/managed + by Big Bang, you must migrate to external installs or new replacement packages + before/at upgrade.' + - Observability stack changes are significant (Loki/Promtail/Grafana/Tempo removed; + new Monitoring/Jaeger/Elasticsearch/Kibana/Fluent Bit added). Expect changes + in dashboards, log shipping, tracing endpoints, and storage backends; plan + data migration/retention impacts. chart_version: 2.10.0 images: [] - version: 2.9.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.18.2-bb.1 @@ -10272,25 +11977,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang release 2.9.0 updates the curated set of packaged - components versus 2.8.0, adding several new components and removing several - previously-included ones.'] - features: ['Adds new packaged components: Istio Operator, Kyverno Policies, - Promtail, Loki, Argo CD, Authservice, Anchore Enterprise, Velero, and Harbor - (now included as a managed package).'] - breaking_changes: ['Multiple components are removed from the default Big Bang - package set in 2.9.0: Jaeger, Elasticsearch/Kibana, Fluentbit, Sonarqube, - Haproxy, Mattermost, and Vault. If you relied on any of these, you must - plan migration/replacement or manage them outside Big Bang after upgrade.', - 'Logging/observability stack shifts: Fluentbit/ES/Kibana/Jaeger removal alongside - Loki/Promtail addition may require reworking log collection, storage, dashboards, - and retention configuration.', 'Security/policy and delivery capabilities - change with Kyverno Policies and Argo CD being newly introduced; enabling - them may require new RBAC, namespaces, and configuration decisions.'] + chart_updates: + - Big Bang release 2.9.0 updates the curated set of packaged components versus + 2.8.0, adding several new components and removing several previously-included + ones. + features: + - 'Adds new packaged components: Istio Operator, Kyverno Policies, Promtail, + Loki, Argo CD, Authservice, Anchore Enterprise, Velero, and Harbor (now included + as a managed package).' + breaking_changes: + - 'Multiple components are removed from the default Big Bang package set in + 2.9.0: Jaeger, Elasticsearch/Kibana, Fluentbit, Sonarqube, Haproxy, Mattermost, + and Vault. If you relied on any of these, you must plan migration/replacement + or manage them outside Big Bang after upgrade.' + - 'Logging/observability stack shifts: Fluentbit/ES/Kibana/Jaeger removal alongside + Loki/Promtail addition may require reworking log collection, storage, dashboards, + and retention configuration.' + - Security/policy and delivery capabilities change with Kyverno Policies and + Argo CD being newly introduced; enabling them may require new RBAC, namespaces, + and configuration decisions. chart_version: 2.9.0 images: [] - version: 2.8.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.18.2-bb.0 @@ -10368,14 +12078,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Release notes were referenced (Big Bang 2.7.0 and 2.8.0), but no - actual changelog content was provided to extract specific features.'] - breaking_changes: [Unable to identify breaking changes because the release note - details were not included in the prompt.] + features: + - Release notes were referenced (Big Bang 2.7.0 and 2.8.0), but no actual changelog + content was provided to extract specific features. + breaking_changes: + - Unable to identify breaking changes because the release note details were + not included in the prompt. chart_version: 2.8.0 images: [] - version: 2.7.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.18.1-bb.0 @@ -10452,34 +12165,41 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang 2.7.0 introduces significant bundle composition changes:\ - \ multiple new packages were added (Jaeger, Gatekeeper, Kyverno, ECK Operator,\ - \ Loki, Authservice, Sonarqube, Mattermost, Metrics Server, and another\ - \ package listed as \u201CNew\u201D).", 'Several packages present in 2.6.0 - were removed in 2.7.0: Istio Controlplane/Operator, Monitoring, Twistlock, - and GitLab.', "One package was updated from `3.10.0-bb.0` to `18.4.3-bb.2`\ - \ (the component name wasn\u2019t provided in the notes)."] - features: ['Adds several new optional capabilities to the Big Bang bundle, including - policy enforcement (Gatekeeper/Kyverno), tracing (Jaeger), logging (Loki), - and additional apps/operators (ECK Operator, Authservice, Sonarqube, Mattermost, - Metrics Server).', 'Removes/decouples some previously bundled components - (Istio, Monitoring, GitLab, Twistlock), implying users now install/operate - them separately or via different packages depending on desired functionality.'] - breaking_changes: ['Removal of Istio Controlplane/Operator means any existing - Istio-managed ingress/service mesh setup must be migrated to whatever replaces - it in 2.7.0, or installed separately before/after the upgrade.', Removal - of Monitoring means any Prometheus/Grafana/Alertmanager stack previously - managed by Big Bang will no longer be upgraded/managed; you must preserve - CRDs/PVCs and plan an alternative monitoring deployment., Removal of GitLab - from the bundle means Big Bang no longer manages GitLab upgrades; ensure - you have a standalone GitLab plan and avoid accidental uninstall of resources - during the upgrade., Removal of Twistlock means security scanning/enforcement - previously integrated will disappear unless replaced by another tool; confirm - compliance requirements before upgrading.] + chart_updates: + - "Big Bang 2.7.0 introduces significant bundle composition changes: multiple\ + \ new packages were added (Jaeger, Gatekeeper, Kyverno, ECK Operator, Loki,\ + \ Authservice, Sonarqube, Mattermost, Metrics Server, and another package\ + \ listed as \u201CNew\u201D)." + - 'Several packages present in 2.6.0 were removed in 2.7.0: Istio Controlplane/Operator, + Monitoring, Twistlock, and GitLab.' + - "One package was updated from `3.10.0-bb.0` to `18.4.3-bb.2` (the component\ + \ name wasn\u2019t provided in the notes)." + features: + - Adds several new optional capabilities to the Big Bang bundle, including policy + enforcement (Gatekeeper/Kyverno), tracing (Jaeger), logging (Loki), and additional + apps/operators (ECK Operator, Authservice, Sonarqube, Mattermost, Metrics + Server). + - Removes/decouples some previously bundled components (Istio, Monitoring, GitLab, + Twistlock), implying users now install/operate them separately or via different + packages depending on desired functionality. + breaking_changes: + - Removal of Istio Controlplane/Operator means any existing Istio-managed ingress/service + mesh setup must be migrated to whatever replaces it in 2.7.0, or installed + separately before/after the upgrade. + - Removal of Monitoring means any Prometheus/Grafana/Alertmanager stack previously + managed by Big Bang will no longer be upgraded/managed; you must preserve + CRDs/PVCs and plan an alternative monitoring deployment. + - Removal of GitLab from the bundle means Big Bang no longer manages GitLab + upgrades; ensure you have a standalone GitLab plan and avoid accidental uninstall + of resources during the upgrade. + - Removal of Twistlock means security scanning/enforcement previously integrated + will disappear unless replaced by another tool; confirm compliance requirements + before upgrading. chart_version: 2.7.0 images: [] - version: 2.6.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Istio Controlplane version: 1.17.3-bb.1 @@ -10555,16 +12275,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: ['Big Bang version 2.6.0 is the target upgrade from 2.5.0, but no - detailed release-note content was provided beyond placeholders, so features - cannot be enumerated from the supplied text.'] - breaking_changes: [No breaking changes were listed in the provided notes; verify - in the official Big Bang 2.6.0 release notes and component changelogs before - upgrading.] + features: + - Big Bang version 2.6.0 is the target upgrade from 2.5.0, but no detailed release-note + content was provided beyond placeholders, so features cannot be enumerated + from the supplied text. + breaking_changes: + - No breaking changes were listed in the provided notes; verify in the official + Big Bang 2.6.0 release notes and component changelogs before upgrading. chart_version: 2.6.0 images: [] - version: 2.5.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.17.3-bb.1 @@ -10637,29 +12359,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: [Big Bang version bump from 2.4.0 to 2.5.0 with significant component - lineup changes., 'Multiple new components introduced (observability, auth, - developer tooling) and several legacy components removed.', GitLab component - upgraded from 6.11.3-bb.0 to 7.0.4-bb.0.] - features: ['Adds several new platform capabilities via new packaged components: - Jaeger, Kiali, Tempo, and a full Monitoring stack for observability.', Adds - Elastic stack components (ECK Operator + Elasticsearch Kibana) to support - log/metric storage and visualization., Adds Authservice for authentication/authorization - integration., 'Adds developer tooling packages including Nexus, Sonarqube, - and Mattermost.'] - breaking_changes: ['Removes multiple previously-included components (Cluster - Auditor, Kyverno Policies, Neuvector, Minio Operator/Minio, Anchore Enterprise, - Velero); any workloads depending on them must be migrated or replaced before - upgrade.', "Large GitLab upgrade (6.11.x \u2192 7.0.x) may introduce GitLab\ - \ breaking changes and requires following GitLab\u2019s upgrade/migration\ - \ steps and verifying chart values compatibility.", 'Vault is now included - as a new component; if you already run Vault separately, plan for namespace/resource - conflicts and decide whether to adopt Big Bang-managed Vault or disable - it.'] + chart_updates: + - Big Bang version bump from 2.4.0 to 2.5.0 with significant component lineup + changes. + - Multiple new components introduced (observability, auth, developer tooling) + and several legacy components removed. + - GitLab component upgraded from 6.11.3-bb.0 to 7.0.4-bb.0. + features: + - 'Adds several new platform capabilities via new packaged components: Jaeger, + Kiali, Tempo, and a full Monitoring stack for observability.' + - Adds Elastic stack components (ECK Operator + Elasticsearch Kibana) to support + log/metric storage and visualization. + - Adds Authservice for authentication/authorization integration. + - Adds developer tooling packages including Nexus, Sonarqube, and Mattermost. + breaking_changes: + - Removes multiple previously-included components (Cluster Auditor, Kyverno + Policies, Neuvector, Minio Operator/Minio, Anchore Enterprise, Velero); any + workloads depending on them must be migrated or replaced before upgrade. + - "Large GitLab upgrade (6.11.x \u2192 7.0.x) may introduce GitLab breaking\ + \ changes and requires following GitLab\u2019s upgrade/migration steps and\ + \ verifying chart values compatibility." + - Vault is now included as a new component; if you already run Vault separately, + plan for namespace/resource conflicts and decide whether to adopt Big Bang-managed + Vault or disable it. chart_version: 2.5.0 images: [] - version: 2.4.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.17.2-bb.2 @@ -10732,28 +12459,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.4.0 is a meta-release that substantially reshuffles - included components: several packages are removed and several new ones are - added (GitLab, Keycloak, MinIO and MinIO Operator).', 'Multiple observability - and security-related add-ons are removed (e.g., Fluentbit/Promtail/Tempo/Twistlock) - which may require replacement tooling or external integrations.'] - features: [Adds GitLab as an included/managed component., Adds Keycloak as an - included/managed component for identity management., Adds MinIO and the - MinIO Operator as included/managed components for S3-compatible object storage.] - breaking_changes: [Removes Istio Operator and Istio Controlplane components - (service mesh management must be handled differently or is no longer provided - by this release)., Removes Kiali (Istio observability UI) from the stack., - Removes ECK Operator (Elastic Cloud on Kubernetes) from the stack., Removes - Fluentbit and Promtail (log shipping) and Tempo (tracing); existing logging/tracing - pipelines will break unless replaced., Removes Twistlock (Prisma Cloud) - integration/component., Removes Authservice; any SSO/authn flows depending - on it must be migrated., Removes Nexus; any artifact repository functionality - must be replaced or externalized., Removes Vault component; any in-cluster - secret management workflows depending on it must be migrated.] + chart_updates: + - 'Big Bang 2.4.0 is a meta-release that substantially reshuffles included components: + several packages are removed and several new ones are added (GitLab, Keycloak, + MinIO and MinIO Operator).' + - Multiple observability and security-related add-ons are removed (e.g., Fluentbit/Promtail/Tempo/Twistlock) + which may require replacement tooling or external integrations. + features: + - Adds GitLab as an included/managed component. + - Adds Keycloak as an included/managed component for identity management. + - Adds MinIO and the MinIO Operator as included/managed components for S3-compatible + object storage. + breaking_changes: + - Removes Istio Operator and Istio Controlplane components (service mesh management + must be handled differently or is no longer provided by this release). + - Removes Kiali (Istio observability UI) from the stack. + - Removes ECK Operator (Elastic Cloud on Kubernetes) from the stack. + - Removes Fluentbit and Promtail (log shipping) and Tempo (tracing); existing + logging/tracing pipelines will break unless replaced. + - Removes Twistlock (Prisma Cloud) integration/component. + - Removes Authservice; any SSO/authn flows depending on it must be migrated. + - Removes Nexus; any artifact repository functionality must be replaced or externalized. + - Removes Vault component; any in-cluster secret management workflows depending + on it must be migrated. chart_version: 2.4.0 images: [] - version: 2.3.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Istio Controlplane version: 1.17.2-bb.1 @@ -10829,16 +12562,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: [Big Bang supported version baseline increased from 3.22.1 (in 2.2.0 - notes) to 3.25.0 (in 2.3.0 notes).] - breaking_changes: ['Potential compatibility/support change: Big Bang 2.3.0 indicates - a newer currently supported Big Bang version (3.25.0) vs 3.22.1 in 2.2.0; - ensure your environment and dependent packages align with the newer supported - baseline.'] + features: + - Big Bang supported version baseline increased from 3.22.1 (in 2.2.0 notes) + to 3.25.0 (in 2.3.0 notes). + breaking_changes: + - 'Potential compatibility/support change: Big Bang 2.3.0 indicates a newer + currently supported Big Bang version (3.25.0) vs 3.22.1 in 2.2.0; ensure your + environment and dependent packages align with the newer supported baseline.' chart_version: 2.3.0 images: [] - version: 2.2.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.17.2-bb.1 @@ -10911,30 +12646,35 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang release 2.2.0 significantly changes the bundled component - set compared to 2.1.0, adding Kyverno Policies, Velero, and Metrics Server - while removing many previously bundled addons (Istio controlplane/operator, - monitoring stack, logging, policy, CI/CD, artifact, and secrets tooling).', - The supported Big Bang version in the admin message changes from 3.25.0 (noted - on 2.1.0 page) to 3.22.1 (noted on 2.2.0 page); verify which message is - authoritative for your environment/support contract.] - features: [Introduces Kyverno Policies as a new packaged component (noted as - added at 1.1.0-bb.6 in the component list)., Introduces Velero as a new - packaged component for backup/restore (added at 3.1.5-bb.1)., Introduces - Metrics Server as a new packaged component to provide Kubernetes resource - metrics (added at 3.9.0-bb.1).] - breaking_changes: ['Large-scale removal of previously included components (Istio, - monitoring/logging, Gatekeeper, Vault, Argo CD, Minio, GitLab Runner, Nexus, - Mattermost, Twistlock, etc.) means existing workloads depending on those - components will lose them unless you manage them separately.', "Component\ - \ version change listed as 3.9.0-bb.1 \u2192 0.24.1-bb.0 indicates at least\ - \ one packaged chart/app was replaced or significantly downgraded/renamed;\ - \ identify which component this refers to in your actual Big Bang manifest\ - \ before upgrading."] + chart_updates: + - Big Bang release 2.2.0 significantly changes the bundled component set compared + to 2.1.0, adding Kyverno Policies, Velero, and Metrics Server while removing + many previously bundled addons (Istio controlplane/operator, monitoring stack, + logging, policy, CI/CD, artifact, and secrets tooling). + - The supported Big Bang version in the admin message changes from 3.25.0 (noted + on 2.1.0 page) to 3.22.1 (noted on 2.2.0 page); verify which message is authoritative + for your environment/support contract. + features: + - Introduces Kyverno Policies as a new packaged component (noted as added at + 1.1.0-bb.6 in the component list). + - Introduces Velero as a new packaged component for backup/restore (added at + 3.1.5-bb.1). + - Introduces Metrics Server as a new packaged component to provide Kubernetes + resource metrics (added at 3.9.0-bb.1). + breaking_changes: + - Large-scale removal of previously included components (Istio, monitoring/logging, + Gatekeeper, Vault, Argo CD, Minio, GitLab Runner, Nexus, Mattermost, Twistlock, + etc.) means existing workloads depending on those components will lose them + unless you manage them separately. + - "Component version change listed as 3.9.0-bb.1 \u2192 0.24.1-bb.0 indicates\ + \ at least one packaged chart/app was replaced or significantly downgraded/renamed;\ + \ identify which component this refers to in your actual Big Bang manifest\ + \ before upgrading." chart_version: 2.2.0 images: [] - version: 2.1.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Istio Controlplane version: 1.17.2-bb.0 @@ -11009,29 +12749,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Big Bang 2.1.0 introduces several new packaged components (Istio - control plane/operator, Jaeger, Kiali, Gatekeeper, Elastic stack components, - Fluent Bit, NeuVector, Argo CD, GitLab Runner, Mattermost, Vault).', "Some\ - \ previously included packages are removed (Anchore Enterprise and Velero);\ - \ there is also a note indicating a 'New: 0.4.1 \u2192 removed' entry which\ - \ likely refers to an internal wrapper/umbrella component\u2014needs confirmation\ - \ from the official changelog."] - features: ['Adds a full Istio service mesh stack (control plane/operator) with - observability components (Jaeger, Kiali).', Adds policy enforcement via - Gatekeeper., 'Adds logging and Elastic stack options via Fluent Bit, ECK - operator, and Elasticsearch/Kibana packages.', Adds GitOps and CI/CD tooling - via Argo CD and GitLab Runner., 'Adds platform apps/security tooling such - as Mattermost, Vault, and NeuVector.'] - breaking_changes: ['Removal of Anchore Enterprise and Velero from the Big Bang - bundle means existing deployments of those components will no longer be - managed/upgraded by Big Bang 2.1.0 and must be handled separately (migrated, - pinned, or replaced).', 'Introducing Istio (if enabled) can change network - behavior (mTLS, sidecars, ingress/egress) and may require namespace labeling, - resource tuning, and compatibility checks for existing workloads.'] + chart_updates: + - Big Bang 2.1.0 introduces several new packaged components (Istio control plane/operator, + Jaeger, Kiali, Gatekeeper, Elastic stack components, Fluent Bit, NeuVector, + Argo CD, GitLab Runner, Mattermost, Vault). + - "Some previously included packages are removed (Anchore Enterprise and Velero);\ + \ there is also a note indicating a 'New: 0.4.1 \u2192 removed' entry which\ + \ likely refers to an internal wrapper/umbrella component\u2014needs confirmation\ + \ from the official changelog." + features: + - Adds a full Istio service mesh stack (control plane/operator) with observability + components (Jaeger, Kiali). + - Adds policy enforcement via Gatekeeper. + - Adds logging and Elastic stack options via Fluent Bit, ECK operator, and Elasticsearch/Kibana + packages. + - Adds GitOps and CI/CD tooling via Argo CD and GitLab Runner. + - Adds platform apps/security tooling such as Mattermost, Vault, and NeuVector. + breaking_changes: + - Removal of Anchore Enterprise and Velero from the Big Bang bundle means existing + deployments of those components will no longer be managed/upgraded by Big + Bang 2.1.0 and must be handled separately (migrated, pinned, or replaced). + - Introducing Istio (if enabled) can change network behavior (mTLS, sidecars, + ingress/egress) and may require namespace labeling, resource tuning, and compatibility + checks for existing workloads. chart_version: 2.1.0 images: [] - version: 2.0.0 - kube: ['1.26'] + kube: + - '1.26' requirements: - name: Updated version: 1.17.2-bb.0 @@ -11102,29 +12847,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Big Bang version jump 1.42.0 \u2192 2.0.0 includes significant\ - \ component set changes (many new packages added; several removed).", "Core\ - \ component version bumps include a major increase for the primary 'Updated'\ - \ component (2.31.3-bb.0 \u2192 3.9.0-bb.0), plus Nexus, Sonarqube, Anchore\ - \ Enterprise, Mattermost Operator, and Keycloak.", 'Istio Operator, Gatekeeper, - ECK Operator, Authservice, Gitlab Runner, Vault, and Metrics Server are - removed from the Big Bang bundle in 2.0.0.'] - features: ['Adds multiple new optional packages: Cluster Auditor, Kyverno, Kyverno - Reporter, Tempo, Monitoring, Twistlock, Velero, Minio Operator/Minio, and - others listed as ''new''.', 'Updates included applications to newer chart/app - versions for Nexus, Sonarqube, Anchore Enterprise, Mattermost Operator, - and Keycloak.'] - breaking_changes: ['Removal of several previously-included components (Istio - Operator, Gatekeeper, ECK Operator, Authservice, Gitlab Runner, Vault, Metrics - Server) requires migrating any functionality/configuration to the new recommended - approach or external installs.', "Large version bumps (notably Sonarqube\ - \ 1.x \u2192 8.x and Nexus 41.x \u2192 47.x) may introduce their own breaking\ - \ changes and should be validated against existing data/config and upgrade\ - \ paths."] + chart_updates: + - "Big Bang version jump 1.42.0 \u2192 2.0.0 includes significant component\ + \ set changes (many new packages added; several removed)." + - "Core component version bumps include a major increase for the primary 'Updated'\ + \ component (2.31.3-bb.0 \u2192 3.9.0-bb.0), plus Nexus, Sonarqube, Anchore\ + \ Enterprise, Mattermost Operator, and Keycloak." + - Istio Operator, Gatekeeper, ECK Operator, Authservice, Gitlab Runner, Vault, + and Metrics Server are removed from the Big Bang bundle in 2.0.0. + features: + - 'Adds multiple new optional packages: Cluster Auditor, Kyverno, Kyverno Reporter, + Tempo, Monitoring, Twistlock, Velero, Minio Operator/Minio, and others listed + as ''new''.' + - Updates included applications to newer chart/app versions for Nexus, Sonarqube, + Anchore Enterprise, Mattermost Operator, and Keycloak. + breaking_changes: + - Removal of several previously-included components (Istio Operator, Gatekeeper, + ECK Operator, Authservice, Gitlab Runner, Vault, Metrics Server) requires + migrating any functionality/configuration to the new recommended approach + or external installs. + - "Large version bumps (notably Sonarqube 1.x \u2192 8.x and Nexus 41.x \u2192\ + \ 47.x) may introduce their own breaking changes and should be validated against\ + \ existing data/config and upgrade paths." chart_version: 2.0.0 images: [] - version: 1.42.0 - kube: ['1.22'] + kube: + - '1.22' requirements: - name: Updated version: 1.14.3-bb.3 @@ -11198,63 +12947,135 @@ addons: helm_repository_url: https://aws.github.io/eks-charts versions: - version: 1.23.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 1.22.1 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 1.21.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.21.0 - version: 1.20.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.20.0 - version: 1.19.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.19.0 - version: 1.18.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.18.0 - version: 1.17.1 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.17.1 - version: 1.16.2 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Reverted the CNI spec used by the bundled CNI config to 0.4.0 to - maintain compatibility with EKS 1.23 (v1.16.0 had moved to CNI spec 1.0.0)., - 'In nftables mode, increased support to up to 50 CIDRs.'] - breaking_changes: ['Behavior change: the shipped CNI config/spec is reverted - from 1.0.0 back to 0.4.0 for EKS 1.23 compatibility; if you rely on CNI - spec 1.0.0 semantics, validate your CNI config/chain and cluster version - expectations during upgrade.'] + features: + - Reverted the CNI spec used by the bundled CNI config to 0.4.0 to maintain + compatibility with EKS 1.23 (v1.16.0 had moved to CNI spec 1.0.0). + - In nftables mode, increased support to up to 50 CIDRs. + breaking_changes: + - 'Behavior change: the shipped CNI config/spec is reverted from 1.0.0 back + to 0.4.0 for EKS 1.23 compatibility; if you rely on CNI spec 1.0.0 semantics, + validate your CNI config/chain and cluster version expectations during upgrade.' chart_version: 1.16.2 images: [] - version: 1.16.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -11266,69 +13087,106 @@ addons: \ upgrade practice (from v1.15.0 note): ensure the full manifest/Helm release\ \ is applied so RBAC/CRDs stay in sync (don\u2019t patch only the DaemonSet\ \ image)." - chart_updates: [Chart exposes additional parameters for `revisionHistory` and - `securityContext` (v1.16.0)., Chart templates were updated to include feature - flags in the ConfigMap (v1.16.0).] - features: [CNI spec updated to 1.0.0 in the VPC CNI conflist (may matter for - tooling that validates CNI config)., Security Groups for Pods is now supported - on IPv6 clusters (requires allowing ICMPv6 Neighbor Discovery in SGs)., - Prometheus metrics scraping support from the CNI metrics helper., Manifest - added for Multus 4.0.2 thick plugin support.] - breaking_changes: ['For IPv6 clusters using Security Groups for Pods, you must - allow ICMPv6 Neighbor Discovery in EC2 security groups or pods may fail - to resolve IPv6 to MAC (connectivity issues).', 'Operationally treat this - as a full-release upgrade: RBAC/CRDs/config changes accompany the DaemonSet; - upgrading by only changing images risks startup failures (highlighted in - v1.15.0 notes and still relevant).'] + chart_updates: + - Chart exposes additional parameters for `revisionHistory` and `securityContext` + (v1.16.0). + - Chart templates were updated to include feature flags in the ConfigMap (v1.16.0). + features: + - CNI spec updated to 1.0.0 in the VPC CNI conflist (may matter for tooling + that validates CNI config). + - Security Groups for Pods is now supported on IPv6 clusters (requires allowing + ICMPv6 Neighbor Discovery in SGs). + - Prometheus metrics scraping support from the CNI metrics helper. + - Manifest added for Multus 4.0.2 thick plugin support. + breaking_changes: + - For IPv6 clusters using Security Groups for Pods, you must allow ICMPv6 Neighbor + Discovery in EC2 security groups or pods may fail to resolve IPv6 to MAC (connectivity + issues). + - 'Operationally treat this as a full-release upgrade: RBAC/CRDs/config changes + accompany the DaemonSet; upgrading by only changing images risks startup failures + (highlighted in v1.15.0 notes and still relevant).' chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['`aws-node` DaemonSet continues to include the additional `aws-eks-nodeagent` - container introduced in 1.14.x for Kubernetes NetworkPolicy support; image - bump to `amazon/aws-network-policy-agent:v1.0.2` in 1.15.0.', 'RBAC/manifest - content changed in 1.15.0: the `aws-node` `ClusterRole` is modified (remove - `update` on `nodes`; add `get, list, patch` on `CNINode`). Upgrade must - apply the full manifest/chart so the new RBAC is present.', 'Security Groups - for Pods integration now uses the `CNINode` CRD in 1.15.0, deprecating reliance - on the `vpc.amazonaws.com/has-trunk-attached` node label.'] - features: ["Support for VPC Resource Controller\u2019s `CNINode` (used by Security\ - \ Groups for Pods) was added/reintroduced.", New `DISABLE_CONTAINER_V6` - env var allows disabling IPv6 networking inside container network namespaces., - New `IP_COOLDOWN_PERIOD` env var allows configuring the IP cooldown period.] - breaking_changes: [RBAC change in 1.15.0 requires updating the entire manifest/chart - (including `aws-node` `ClusterRole`) during upgrade/downgrade; partial applies - can prevent the CNI containers from starting., Security Groups for Pods - now relies on the `CNINode` CRD and deprecates the `vpc.amazonaws.com/has-trunk-attached` - label; any tooling/automation depending on that label should be updated.] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '`aws-node` DaemonSet continues to include the additional `aws-eks-nodeagent` + container introduced in 1.14.x for Kubernetes NetworkPolicy support; image + bump to `amazon/aws-network-policy-agent:v1.0.2` in 1.15.0.' + - 'RBAC/manifest content changed in 1.15.0: the `aws-node` `ClusterRole` is + modified (remove `update` on `nodes`; add `get, list, patch` on `CNINode`). + Upgrade must apply the full manifest/chart so the new RBAC is present.' + - Security Groups for Pods integration now uses the `CNINode` CRD in 1.15.0, + deprecating reliance on the `vpc.amazonaws.com/has-trunk-attached` node label. + features: + - "Support for VPC Resource Controller\u2019s `CNINode` (used by Security Groups\ + \ for Pods) was added/reintroduced." + - New `DISABLE_CONTAINER_V6` env var allows disabling IPv6 networking inside + container network namespaces. + - New `IP_COOLDOWN_PERIOD` env var allows configuring the IP cooldown period. + breaking_changes: + - RBAC change in 1.15.0 requires updating the entire manifest/chart (including + `aws-node` `ClusterRole`) during upgrade/downgrade; partial applies can prevent + the CNI containers from starting. + - Security Groups for Pods now relies on the `CNINode` CRD and deprecates the + `vpc.amazonaws.com/has-trunk-attached` label; any tooling/automation depending + on that label should be updated. chart_version: 1.15.0 images: [] - version: 1.14.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['`aws-node` DaemonSet now runs an additional container `aws-eks-nodeagent` - (AWS Network Policy Agent) alongside the existing CNI containers.', 'Verification - output/images now include `amazon/aws-network-policy-agent:v1.0.1` in addition - to `amazon-k8s-cni-init` and `amazon-k8s-cni`.', 'If deploying via raw manifests, - use the v1.14.0 YAMLs (and region-specific variants for gov/cloud-cn), as - the DaemonSet spec changed to include the new container.'] - features: [Adds Kubernetes NetworkPolicy enforcement support via an in-pod Network - Policy Agent (`aws-eks-nodeagent`).] - breaking_changes: ["`aws-eks-nodeagent` exposes metrics on host-network port\ - \ 8080 by default; this can conflict with other hostNetwork workloads binding\ - \ to 8080. Change the agent\u2019s metrics port via the `metrics-bind-addr`\ - \ container argument if needed."] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '`aws-node` DaemonSet now runs an additional container `aws-eks-nodeagent` + (AWS Network Policy Agent) alongside the existing CNI containers.' + - Verification output/images now include `amazon/aws-network-policy-agent:v1.0.1` + in addition to `amazon-k8s-cni-init` and `amazon-k8s-cni`. + - If deploying via raw manifests, use the v1.14.0 YAMLs (and region-specific + variants for gov/cloud-cn), as the DaemonSet spec changed to include the new + container. + features: + - Adds Kubernetes NetworkPolicy enforcement support via an in-pod Network Policy + Agent (`aws-eks-nodeagent`). + breaking_changes: + - "`aws-eks-nodeagent` exposes metrics on host-network port 8080 by default;\ + \ this can conflict with other hostNetwork workloads binding to 8080. Change\ + \ the agent\u2019s metrics port via the `metrics-bind-addr` container argument\ + \ if needed." chart_version: 1.14.0 images: [] - version: 1.13.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -11345,33 +13203,61 @@ addons: \ If you had custom tolerations, re-validate output for any formatting differences.\n\ - **Env var case-insensitivity**: all AWS VPC CNI env vars are now treated\ \ case-insensitively; standardize to canonical uppercase to avoid confusion.\n" - chart_updates: ['CNI chart: fix tolerations templating to produce valid YAML.', - 'CNI chart: refactor image template logic to better support flexible endpoints/registries.', - 'Init container behavior: install all core CNI plugins via init container - (manifest content/containers may change).', 'EKS add-on manifest: add resource - limits on init container (may affect custom overrides).'] - features: ['`ENABLE_V6_EGRESS`: allows pods in an IPv4 cluster to reach IPv6 - endpoints (IPv6 egress capability).', '`DISABLE_LEAKED_ENI_CLEANUP`: lets - operators disable the leaked ENI cleanup task if it conflicts with their - operational model.', '`AWS_EC2_ENDPOINT`: supports using a custom EC2 API - endpoint (e.g., private endpoints or special partitions).'] + chart_updates: + - 'CNI chart: fix tolerations templating to produce valid YAML.' + - 'CNI chart: refactor image template logic to better support flexible endpoints/registries.' + - 'Init container behavior: install all core CNI plugins via init container + (manifest content/containers may change).' + - 'EKS add-on manifest: add resource limits on init container (may affect custom + overrides).' + features: + - '`ENABLE_V6_EGRESS`: allows pods in an IPv4 cluster to reach IPv6 endpoints + (IPv6 egress capability).' + - '`DISABLE_LEAKED_ENI_CLEANUP`: lets operators disable the leaked ENI cleanup + task if it conflicts with their operational model.' + - '`AWS_EC2_ENDPOINT`: supports using a custom EC2 API endpoint (e.g., private + endpoints or special partitions).' breaking_changes: [] chart_version: 1.13.0 images: [] - version: 1.12.5 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.2.7 images: [] - version: 1.11.5 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 1.10.3 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null @@ -11386,187 +13272,267 @@ addons: eolApiSlug: calico versions: - version: 3.32.2 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release artifacts updated to v3.32.2 (container images/binaries/manifests, - Windows bundle, tigera-operator Helm chart, and CRD charts).'] + features: + - Release artifacts updated to v3.32.2 (container images/binaries/manifests, + Windows bundle, tigera-operator Helm chart, and CRD charts). breaking_changes: [] chart_version: 3.32.2 - images: ['quay.io/tigera/operator:v1.42.6'] + images: + - quay.io/tigera/operator:v1.42.6 - version: 3.32.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Calico v3.32.0 release artifacts include updated tigera-operator - Helm chart (v3.32.0) and separate CRD Helm charts for `crd.projectcalico.org/v1` - (v3.32.0) and a tech-preview `projectcalico.org/v3` CRD chart., v3.32.0 - continues to publish the standard Calico release bundle (images/binaries/manifests) - plus Windows and OpenShift (ocp.tgz) assets for this version.] + features: + - Calico v3.32.0 release artifacts include updated tigera-operator Helm chart + (v3.32.0) and separate CRD Helm charts for `crd.projectcalico.org/v1` (v3.32.0) + and a tech-preview `projectcalico.org/v3` CRD chart. + - v3.32.0 continues to publish the standard Calico release bundle (images/binaries/manifests) + plus Windows and OpenShift (ocp.tgz) assets for this version. breaking_changes: [] chart_version: 3.32.0 - images: ['quay.io/tigera/operator:v1.42.0'] + images: + - quay.io/tigera/operator:v1.42.0 - version: 3.31.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['New release artifacts packaging includes per-arch image tarballs - (including FIPS for linux/amd64), making air-gapped installs/upgrades easier - by importing images directly from provided tar files.', Updated tigera-operator - Helm chart package version to v3.31.0 (chart content likely updated to reference - Calico v3.31.0 images/manifests).] + features: + - New release artifacts packaging includes per-arch image tarballs (including + FIPS for linux/amd64), making air-gapped installs/upgrades easier by importing + images directly from provided tar files. + - Updated tigera-operator Helm chart package version to v3.31.0 (chart content + likely updated to reference Calico v3.31.0 images/manifests). breaking_changes: [] chart_version: 3.31.0 - images: ['quay.io/tigera/operator:v1.40.0'] + images: + - quay.io/tigera/operator:v1.40.0 - version: 3.30.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v3.30.0 ships updated Calico component images/binaries and updated - install bundles (including tigera-operator Helm v3 chart) compared to v3.29.0. - (No feature-level details were provided in the notes you shared.)] - breaking_changes: [No breaking changes were listed in the notes you shared; - confirm by reviewing the v3.30.0 release notes and the tigera-operator Helm - chart changelog before upgrading.] + features: + - v3.30.0 ships updated Calico component images/binaries and updated install + bundles (including tigera-operator Helm v3 chart) compared to v3.29.0. (No + feature-level details were provided in the notes you shared.) + breaking_changes: + - No breaking changes were listed in the notes you shared; confirm by reviewing + the v3.30.0 release notes and the tigera-operator Helm chart changelog before + upgrading. chart_version: 3.30.0 - images: ['quay.io/tigera/operator:v1.38.0'] + images: + - quay.io/tigera/operator:v1.38.0 eolAt: '2026-04-30' - version: 3.29.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release artifacts updated to v3.29.0 (new container images/binaries/manifests, - Windows bundle, and tigera-operator Helm v3 chart).'] + features: + - Release artifacts updated to v3.29.0 (new container images/binaries/manifests, + Windows bundle, and tigera-operator Helm v3 chart). breaking_changes: [] chart_version: 3.29.0 - images: ['quay.io/tigera/operator:v1.36.0'] + images: + - quay.io/tigera/operator:v1.36.0 eolAt: '2025-10-21' - version: 3.28.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release v3.28.0 is available with updated container images/binaries/manifests - and an updated tigera-operator Helm v3 chart artifact., Updated Calico for - Windows bundle is provided for v3.28.0., Updated OpenShift manifest bundle - (ocp.tgz) is provided for v3.28.0.] + features: + - Release v3.28.0 is available with updated container images/binaries/manifests + and an updated tigera-operator Helm v3 chart artifact. + - Updated Calico for Windows bundle is provided for v3.28.0. + - Updated OpenShift manifest bundle (ocp.tgz) is provided for v3.28.0. breaking_changes: [] chart_version: 3.28.0 - images: ['quay.io/tigera/operator:v1.34.0'] + images: + - quay.io/tigera/operator:v1.34.0 eolAt: '2025-05-05' - version: 3.27.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release notes content for v3.27.0 vs v3.26.0 not provided beyond - artifact lists; cannot extract specific new features from supplied text.] - breaking_changes: [No breaking changes described in the provided excerpts; full - v3.27.0 release notes link would be needed to confirm.] + features: + - Release notes content for v3.27.0 vs v3.26.0 not provided beyond artifact + lists; cannot extract specific new features from supplied text. + breaking_changes: + - No breaking changes described in the provided excerpts; full v3.27.0 release + notes link would be needed to confirm. chart_version: 3.27.0 - images: ['quay.io/tigera/operator:v1.32.3'] + images: + - quay.io/tigera/operator:v1.32.3 eolAt: '2024-10-29' - version: 3.26.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Calico v3.26.0 release available with updated artifacts (including - tigera-operator-v3.26.0.tgz).] + features: + - Calico v3.26.0 release available with updated artifacts (including tigera-operator-v3.26.0.tgz). breaking_changes: [] chart_version: 3.26.0 - images: ['quay.io/tigera/operator:v1.30.0'] + images: + - quay.io/tigera/operator:v1.30.0 eolAt: '2024-05-11' - version: 3.25.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Upgrade Calico application and bundled artifacts from v3.24.1 to - v3.25.0 (new release tarball, updated Windows zip, updated tigera-operator - Helm chart bundle).'] + features: + - Upgrade Calico application and bundled artifacts from v3.24.1 to v3.25.0 (new + release tarball, updated Windows zip, updated tigera-operator Helm chart bundle). breaking_changes: [] chart_version: 3.25.0 - images: ['quay.io/tigera/operator:v1.29.0'] + images: + - quay.io/tigera/operator:v1.29.0 eolAt: '2023-12-15' - version: 3.24.1 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are high-level metadata only (assets, links) - for v3.23.4 and v3.24.1; no functional changes are included in the excerpt, - so no specific new features can be confirmed from the supplied text.'] - breaking_changes: [No breaking changes are stated in the supplied release metadata; - must review the linked v3.24.x and v3.23.x release notes/changelog for actual - upgrade-impacting changes.] + features: + - Release notes provided are high-level metadata only (assets, links) for v3.23.4 + and v3.24.1; no functional changes are included in the excerpt, so no specific + new features can be confirmed from the supplied text. + breaking_changes: + - No breaking changes are stated in the supplied release metadata; must review + the linked v3.24.x and v3.23.x release notes/changelog for actual upgrade-impacting + changes. chart_version: 3.24.1 - images: ['quay.io/tigera/operator:v1.28.1'] + images: + - quay.io/tigera/operator:v1.28.1 - version: 3.23.4 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Tigera operator Helm chart artifact updated from v3.22.5 to - v3.23.4 (chart bundle size 47KB -> 49KB); no explicit chart changelog details - provided in supplied notes.] - features: [No specific feature list provided in the supplied release note excerpts; - refer to the Calico v3.23 release notes page for details.] - breaking_changes: [No breaking changes described in the supplied excerpts; review - the Calico v3.23 release notes for any upgrade-impacting changes between - 3.22 and 3.23.] + chart_updates: + - Tigera operator Helm chart artifact updated from v3.22.5 to v3.23.4 (chart + bundle size 47KB -> 49KB); no explicit chart changelog details provided in + supplied notes. + features: + - No specific feature list provided in the supplied release note excerpts; refer + to the Calico v3.23 release notes page for details. + breaking_changes: + - No breaking changes described in the supplied excerpts; review the Calico + v3.23 release notes for any upgrade-impacting changes between 3.22 and 3.23. chart_version: 3.23.4 - images: ['quay.io/tigera/operator:v1.27.14'] + images: + - quay.io/tigera/operator:v1.27.14 - version: 3.22.5 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Upgrade Calico application from v3.20.6 to v3.22.5 (includes updated - container images, binaries, and Kubernetes manifests).', Updated bundled - Tigera Operator Helm v3 chart artifact to tigera-operator-v3.22.5.tgz., - Release includes updated calicoctl binaries across multiple platforms and - updated Windows packaging (calico-windows-v3.22.5.zip).] - breaking_changes: ['Not provided in the notes shared; review the Calico v3.21 - and v3.22 archived release notes for any breaking changes impacting CNI, - Felix, BGP, IPAM, or CRDs before upgrading.'] + features: + - Upgrade Calico application from v3.20.6 to v3.22.5 (includes updated container + images, binaries, and Kubernetes manifests). + - Updated bundled Tigera Operator Helm v3 chart artifact to tigera-operator-v3.22.5.tgz. + - Release includes updated calicoctl binaries across multiple platforms and + updated Windows packaging (calico-windows-v3.22.5.zip). + breaking_changes: + - Not provided in the notes shared; review the Calico v3.21 and v3.22 archived + release notes for any breaking changes impacting CNI, Felix, BGP, IPAM, or + CRDs before upgrading. chart_version: 3.22.5 - images: ['quay.io/tigera/operator:v1.25.13'] + images: + - quay.io/tigera/operator:v1.25.13 - version: 3.20.6 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 3.20.6 - images: ['quay.io/tigera/operator:v1.20.9'] + images: + - quay.io/tigera/operator:v1.20.9 name: calico - icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png git_url: https://github.com/cert-manager/cert-manager @@ -11575,7 +13541,11 @@ addons: eolApiSlug: cert-manager versions: - version: 1.21.0 - kube: ['1.36', '1.35', '1.34', '1.33'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: @@ -11609,43 +13579,55 @@ addons: \ and component `runtimeClassName` settings\n - (If using common labels)\ \ ensure `global.commonLabels` propagation fits your expectations with the\ \ new HTTP01 solver extra-labels behavior." - chart_updates: ['Helm chart removed the default tokenrequest Role/RoleBinding - for the controller ServiceAccount (`serviceaccounts/token: create`).', Controller - Service metrics port name changed from `tcp-prometheus-servicemonitor` to - `http-metrics`., 'Removed Helm values `prometheus.servicemonitor.targetPort`, - `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` (schema - will reject them).', '`cert-manager-edit` aggregate ClusterRole permissions - reduced for ACME Challenge/Order resources (security hardening).', Gateway - API configuration fields `enableGatewayAPI*` deprecated in favor of `gatewayAPI.*` - (old fields still supported).] - features: [Experimental ACME Renewal Information (ARI) support behind the `ACMEUseARI` - feature gate to honor CA-provided renewal windows., New `waitInsteadOfSelfCheck` - option for ACME solvers to skip self-check and wait before asking the ACME - server to validate., Vault issuer can now use AWS IAM authentication (IRSA/EKS - Pod Identity/ambient EC2/ECS credentials) to avoid long-lived AWS secrets., - New `renewalPolicies` field on Certificates for more expressive renewal scheduling., - Configurable cap for CertificateRequest retry backoff via `--certificate-request-maximum-backoff-duration` - / `config.certificateRequestMaximumBackoffDuration` (default 32h)., Gateway - API improvements including HTTP01 parentRef fallback for ListenerSets and - an annotation to ignore selected TLS listeners., 'Cainjector improvements: - `CAInjectorMerging` is GA and server-side apply is now unconditional; new - `--ignore-namespaces` flag.', 'Operational improvements: `runtimeClassName` - support, startupapicheck TTL cleanup, and better observability for Venafi/CyberArk - OAuth auth failures.'] - breaking_changes: [Helm chart no longer creates default RBAC allowing the controller - ServiceAccount to `create` `serviceaccounts/token`; workloads relying on - that undocumented pattern must add RBAC or switch to a dedicated ServiceAccount., - '`cert-manager-edit` aggregate ClusterRole no longer grants create/update - permissions for ACME Challenge/Order resources; any tooling that manipulates - these resources directly needs explicit RBAC.', 'Helm values `prometheus.servicemonitor.targetPort`, - `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` were - removed and will cause schema validation failure if still present; controller - metrics port name is now `http-metrics`.'] + chart_updates: + - 'Helm chart removed the default tokenrequest Role/RoleBinding for the controller + ServiceAccount (`serviceaccounts/token: create`).' + - Controller Service metrics port name changed from `tcp-prometheus-servicemonitor` + to `http-metrics`. + - Removed Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, + and `prometheus.podmonitor.path` (schema will reject them). + - '`cert-manager-edit` aggregate ClusterRole permissions reduced for ACME Challenge/Order + resources (security hardening).' + - Gateway API configuration fields `enableGatewayAPI*` deprecated in favor of + `gatewayAPI.*` (old fields still supported). + features: + - Experimental ACME Renewal Information (ARI) support behind the `ACMEUseARI` + feature gate to honor CA-provided renewal windows. + - New `waitInsteadOfSelfCheck` option for ACME solvers to skip self-check and + wait before asking the ACME server to validate. + - Vault issuer can now use AWS IAM authentication (IRSA/EKS Pod Identity/ambient + EC2/ECS credentials) to avoid long-lived AWS secrets. + - New `renewalPolicies` field on Certificates for more expressive renewal scheduling. + - Configurable cap for CertificateRequest retry backoff via `--certificate-request-maximum-backoff-duration` + / `config.certificateRequestMaximumBackoffDuration` (default 32h). + - Gateway API improvements including HTTP01 parentRef fallback for ListenerSets + and an annotation to ignore selected TLS listeners. + - 'Cainjector improvements: `CAInjectorMerging` is GA and server-side apply + is now unconditional; new `--ignore-namespaces` flag.' + - 'Operational improvements: `runtimeClassName` support, startupapicheck TTL + cleanup, and better observability for Venafi/CyberArk OAuth auth failures.' + breaking_changes: + - Helm chart no longer creates default RBAC allowing the controller ServiceAccount + to `create` `serviceaccounts/token`; workloads relying on that undocumented + pattern must add RBAC or switch to a dedicated ServiceAccount. + - '`cert-manager-edit` aggregate ClusterRole no longer grants create/update + permissions for ACME Challenge/Order resources; any tooling that manipulates + these resources directly needs explicit RBAC.' + - Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, + and `prometheus.podmonitor.path` were removed and will cause schema validation + failure if still present; controller metrics port name is now `http-metrics`. chart_version: 1.21.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.21.0', 'quay.io/jetstack/cert-manager-controller:v1.21.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.21.0', 'quay.io/jetstack/cert-manager-webhook:v1.21.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.21.0 + - quay.io/jetstack/cert-manager-controller:v1.21.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.21.0 + - quay.io/jetstack/cert-manager-webhook:v1.21.0 - version: 1.20.0 - kube: ['1.35', '1.34', '1.33', '1.32'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -11677,35 +13659,48 @@ addons: by the chart, note the **metrics label is now consistently `cert-manager`** (previously it could vary by namespace/release name). Update any label-selectors in Prometheus/alerts accordingly. *(#8162)*' - chart_updates: [NetworkPolicy configurability improvements and example policy - cleanup (#8370)., '`startupapicheck-job` template now supports `imagePullSecrets` - (#8186).', Helm chart adds `extraContainers` support for controller/operator - pod sidecars (#8355)., Helm chart `global.nodeSelector` now merges with - per-component nodeSelectors (#8195)., Helm chart NOTES.TXT includes Gateway - API documentation (#8353)., PodDisruptionBudget template supports `unhealthyPodEvictionPolicy` - (#7728).] - features: [Alpha/experimental support for the new ListenerSet resource (feature - gate renamed from `XListenerSets` to `ListenerSets`)., 'DNS-01: support - for Azure Private DNS zones.', 'Gateway API + ACME: `parentRefs` are no - longer required in some flows; you can also override parentRefs via Certificate - annotations.', OtherNames feature promoted to Beta and enabled by default., - 'Operational flexibility improvements: configurable PEM decoding size limits, - plus the ability to run sidecars (via Helm) and set imagePullSecrets for - startup checks.'] - breaking_changes: ['Container security context defaults changed: default UID/GID - are now **65532/65532** (was 1000/0). This can break clusters with strict - PSP/OPA/Kyverno policies, custom volume permissions, or sidecars expecting - the old IDs.', 'Feature gate `DefaultPrivateKeyRotationPolicyAlways` is - now **GA and cannot be disabled**. If you previously relied on disabling - it, you must remove that configuration and validate resulting key rotation - behavior.', 'IssuerRef API defaults introduced in 1.19 were reverted; if - you were depending on implicit `group/kind` defaults, ensure your manifests - explicitly set the intended issuerRef fields to avoid unexpected behavior.'] + chart_updates: + - NetworkPolicy configurability improvements and example policy cleanup (#8370). + - '`startupapicheck-job` template now supports `imagePullSecrets` (#8186).' + - Helm chart adds `extraContainers` support for controller/operator pod sidecars + (#8355). + - Helm chart `global.nodeSelector` now merges with per-component nodeSelectors + (#8195). + - Helm chart NOTES.TXT includes Gateway API documentation (#8353). + - PodDisruptionBudget template supports `unhealthyPodEvictionPolicy` (#7728). + features: + - Alpha/experimental support for the new ListenerSet resource (feature gate + renamed from `XListenerSets` to `ListenerSets`). + - 'DNS-01: support for Azure Private DNS zones.' + - 'Gateway API + ACME: `parentRefs` are no longer required in some flows; you + can also override parentRefs via Certificate annotations.' + - OtherNames feature promoted to Beta and enabled by default. + - 'Operational flexibility improvements: configurable PEM decoding size limits, + plus the ability to run sidecars (via Helm) and set imagePullSecrets for startup + checks.' + breaking_changes: + - 'Container security context defaults changed: default UID/GID are now **65532/65532** + (was 1000/0). This can break clusters with strict PSP/OPA/Kyverno policies, + custom volume permissions, or sidecars expecting the old IDs.' + - Feature gate `DefaultPrivateKeyRotationPolicyAlways` is now **GA and cannot + be disabled**. If you previously relied on disabling it, you must remove that + configuration and validate resulting key rotation behavior. + - IssuerRef API defaults introduced in 1.19 were reverted; if you were depending + on implicit `group/kind` defaults, ensure your manifests explicitly set the + intended issuerRef fields to avoid unexpected behavior. chart_version: 1.20.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.20.0', 'quay.io/jetstack/cert-manager-controller:v1.20.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.20.0', 'quay.io/jetstack/cert-manager-webhook:v1.20.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.20.0 + - quay.io/jetstack/cert-manager-controller:v1.20.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.20.0 + - quay.io/jetstack/cert-manager-webhook:v1.20.0 - version: 1.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -11723,44 +13718,60 @@ addons: \ in diff.\n\n- **Helm chart quoting change (1.18.0):** nodeSelector values\ \ are quoted.\n - Mostly transparent, but can affect strict YAML/value types\ \ if you relied on non-string types.\n" - chart_updates: [Default NetworkPolicy now includes IPv6 rules (1.19.0)., Pods - now support an experimental `hostUsers` field (not enabled by default) (1.19.0)., - Services/ServiceMonitors switched to using **named ports** instead of numeric - ports (1.18.0)., 'Ingress-shim: new `--extra-certificate-annotations` option - to copy selected annotations from Ingress-like resources to resulting Certificates - (1.18.0).', 'Metrics changes: certificate metrics moved to a collector approach - (1.19.0); new `certmanager_certificate_challenge_status` metric (1.19.0); - new notBefore/notAfter timestamp metrics (1.18.0).', 'ACME HTTP-01: added - feature gate to default solver Ingress `pathType` to `Exact` (1.19.0); also - earlier change set pathType to `Exact` for reliability/security (1.18.0).'] - features: [Global `nodeSelector` Helm value to pin cert-manager components to - specific nodes (deployment flexibility)., Configurable resource requests/limits - for ACME HTTP-01 solver pods via Issuer/ClusterIssuer (overrides global - `--acme-http01-solver-resource-*`)., CAInjectorMerging promoted to **BETA** - and enabled by default (more robust CA bundle injection behavior)., 'Improved - observability: version + git commit logged on startup; new certificate challenge - status metric; additional certificate issuance/expiry timestamp metrics.', - 'Platform/compatibility improvements: default NetworkPolicy adds IPv6 rules; - increased ACME authorization timeout to reduce flakiness.'] - breaking_changes: ["**Potential incident risk / known issue:** v1.19.0 has a\ - \ known issue causing **unexpected certificate renewal** after upgrade;\ - \ it\u2019s fixed in **v1.19.1**. Strongly prefer upgrading to 1.19.1+ if\ - \ possible.", "Monitoring breaking change: **removed the `path` label**\ - \ from core ACME client metrics\u2014dashboards/alerts that filter/group\ - \ by `path` must be updated.", "Behavioral breaking changes introduced in\ - \ 1.18 (still relevant if you\u2019re coming from 1.18.0): default `Certificate.spec.privateKey.rotationPolicy`\ - \ changed to **`Always`** (can trigger key rotation on renewals), and default\ - \ `Certificate.spec.revisionHistoryLimit` set to **1** (fewer historical\ - \ CertificateRequest revisions retained).", "Access-control/values breaking\ - \ change: `global.rbac.disableHTTPChallengesRole` was **reverted** in 1.19.0\u2014\ - config relying on it must be removed and you may need an alternative approach\ - \ if you were using it to reduce privileges."] + chart_updates: + - Default NetworkPolicy now includes IPv6 rules (1.19.0). + - Pods now support an experimental `hostUsers` field (not enabled by default) + (1.19.0). + - Services/ServiceMonitors switched to using **named ports** instead of numeric + ports (1.18.0). + - 'Ingress-shim: new `--extra-certificate-annotations` option to copy selected + annotations from Ingress-like resources to resulting Certificates (1.18.0).' + - 'Metrics changes: certificate metrics moved to a collector approach (1.19.0); + new `certmanager_certificate_challenge_status` metric (1.19.0); new notBefore/notAfter + timestamp metrics (1.18.0).' + - 'ACME HTTP-01: added feature gate to default solver Ingress `pathType` to + `Exact` (1.19.0); also earlier change set pathType to `Exact` for reliability/security + (1.18.0).' + features: + - Global `nodeSelector` Helm value to pin cert-manager components to specific + nodes (deployment flexibility). + - Configurable resource requests/limits for ACME HTTP-01 solver pods via Issuer/ClusterIssuer + (overrides global `--acme-http01-solver-resource-*`). + - CAInjectorMerging promoted to **BETA** and enabled by default (more robust + CA bundle injection behavior). + - 'Improved observability: version + git commit logged on startup; new certificate + challenge status metric; additional certificate issuance/expiry timestamp + metrics.' + - 'Platform/compatibility improvements: default NetworkPolicy adds IPv6 rules; + increased ACME authorization timeout to reduce flakiness.' + breaking_changes: + - "**Potential incident risk / known issue:** v1.19.0 has a known issue causing\ + \ **unexpected certificate renewal** after upgrade; it\u2019s fixed in **v1.19.1**.\ + \ Strongly prefer upgrading to 1.19.1+ if possible." + - "Monitoring breaking change: **removed the `path` label** from core ACME client\ + \ metrics\u2014dashboards/alerts that filter/group by `path` must be updated." + - "Behavioral breaking changes introduced in 1.18 (still relevant if you\u2019\ + re coming from 1.18.0): default `Certificate.spec.privateKey.rotationPolicy`\ + \ changed to **`Always`** (can trigger key rotation on renewals), and default\ + \ `Certificate.spec.revisionHistoryLimit` set to **1** (fewer historical CertificateRequest\ + \ revisions retained)." + - "Access-control/values breaking change: `global.rbac.disableHTTPChallengesRole`\ + \ was **reverted** in 1.19.0\u2014config relying on it must be removed and\ + \ you may need an alternative approach if you were using it to reduce privileges." chart_version: 1.19.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.19.0', 'quay.io/jetstack/cert-manager-controller:v1.19.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.19.0', 'quay.io/jetstack/cert-manager-webhook:v1.19.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.19.0 + - quay.io/jetstack/cert-manager-controller:v1.19.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.19.0 + - quay.io/jetstack/cert-manager-webhook:v1.19.0 eolAt: '2026-07-08' - version: 1.18.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -11772,43 +13783,59 @@ addons: \ `startupapicheck.extraEnv` (useful if you previously templated env vars).\n\ - **Chart templating fix:** nodeSelector values are now quoted; if you relied\ \ on unquoted numeric/bool-looking values, rendering/behavior may change slightly.\n" - chart_updates: [RBAC can now be tightened via `global.rbac.disableHTTPChallengesRole` - (drops Pod-creation permissions when HTTP-01 is disabled)., Service/ServiceMonitor - ports are now defined using **named ports** instead of numeric ports (may - affect scraping or any tooling selecting ports by number)., 'Ingress-shim - related additions: supports copying selected annotations via new flag `--extra-certificate-annotations`.', - 'Helm template fixes: nodeSelector quoting; ServiceAccount annotations handling - boolean values correctly.'] - features: ['ACME: **Support for ACME Profiles** (draft ACME profiles extension) - allowing more profile-driven issuance behavior when your ACME CA supports - it.', 'Observability: new certificate validity metrics for NotBefore/NotAfter - timestamps (`certmanager_certificate_not_before_timestamp_seconds`, `certmanager_certificate_not_after_timestamp_seconds`).', - 'Security hardening option: ability to disable HTTP-01 RBAC permissions via - Helm when not using HTTP-01 challenges.', "Vault Issuer: option to specify\ - \ the expected server name when validating Vault\u2019s presented TLS certs.", - 'Ingress-shim: can copy a configured list of annotations from Ingress-like - resources onto the generated Certificate.', 'Resource UX: new kubectl shortnames - `iss` (Issuer) and `ciss` (ClusterIssuer).', 'Crypto: ability to customize - the certificate signature algorithm.', 'Features promoted to GA: `UseDomainQualifiedFinalizer`; - `AdditionalCertificateOutputFormats` always enabled.'] - breaking_changes: ["Default `Certificate.spec.privateKey.rotationPolicy` changes\ - \ from **`Never` \u2192 `Always`**. This can trigger private key rotation\ - \ on renewals/issuance unless you explicitly set it back.", Default `Certificate.spec.revisionHistoryLimit` - effectively becomes **1** (CertificateRequest revision history). This may - surprise users relying on multiple historical CertificateRequests for debugging/auditing., - "Ingress HTTP-01 solver Ingress `pathType` changes from **ImplementationSpecific\ - \ \u2192 Exact**, which can change matching behavior on some ingress controllers.", - "Feature gate **`ValidateCAA` removed** (setting it becomes a no-op with a\ - \ warning); if you depended on it, behavior won\u2019t be enforced by that\ - \ gate anymore.", 'Known issue: ingress-nginx validating webhook may reject - ACME HTTP-01 challenge paths (see cert-manager #7791); plan mitigations - if you use ingress-nginx + HTTP-01.'] + chart_updates: + - RBAC can now be tightened via `global.rbac.disableHTTPChallengesRole` (drops + Pod-creation permissions when HTTP-01 is disabled). + - Service/ServiceMonitor ports are now defined using **named ports** instead + of numeric ports (may affect scraping or any tooling selecting ports by number). + - 'Ingress-shim related additions: supports copying selected annotations via + new flag `--extra-certificate-annotations`.' + - 'Helm template fixes: nodeSelector quoting; ServiceAccount annotations handling + boolean values correctly.' + features: + - 'ACME: **Support for ACME Profiles** (draft ACME profiles extension) allowing + more profile-driven issuance behavior when your ACME CA supports it.' + - 'Observability: new certificate validity metrics for NotBefore/NotAfter timestamps + (`certmanager_certificate_not_before_timestamp_seconds`, `certmanager_certificate_not_after_timestamp_seconds`).' + - 'Security hardening option: ability to disable HTTP-01 RBAC permissions via + Helm when not using HTTP-01 challenges.' + - "Vault Issuer: option to specify the expected server name when validating\ + \ Vault\u2019s presented TLS certs." + - 'Ingress-shim: can copy a configured list of annotations from Ingress-like + resources onto the generated Certificate.' + - 'Resource UX: new kubectl shortnames `iss` (Issuer) and `ciss` (ClusterIssuer).' + - 'Crypto: ability to customize the certificate signature algorithm.' + - 'Features promoted to GA: `UseDomainQualifiedFinalizer`; `AdditionalCertificateOutputFormats` + always enabled.' + breaking_changes: + - "Default `Certificate.spec.privateKey.rotationPolicy` changes from **`Never`\ + \ \u2192 `Always`**. This can trigger private key rotation on renewals/issuance\ + \ unless you explicitly set it back." + - Default `Certificate.spec.revisionHistoryLimit` effectively becomes **1** + (CertificateRequest revision history). This may surprise users relying on + multiple historical CertificateRequests for debugging/auditing. + - "Ingress HTTP-01 solver Ingress `pathType` changes from **ImplementationSpecific\ + \ \u2192 Exact**, which can change matching behavior on some ingress controllers." + - "Feature gate **`ValidateCAA` removed** (setting it becomes a no-op with a\ + \ warning); if you depended on it, behavior won\u2019t be enforced by that\ + \ gate anymore." + - 'Known issue: ingress-nginx validating webhook may reject ACME HTTP-01 challenge + paths (see cert-manager #7791); plan mitigations if you use ingress-nginx + + HTTP-01.' chart_version: 1.18.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.18.0', 'quay.io/jetstack/cert-manager-controller:v1.18.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.18.0', 'quay.io/jetstack/cert-manager-webhook:v1.18.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.18.0 + - quay.io/jetstack/cert-manager-controller:v1.18.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.18.0 + - quay.io/jetstack/cert-manager-webhook:v1.18.0 eolAt: '2026-03-10' - version: 1.17.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -11827,36 +13854,53 @@ addons: \ can be added to Deployments; verify if you rely on custom SA creation.\n\ \n- **If you used `ValidateCAA` feature gate via Helm flags/env**: it is deprecated\ \ in 1.17 and will warn; plan removal before 1.18.\n" - chart_updates: [Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` - are now **enabled by default** (promoted to Beta). Expect behavior changes - without explicitly setting flags., Optional new feature gate `CAInjectorMerging` - available for ca-injector; enabling changes CA bundle rotation behavior - (merge vs replace)., Some log lines are now structured; log formats may - differ from 1.16.] - features: ["RSA signing compliance: CA and SelfSigned issuers select hash based\ - \ on RSA key size (3072\u2192SHA-384, 4096\u2192SHA-512).", 'Keystore passwords - (JKS/PKCS#12) can be set as a literal string in the `Certificate` resource, - not only via Secret reference.', Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` - are now enabled by default (Beta)., New `CAInjectorMerging` feature gate - to make CA bundle rotation safer by merging new CAs instead of replacing., - 'Helm improvements: extra env var injection for webhook/cainjector/startupapicheck - and `tpl` support for ServiceAccount annotations.', 'AzureDNS: new `tenantID` - option for managed identity with service principals; Venafi username/password - client ID customization.', 'Larger trust bundles supported: increased PEM - parsing capacity.'] - breaking_changes: ['Potentially breaking cryptography change: CA/SelfSigned - issuers now use stronger hashes for larger RSA keys (3072/4096+). Verify - downstream consumers support SHA-384/SHA-512 with your chosen RSA key sizes.', - 'Potentially breaking operational change: some previously unstructured log - messages are now structured; any tooling that greps/matches exact log strings - may break.', '`ValidateCAA` feature gate is deprecated and will be removed - in 1.18; enabling it now emits warnings (plan to stop using it).'] + chart_updates: + - Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` are now + **enabled by default** (promoted to Beta). Expect behavior changes without + explicitly setting flags. + - Optional new feature gate `CAInjectorMerging` available for ca-injector; enabling + changes CA bundle rotation behavior (merge vs replace). + - Some log lines are now structured; log formats may differ from 1.16. + features: + - "RSA signing compliance: CA and SelfSigned issuers select hash based on RSA\ + \ key size (3072\u2192SHA-384, 4096\u2192SHA-512)." + - Keystore passwords (JKS/PKCS#12) can be set as a literal string in the `Certificate` + resource, not only via Secret reference. + - Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` are now + enabled by default (Beta). + - New `CAInjectorMerging` feature gate to make CA bundle rotation safer by merging + new CAs instead of replacing. + - 'Helm improvements: extra env var injection for webhook/cainjector/startupapicheck + and `tpl` support for ServiceAccount annotations.' + - 'AzureDNS: new `tenantID` option for managed identity with service principals; + Venafi username/password client ID customization.' + - 'Larger trust bundles supported: increased PEM parsing capacity.' + breaking_changes: + - 'Potentially breaking cryptography change: CA/SelfSigned issuers now use stronger + hashes for larger RSA keys (3072/4096+). Verify downstream consumers support + SHA-384/SHA-512 with your chosen RSA key sizes.' + - 'Potentially breaking operational change: some previously unstructured log + messages are now structured; any tooling that greps/matches exact log strings + may break.' + - '`ValidateCAA` feature gate is deprecated and will be removed in 1.18; enabling + it now emits warnings (plan to stop using it).' chart_version: 1.17.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.17.0', 'quay.io/jetstack/cert-manager-controller:v1.17.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.17.0', 'quay.io/jetstack/cert-manager-webhook:v1.17.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.17.0 + - quay.io/jetstack/cert-manager-controller:v1.17.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.17.0 + - quay.io/jetstack/cert-manager-webhook:v1.17.0 eolAt: '2025-10-07' - version: 1.16.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -11877,37 +13921,55 @@ addons: \ in 1.15 but matter for upgrades**:\n - `disableAutoApproval`, `approveSignerNames`\n\ \ - `extraObjects` (install extra manifests with the release)\n - optional\ \ `hostAliases` support for cert-manager pod DNS self-check scenarios" - chart_updates: ['Helm chart adds a JSON schema for values (1.16), making `helm - install/upgrade` stricter and more likely to fail on invalid/unknown values.', - Helm chart now supports adding extra environment variables to webhook/cainjector/startupapicheck - pods via new `*.extraEnv` values (1.16)., 'Chart behavior around CRDs changed - (1.15): CRDs are no longer removed on uninstall by default; `crds.enabled`/`crds.keep` - replace `installCRDs`.', startupapicheck image repository reference changed - (1.15) to `quay.io/jetstack/cert-manager-startupapicheck`.] - features: ['More Prometheus metrics: new metrics servers for webhook and cainjector; - controller now exposes process and Go runtime metrics.', Certificate renewal - can now be expressed as `renewBeforePercentage` as an alternative to `renewBefore`., - 'Gateway API HTTP01 solver now supports a user-provided Pod template, similar - to the Ingress HTTP01 solver.', 'Route53 ACME DNS01 improvements: better - region handling (ambient/IRSA), regional STS endpoints, and improved debug - logging/user-agent tagging for AWS requests.', 'Vault and Venafi improvements: - Vault supports client certificate auth; Venafi adds SecretRef for CA bundle - and improved duration handling; TPP OAuth with username/password support.'] - breaking_changes: [Helm schema validation in 1.16 may reject existing values - files that contain unknown keys/typos; you may need to clean up `values.yaml` - before upgrading., 'Venafi Issuer behavior changes in 1.16 can break renewals - if requested durations violate Venafi policy min/max, or if using TPP username/password - auth in certain configurations.', 'Venafi TPP: API Key authentication (deprecated/removed - in recent TPP versions) is no longer used; environments relying on it must - migrate to supported auth methods.', Old cert-manager API versions were - removed from the codebase (v1alpha2/v1alpha3/v1beta1 for acme.cert-manager.io - and cert-manager.io); ensure no manifests/CRs still use those versions.] + chart_updates: + - Helm chart adds a JSON schema for values (1.16), making `helm install/upgrade` + stricter and more likely to fail on invalid/unknown values. + - Helm chart now supports adding extra environment variables to webhook/cainjector/startupapicheck + pods via new `*.extraEnv` values (1.16). + - 'Chart behavior around CRDs changed (1.15): CRDs are no longer removed on + uninstall by default; `crds.enabled`/`crds.keep` replace `installCRDs`.' + - startupapicheck image repository reference changed (1.15) to `quay.io/jetstack/cert-manager-startupapicheck`. + features: + - 'More Prometheus metrics: new metrics servers for webhook and cainjector; + controller now exposes process and Go runtime metrics.' + - Certificate renewal can now be expressed as `renewBeforePercentage` as an + alternative to `renewBefore`. + - Gateway API HTTP01 solver now supports a user-provided Pod template, similar + to the Ingress HTTP01 solver. + - 'Route53 ACME DNS01 improvements: better region handling (ambient/IRSA), regional + STS endpoints, and improved debug logging/user-agent tagging for AWS requests.' + - 'Vault and Venafi improvements: Vault supports client certificate auth; Venafi + adds SecretRef for CA bundle and improved duration handling; TPP OAuth with + username/password support.' + breaking_changes: + - Helm schema validation in 1.16 may reject existing values files that contain + unknown keys/typos; you may need to clean up `values.yaml` before upgrading. + - Venafi Issuer behavior changes in 1.16 can break renewals if requested durations + violate Venafi policy min/max, or if using TPP username/password auth in certain + configurations. + - 'Venafi TPP: API Key authentication (deprecated/removed in recent TPP versions) + is no longer used; environments relying on it must migrate to supported auth + methods.' + - Old cert-manager API versions were removed from the codebase (v1alpha2/v1alpha3/v1beta1 + for acme.cert-manager.io and cert-manager.io); ensure no manifests/CRs still + use those versions. chart_version: 1.16.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.16.0', 'quay.io/jetstack/cert-manager-controller:v1.16.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.16.0', 'quay.io/jetstack/cert-manager-webhook:v1.16.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.16.0 + - quay.io/jetstack/cert-manager-controller:v1.16.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.16.0 + - quay.io/jetstack/cert-manager-webhook:v1.16.0 eolAt: '2025-06-10' - version: 1.15.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -11925,41 +13987,57 @@ addons: \ for the cert-manager Pod (to help DNS01 self-check in custom DNS scenarios).\n\ \ - New chart options: `disableAutoApproval` and `approveSignerNames` (controls\ \ auto-approval behavior for CertificateRequests / signers).\n" - chart_updates: [CRDs are now retained by default on Helm uninstall to prevent - accidental data loss; introduced `crds.keep`/`crds.enabled` to manage this - behavior., Helm chart adds `extraObjects` to let you ship additional manifests - with the release., Helm chart supports optional `hostAliases` on the cert-manager - Pod., 'Fixed/adjusted Helm behaviors noted in release notes: logic distinguishing - `0` vs empty values; restored default Prometheus Service resource behavior; - corrected cainjector image value; ensured cainjector ConfigMap mounts correctly.', - Added Helm options `disableAutoApproval` and `approveSignerNames`., 'Operational - note: `cmctl` and `kubectl cert-manager` moved to the separate `cert-manager/cmctl` - repo and are versioned independently (affects where you fetch the binary, - not the Helm chart directly).'] - features: [Gateway API integration is now Beta; enable it with `--enable-gateway-api` - (was previously experimental)., '`LiteralCertificateSubject` and `AdditionalCertificateOutputFormats` - feature gates are now Beta; additional output formats are enabled by default.', - 'Helm can now install extra Kubernetes objects via `extraObjects`, and can - set `hostAliases` to help DNS self-checks in custom environments.', 'Vault - integration enhancements: mTLS support when Vault requires strict client - certs, plus ability to configure additional Kubernetes auth audiences.', - AWS Route53 provider supports AssumeRoleWithWebIdentity for credential retrieval; - JKS keystore can now set a custom key alias.] - breaking_changes: ['**CRD lifecycle change on uninstall**: Helm uninstall will - no longer remove cert-manager CRDs by default; adjust your uninstall/runbook - (set `crds.keep=false` only if you explicitly want CRDs deleted).', '**ACME - `preferredChain` behavior fix**: if you relied on the previously unintended - chain selection when `preferredChain` is set, certificate chain selection - may change after upgrading (now uses the intended chain).', 'Tooling packaging - change: `cmctl` moved to a separate repository and is versioned independently; - update any automation that downloads `cmctl` from the main cert-manager - release assets.'] + chart_updates: + - CRDs are now retained by default on Helm uninstall to prevent accidental data + loss; introduced `crds.keep`/`crds.enabled` to manage this behavior. + - Helm chart adds `extraObjects` to let you ship additional manifests with the + release. + - Helm chart supports optional `hostAliases` on the cert-manager Pod. + - 'Fixed/adjusted Helm behaviors noted in release notes: logic distinguishing + `0` vs empty values; restored default Prometheus Service resource behavior; + corrected cainjector image value; ensured cainjector ConfigMap mounts correctly.' + - Added Helm options `disableAutoApproval` and `approveSignerNames`. + - 'Operational note: `cmctl` and `kubectl cert-manager` moved to the separate + `cert-manager/cmctl` repo and are versioned independently (affects where you + fetch the binary, not the Helm chart directly).' + features: + - Gateway API integration is now Beta; enable it with `--enable-gateway-api` + (was previously experimental). + - '`LiteralCertificateSubject` and `AdditionalCertificateOutputFormats` feature + gates are now Beta; additional output formats are enabled by default.' + - Helm can now install extra Kubernetes objects via `extraObjects`, and can + set `hostAliases` to help DNS self-checks in custom environments. + - 'Vault integration enhancements: mTLS support when Vault requires strict client + certs, plus ability to configure additional Kubernetes auth audiences.' + - AWS Route53 provider supports AssumeRoleWithWebIdentity for credential retrieval; + JKS keystore can now set a custom key alias. + breaking_changes: + - '**CRD lifecycle change on uninstall**: Helm uninstall will no longer remove + cert-manager CRDs by default; adjust your uninstall/runbook (set `crds.keep=false` + only if you explicitly want CRDs deleted).' + - '**ACME `preferredChain` behavior fix**: if you relied on the previously unintended + chain selection when `preferredChain` is set, certificate chain selection + may change after upgrading (now uses the intended chain).' + - 'Tooling packaging change: `cmctl` moved to a separate repository and is versioned + independently; update any automation that downloads `cmctl` from the main + cert-manager release assets.' chart_version: 1.15.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.15.0', 'quay.io/jetstack/cert-manager-controller:v1.15.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.15.0', 'quay.io/jetstack/cert-manager-webhook:v1.15.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.15.0 + - quay.io/jetstack/cert-manager-controller:v1.15.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.15.0 + - quay.io/jetstack/cert-manager-webhook:v1.15.0 eolAt: '2025-02-03' - version: 1.14.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -11981,39 +14059,56 @@ addons: \ chart was manually corrected during release due to a wrong `cainjector`\ \ image reference; upstream recommends installing **>= 1.14.2** instead of\ \ 1.14.0/1.14.1." - chart_updates: ['Security hardening defaults: pods now run with `readOnlyRootFilesystem: - true` by default (including the ACME HTTP01 solver pod).', Controller liveness - probe enabled by default; additional clock-skew detector liveness probe - added., Webhook timeout default increased to 30s (max) to improve error - visibility., Webhook can be restricted via custom `spec.namespaceSelector` - support., Metrics endpoint can now be served over TLS (static cert files - or dynamically issued certs)., 'ACME HTTP01 solver pods gain a default `cluster-autoscaler.kubernetes.io/safe-to-evict: - "true"` annotation (overridable in podTemplate).'] - features: ['X.509: Certificate spec can now include certain `otherName` SANs - (alpha; requires enabling `OtherName` feature gate on controller and webhook).', - 'CA Issuer: support for Name Constraints in CA certs and Authority Information - Accessors (AIA) URLs for issued certificates.', 'Security: more secure HTTP - server defaults (DoS mitigations), optional HTTPS metrics, and read-only - root filesystem by default for pods.', 'Operational: controller liveness - probe enabled by default plus clock-skew restart detection; configurable - dynamic serving leaf certificate duration.', 'PKCS#12: new `.spec.keystores.pkcs12.algorithms` - to control encryption/MAC algorithms.'] - breaking_changes: ['If you set Helm `.Values.featureGates`, those gates no longer - get passed to the webhook (controller only). Use `.Values.webhook.featureGates` - for webhook gates.', '`startupapicheck` job now uses a new `startupapicheck` - image instead of `ctl`; environments that mirror/preload images must include - it.', 'Potential compatibility change: KeyUsage and BasicConstraints are - now encoded as **critical** in the CSR blob inside CertificateRequests; - any downstream tooling expecting non-critical encoding may be affected.', - 'Webhook validation is stricter (from 1.13): CertificateRequest KeyUsages/ExtendedKeyUsages - must be explicitly declared on the resource and must not be exceeded by - the CSR contents.'] + chart_updates: + - 'Security hardening defaults: pods now run with `readOnlyRootFilesystem: true` + by default (including the ACME HTTP01 solver pod).' + - Controller liveness probe enabled by default; additional clock-skew detector + liveness probe added. + - Webhook timeout default increased to 30s (max) to improve error visibility. + - Webhook can be restricted via custom `spec.namespaceSelector` support. + - Metrics endpoint can now be served over TLS (static cert files or dynamically + issued certs). + - 'ACME HTTP01 solver pods gain a default `cluster-autoscaler.kubernetes.io/safe-to-evict: + "true"` annotation (overridable in podTemplate).' + features: + - 'X.509: Certificate spec can now include certain `otherName` SANs (alpha; + requires enabling `OtherName` feature gate on controller and webhook).' + - 'CA Issuer: support for Name Constraints in CA certs and Authority Information + Accessors (AIA) URLs for issued certificates.' + - 'Security: more secure HTTP server defaults (DoS mitigations), optional HTTPS + metrics, and read-only root filesystem by default for pods.' + - 'Operational: controller liveness probe enabled by default plus clock-skew + restart detection; configurable dynamic serving leaf certificate duration.' + - 'PKCS#12: new `.spec.keystores.pkcs12.algorithms` to control encryption/MAC + algorithms.' + breaking_changes: + - If you set Helm `.Values.featureGates`, those gates no longer get passed to + the webhook (controller only). Use `.Values.webhook.featureGates` for webhook + gates. + - '`startupapicheck` job now uses a new `startupapicheck` image instead of `ctl`; + environments that mirror/preload images must include it.' + - 'Potential compatibility change: KeyUsage and BasicConstraints are now encoded + as **critical** in the CSR blob inside CertificateRequests; any downstream + tooling expecting non-critical encoding may be affected.' + - 'Webhook validation is stricter (from 1.13): CertificateRequest KeyUsages/ExtendedKeyUsages + must be explicitly declared on the resource and must not be exceeded by the + CSR contents.' chart_version: 1.14.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.14.0', 'quay.io/jetstack/cert-manager-controller:v1.14.0', - 'quay.io/jetstack/cert-manager-startupapicheck:v1.14.0', 'quay.io/jetstack/cert-manager-webhook:v1.14.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.14.0 + - quay.io/jetstack/cert-manager-controller:v1.14.0 + - quay.io/jetstack/cert-manager-startupapicheck:v1.14.0 + - quay.io/jetstack/cert-manager-webhook:v1.14.0 eolAt: '2024-10-03' - version: 1.13.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -12032,43 +14127,62 @@ addons: \ If coming from **< v1.12**, upgrade to the **latest v1.12 patch** first\ \ before moving to v1.13, to avoid unexpected certificate re-issuance (release\ \ note #6494 comment)." - chart_updates: ['Webhook helm template behavior changed so controller feature - gates are no longer inadvertently applied to the webhook (fix in #6093).', - 'NetworkPolicy templating fix: corrected indentation for webhook `matchLabels` - (#6220).', 'Adds configurability / defaults around `enableServiceLinks` - for deployments and `startupapicheck` job (#6292, plus follow-up changes - disabling service links more broadly).', Adds ServiceMonitor endpoint extension - point via `prometheus.servicemonitor.endpointAdditionalProperties` (#6110)., - Adds Apache 2.0 license annotation in chart metadata (#6225).] - features: ["DNS-over-HTTPS (DoH) support for ACME DNS-01 self-checks (use `--dns01-recursive-nameservers-only=true`\ - \ with an `https://\u2026/dns-query` endpoint).", Controller options can - now be provided via a versioned configuration file (useful for managing - controller settings declaratively)., 'Feature gates **StableCertificateRequestName** - and **SecretsFilteredCaching** promoted to **Beta** and enabled by default - (note known issue for StableCertificateRequestName in 1.13.0, fixed in 1.13.1+).', - CertificateRequest / CSR validation tightened when using pki CertificateTemplate - functions to ensure signed certs match requested usages and CA-ness., 'Helm: - can add extra properties to Prometheus ServiceMonitor endpoints; `enableServiceLinks` - can be configured across deployments; logging options can be set via webhook - config file.'] - breaking_changes: ["**Helm breaking change:** `.featureGates` no longer applies\ - \ to the webhook; use `webhook.featureGates` instead. If you relied on controller\ - \ gates being passed through to the webhook\u2019s `--feature-gates`, that\ - \ will now fail unless the webhook actually supports those gates.", '**Potentially - breaking:** webhook validation of CertificateRequest is stricter: all `keyUsages`/`extendedKeyUsages` - must be explicitly declared on the CertificateRequest, and the CSR must - not contain additional usages beyond those declared.', '**Known issue in - 1.13.0:** StableCertificateRequestName (now Beta, enabled by default) has - a name-collision bug; upgrade to **v1.13.1+** to avoid it.', 'Upgrade path - warning: if upgrading from <1.12, you must first upgrade to latest 1.12 - patch before 1.13 or some certs may be unexpectedly re-issued.'] + chart_updates: + - 'Webhook helm template behavior changed so controller feature gates are no + longer inadvertently applied to the webhook (fix in #6093).' + - 'NetworkPolicy templating fix: corrected indentation for webhook `matchLabels` + (#6220).' + - Adds configurability / defaults around `enableServiceLinks` for deployments + and `startupapicheck` job (#6292, plus follow-up changes disabling service + links more broadly). + - Adds ServiceMonitor endpoint extension point via `prometheus.servicemonitor.endpointAdditionalProperties` + (#6110). + - Adds Apache 2.0 license annotation in chart metadata (#6225). + features: + - "DNS-over-HTTPS (DoH) support for ACME DNS-01 self-checks (use `--dns01-recursive-nameservers-only=true`\ + \ with an `https://\u2026/dns-query` endpoint)." + - Controller options can now be provided via a versioned configuration file + (useful for managing controller settings declaratively). + - Feature gates **StableCertificateRequestName** and **SecretsFilteredCaching** + promoted to **Beta** and enabled by default (note known issue for StableCertificateRequestName + in 1.13.0, fixed in 1.13.1+). + - CertificateRequest / CSR validation tightened when using pki CertificateTemplate + functions to ensure signed certs match requested usages and CA-ness. + - 'Helm: can add extra properties to Prometheus ServiceMonitor endpoints; `enableServiceLinks` + can be configured across deployments; logging options can be set via webhook + config file.' + breaking_changes: + - "**Helm breaking change:** `.featureGates` no longer applies to the webhook;\ + \ use `webhook.featureGates` instead. If you relied on controller gates being\ + \ passed through to the webhook\u2019s `--feature-gates`, that will now fail\ + \ unless the webhook actually supports those gates." + - '**Potentially breaking:** webhook validation of CertificateRequest is stricter: + all `keyUsages`/`extendedKeyUsages` must be explicitly declared on the CertificateRequest, + and the CSR must not contain additional usages beyond those declared.' + - '**Known issue in 1.13.0:** StableCertificateRequestName (now Beta, enabled + by default) has a name-collision bug; upgrade to **v1.13.1+** to avoid it.' + - 'Upgrade path warning: if upgrading from <1.12, you must first upgrade to + latest 1.12 patch before 1.13 or some certs may be unexpectedly re-issued.' chart_version: 1.13.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.13.0', 'quay.io/jetstack/cert-manager-controller:v1.13.0', - 'quay.io/jetstack/cert-manager-ctl:v1.13.0', 'quay.io/jetstack/cert-manager-webhook:v1.13.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.13.0 + - quay.io/jetstack/cert-manager-controller:v1.13.0 + - quay.io/jetstack/cert-manager-ctl:v1.13.0 + - quay.io/jetstack/cert-manager-webhook:v1.13.0 eolAt: '2024-06-05' - version: 1.12.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: @@ -12091,39 +14205,56 @@ addons: - ACME HTTP-01 solver can now be configured with `ingressClassName`; if you\ \ previously relied on the deprecated ingress.class annotation behavior, consider\ \ moving to the field.\n" - chart_updates: [Added optional PodDisruptionBudgets for cert-manager components - (off by default)., Webhook NetworkPolicy updated to permit egress to Kubernetes - API on 6443/TCP (OpenShift/OKD compatibility)., Helm chart now supports - adding extra volumes and volumeMounts to cainjector/webhook/startupapicheck - pods via values., Helm chart exposes additional controller flags for DNS01 - recursion and certificate owner refs., Chart behavior updated so `--acme-http01-solver-image` - in `acmesolver.extraArgs` overrides `acmesolver.image`., 'Chart documentation: - fixed dead links in values.yaml.'] - features: [JSON logging is now supported via `--logging-format=json` (handy - for log aggregation/parsing)., New `--concurrent-workers` flag lets you - tune controller concurrency per controller., 'HTTP-01 solver can now set - `ingressClassName` on created Ingresses, improving compatibility with clusters - that require it.', Vault issuer supports ephemeral Kubernetes service account - tokens via `serviceAccountRef` (short-lived auth to Vault)., Significant - memory footprint reductions (controller and cainjector) through filtered/metadata-only - caching and other optimizations., cainjector now has flags to disable unneeded - injectable kinds to reduce memory usage.] - breaking_changes: ['Gateway API integration (introduced in 1.11) moved to a - more stable API; if you use the experimental Gateway API support, ensure - the required Gateway API version is installed (1.11 notes).', 'cainjector - behavior change: if the `certificates.cert-manager.io` CRD is not installed - and you relied on cainjector running anyway, you now must pass `--watch-certificates=false` - or cainjector will not start.', 'ACME Challenge naming calculation changed; - to avoid duplicate issuances, ensure there is **no in-progress ACME issuance** - during the upgrade.', 'POTENTIALLY BREAKING for Go consumers only: cert-manager - binaries/tests were split into separate Go modules; code changes may be - required if you import these modules.'] + chart_updates: + - Added optional PodDisruptionBudgets for cert-manager components (off by default). + - Webhook NetworkPolicy updated to permit egress to Kubernetes API on 6443/TCP + (OpenShift/OKD compatibility). + - Helm chart now supports adding extra volumes and volumeMounts to cainjector/webhook/startupapicheck + pods via values. + - Helm chart exposes additional controller flags for DNS01 recursion and certificate + owner refs. + - Chart behavior updated so `--acme-http01-solver-image` in `acmesolver.extraArgs` + overrides `acmesolver.image`. + - 'Chart documentation: fixed dead links in values.yaml.' + features: + - JSON logging is now supported via `--logging-format=json` (handy for log aggregation/parsing). + - New `--concurrent-workers` flag lets you tune controller concurrency per controller. + - HTTP-01 solver can now set `ingressClassName` on created Ingresses, improving + compatibility with clusters that require it. + - Vault issuer supports ephemeral Kubernetes service account tokens via `serviceAccountRef` + (short-lived auth to Vault). + - Significant memory footprint reductions (controller and cainjector) through + filtered/metadata-only caching and other optimizations. + - cainjector now has flags to disable unneeded injectable kinds to reduce memory + usage. + breaking_changes: + - Gateway API integration (introduced in 1.11) moved to a more stable API; if + you use the experimental Gateway API support, ensure the required Gateway + API version is installed (1.11 notes). + - 'cainjector behavior change: if the `certificates.cert-manager.io` CRD is + not installed and you relied on cainjector running anyway, you now must pass + `--watch-certificates=false` or cainjector will not start.' + - ACME Challenge naming calculation changed; to avoid duplicate issuances, ensure + there is **no in-progress ACME issuance** during the upgrade. + - 'POTENTIALLY BREAKING for Go consumers only: cert-manager binaries/tests were + split into separate Go modules; code changes may be required if you import + these modules.' chart_version: 1.12.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.12.0', 'quay.io/jetstack/cert-manager-controller:v1.12.0', - 'quay.io/jetstack/cert-manager-ctl:v1.12.0', 'quay.io/jetstack/cert-manager-webhook:v1.12.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.12.0 + - quay.io/jetstack/cert-manager-controller:v1.12.0 + - quay.io/jetstack/cert-manager-ctl:v1.12.0 + - quay.io/jetstack/cert-manager-webhook:v1.12.0 eolAt: '2025-05-19' - version: 1.11.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -12149,33 +14280,47 @@ addons: to watch only the cert-manager namespace. ' - chart_updates: ['Reduced runtime memory usage (notably: controller secret caching - fixed; cainjector namespace scoping works).', Gateway API integration moved - to **v1beta1** for the experimental feature; requires Gateway API v1beta1 - CRDs installed if you use it., Security and dependency updates (Go minor - bumps; `golang/x/net` and `x/text` vulns fixed)., Improved AzureDNS integration - (Workload Identity support + a fix for misconfigured WI setups)., 'Venafi - issuer improvements: vcert bumped; renewal and Ed25519 issues fixed; TLS - renegotiation support for certain TPP setups.', Certificate secrets will - refresh when keystore format changes; secrets get an additional label for - troubleshooting/ownership.] - features: [Significant reduction in runtime memory usage (fixing duplicate Secret - caching and enabling cainjector namespace scoping)., Helm chart can now - configure the ACME HTTP-01 solver image and expose `--max-concurrent-challenges` - for tuning challenge throughput., 'AzureDNS solver gains Workload Identity - support, improving AKS/Azure integrations.', Issuers can specify a custom - CA bundle when connecting to an ACME server., Experimental Gateway API integration - now targets the more stable v1beta1 API.] - breaking_changes: ["**Gateway API breaking change (experimental):** cert-manager\u2019\ - s `ExperimentalGatewayAPISupport` now uses **Gateway API v1beta1**. Clusters\ - \ must have v1beta1 Gateway API CRDs installed; v1alpha2-only installs will\ - \ break."] + chart_updates: + - 'Reduced runtime memory usage (notably: controller secret caching fixed; cainjector + namespace scoping works).' + - Gateway API integration moved to **v1beta1** for the experimental feature; + requires Gateway API v1beta1 CRDs installed if you use it. + - Security and dependency updates (Go minor bumps; `golang/x/net` and `x/text` + vulns fixed). + - Improved AzureDNS integration (Workload Identity support + a fix for misconfigured + WI setups). + - 'Venafi issuer improvements: vcert bumped; renewal and Ed25519 issues fixed; + TLS renegotiation support for certain TPP setups.' + - Certificate secrets will refresh when keystore format changes; secrets get + an additional label for troubleshooting/ownership. + features: + - Significant reduction in runtime memory usage (fixing duplicate Secret caching + and enabling cainjector namespace scoping). + - Helm chart can now configure the ACME HTTP-01 solver image and expose `--max-concurrent-challenges` + for tuning challenge throughput. + - AzureDNS solver gains Workload Identity support, improving AKS/Azure integrations. + - Issuers can specify a custom CA bundle when connecting to an ACME server. + - Experimental Gateway API integration now targets the more stable v1beta1 API. + breaking_changes: + - "**Gateway API breaking change (experimental):** cert-manager\u2019s `ExperimentalGatewayAPISupport`\ + \ now uses **Gateway API v1beta1**. Clusters must have v1beta1 Gateway API\ + \ CRDs installed; v1alpha2-only installs will break." chart_version: 1.11.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.11.0', 'quay.io/jetstack/cert-manager-controller:v1.11.0', - 'quay.io/jetstack/cert-manager-ctl:v1.11.0', 'quay.io/jetstack/cert-manager-webhook:v1.11.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.11.0 + - quay.io/jetstack/cert-manager-controller:v1.11.0 + - quay.io/jetstack/cert-manager-ctl:v1.11.0 + - quay.io/jetstack/cert-manager-webhook:v1.11.0 eolAt: '2023-09-12' - version: 1.10.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: @@ -12195,35 +14340,49 @@ addons: \ you previously relied on older behavior, validate resources render into\ \ the intended namespace.\n\n*(From 1.9: note that `securityContext.enabled`\ \ was removed earlier; ensure you are not still setting it in values.)*" - chart_updates: [Add NetworkPolicy support in the Helm chart., Add `commonLabels` - to apply consistent labels across chart resources., Add support for ServiceMonitor - annotations in the chart., Avoid hard-coding release namespace in chart - templates., 'Rename containers in Pods to unique, role-reflecting names - (breaking for scripts/CI).', Set Pod seccomp profile to `RuntimeDefault` - to improve PSS/restricted compliance (may require OpenShift SCC changes).] - features: ['Certificate metrics now include `issuer_name`, `issuer_kind`, and - `issuer_group` labels for better attribution in monitoring.', Vault Issuer - supports `caBundleSecretRef` (mutually exclusive with inline `caBundle`) - to source CA bundle from a Secret., Gateway API dependency bumped to v0.5.0 - (relevant if you use Gateway-related integrations)., New (disabled-by-default) - feature gate `StableCertificateRequestName` to generate deterministic CertificateRequest - names and reduce "multiple CertificateRequests found" errors., 'Improved - SelfSigned issuance behavior: CertificateRequests/CSRs will re-reconcile - when referenced private key Secrets appear or become valid.', 'Chart-level - quality-of-life: ability to set global `commonLabels`, plus optional NetworkPolicy - resources.'] - breaking_changes: ['**Container name changes in cert-manager Pods** (Helm/static - manifests): update any automation/monitoring that references container names - (e.g., `kubectl logs -c cert-manager ...`, Prometheus scrape relabeling, - log collection configs).', '**OpenShift SCC compatibility risk**: new `seccompProfile: - RuntimeDefault` may cause Pods to be rejected until SCCs are adjusted/approved - for the service accounts.'] + chart_updates: + - Add NetworkPolicy support in the Helm chart. + - Add `commonLabels` to apply consistent labels across chart resources. + - Add support for ServiceMonitor annotations in the chart. + - Avoid hard-coding release namespace in chart templates. + - Rename containers in Pods to unique, role-reflecting names (breaking for scripts/CI). + - Set Pod seccomp profile to `RuntimeDefault` to improve PSS/restricted compliance + (may require OpenShift SCC changes). + features: + - Certificate metrics now include `issuer_name`, `issuer_kind`, and `issuer_group` + labels for better attribution in monitoring. + - Vault Issuer supports `caBundleSecretRef` (mutually exclusive with inline + `caBundle`) to source CA bundle from a Secret. + - Gateway API dependency bumped to v0.5.0 (relevant if you use Gateway-related + integrations). + - New (disabled-by-default) feature gate `StableCertificateRequestName` to generate + deterministic CertificateRequest names and reduce "multiple CertificateRequests + found" errors. + - 'Improved SelfSigned issuance behavior: CertificateRequests/CSRs will re-reconcile + when referenced private key Secrets appear or become valid.' + - 'Chart-level quality-of-life: ability to set global `commonLabels`, plus optional + NetworkPolicy resources.' + breaking_changes: + - '**Container name changes in cert-manager Pods** (Helm/static manifests): + update any automation/monitoring that references container names (e.g., `kubectl + logs -c cert-manager ...`, Prometheus scrape relabeling, log collection configs).' + - '**OpenShift SCC compatibility risk**: new `seccompProfile: RuntimeDefault` + may cause Pods to be rejected until SCCs are adjusted/approved for the service + accounts.' chart_version: 1.10.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.10.0', 'quay.io/jetstack/cert-manager-controller:v1.10.0', - 'quay.io/jetstack/cert-manager-ctl:v1.10.0', 'quay.io/jetstack/cert-manager-webhook:v1.10.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.10.0 + - quay.io/jetstack/cert-manager-controller:v1.10.0 + - quay.io/jetstack/cert-manager-ctl:v1.10.0 + - quay.io/jetstack/cert-manager-webhook:v1.10.0 eolAt: '2023-05-19' - version: 1.9.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: @@ -12240,30 +14399,42 @@ addons: \ **Chart scheduling fix:** `startupapicheck` is now scheduled only on **Linux**\ \ nodes by default; ensure this matches your cluster node OS mix and any custom\ \ node selectors/tolerations.\n" - chart_updates: [Adds `namespace` override for resource creation (supports subchart - use)., Option to disable auto-mounting service account tokens., Removes - deprecated `securityContext.enabled` chart value., startupapicheck job scheduling - constrained to Linux nodes.] - features: ['Alpha: `Certificate.spec.literalSubject` to preserve ordered X.509 - subject RDN sequence (requires `--feature-gates=LiteralCertificateSubject=true` - on controller and webhook; mutually exclusive with `spec.subject`/`spec.commonName`).', - 'ingress-shim: configure `Certificate.spec.privateKey` and `Certificate.spec.revisionHistoryLimit` - via Ingress annotations (enables rotationPolicy best practices like `Always`).', - 'AWS credentials: can load both access key ID and secret access key from Kubernetes - Secrets for AWS-based integrations/solvers.', 'Observability: new (alpha) - Prometheus summary metric for Venafi API request latency.'] - breaking_changes: ['ingress-shim: **drops support for `networking.k8s.io/v1beta1` - Ingress**. Clusters/manifests must use `networking.k8s.io/v1` (Kubernetes - 1.22+).', "Helm chart: `securityContext.enabled` value removed\u2014must\ - \ be deleted from your values and replaced with explicit securityContext\ - \ fields if needed.", 'Feature-gated field: using `spec.literalSubject` - requires enabling the feature gate on both controller and webhook; otherwise - applies/updates will fail validation.'] + chart_updates: + - Adds `namespace` override for resource creation (supports subchart use). + - Option to disable auto-mounting service account tokens. + - Removes deprecated `securityContext.enabled` chart value. + - startupapicheck job scheduling constrained to Linux nodes. + features: + - 'Alpha: `Certificate.spec.literalSubject` to preserve ordered X.509 subject + RDN sequence (requires `--feature-gates=LiteralCertificateSubject=true` on + controller and webhook; mutually exclusive with `spec.subject`/`spec.commonName`).' + - 'ingress-shim: configure `Certificate.spec.privateKey` and `Certificate.spec.revisionHistoryLimit` + via Ingress annotations (enables rotationPolicy best practices like `Always`).' + - 'AWS credentials: can load both access key ID and secret access key from Kubernetes + Secrets for AWS-based integrations/solvers.' + - 'Observability: new (alpha) Prometheus summary metric for Venafi API request + latency.' + breaking_changes: + - 'ingress-shim: **drops support for `networking.k8s.io/v1beta1` Ingress**. + Clusters/manifests must use `networking.k8s.io/v1` (Kubernetes 1.22+).' + - "Helm chart: `securityContext.enabled` value removed\u2014must be deleted\ + \ from your values and replaced with explicit securityContext fields if needed." + - 'Feature-gated field: using `spec.literalSubject` requires enabling the feature + gate on both controller and webhook; otherwise applies/updates will fail validation.' chart_version: 1.9.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.9.0', 'quay.io/jetstack/cert-manager-controller:v1.9.0', - 'quay.io/jetstack/cert-manager-ctl:v1.9.0', 'quay.io/jetstack/cert-manager-webhook:v1.9.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.9.0 + - quay.io/jetstack/cert-manager-controller:v1.9.0 + - quay.io/jetstack/cert-manager-ctl:v1.9.0 + - quay.io/jetstack/cert-manager-webhook:v1.9.0 - version: 1.8.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -12280,38 +14451,53 @@ addons: \ **alpha `additionalOutputFormats`**, you must enable the feature gate on\ \ **both** controller and webhook in v1.8 (`--feature-gates=AdditionalCertificateOutputFormats=true`),\ \ not only controller. (v1.8)\n" - chart_updates: ['Default nodeSelector changed to linux (`kubernetes.io/os: linux`).', - New values to add labels to ServiceAccounts across components., 'Chart sets - `allowPrivilegeEscalation: false` by default for core pods and startupapicheck - job.'] - features: ['Alpha server-side-apply support behind `ServerSideApply=true` feature - gate on Kubernetes 1.22+, reducing optimistic-locking conflicts and log - noise.', "Exponential backoff for failed certificate issuances (1h \u2192\ - \ 2h \u2192 4h \u2026 up to 32h) plus a new `failedIssuanceAttempts` field\ - \ on Certificates.", 'Support for Kubernetes CSR `spec.expirationSeconds` - (Kubernetes 1.22+), retaining the existing duration annotation with a minimum - of 600s.', 'Ingress/Gateway shim enhancements: override whitelist-source-range - via Issuer `ingressTemplate`, and ability to use an external issuer resource - as default for ingress-shim.', 'Operational tooling improvements: `cmctl - experimental uninstall` and build system transition from Bazel to Make (primarily - developer-facing).'] - breaking_changes: ['Cert-manager API removals already landed in v1.7: v1alpha2/v1alpha3/v1beta1 - CRDs removed; all resources must be stored as v1 prior to upgrade (run `cmctl - upgrade migrate-api-version`).', "v1.8 validates `spec.privateKey.rotationPolicy`\ - \ on Certificates; only `Never` and `Always` are allowed\u2014invalid manifests\ - \ will be rejected by the API/webhook and can break GitOps syncs.", 'If - enabling `ServerSideApply=true` when upgrading to v1.8, pre-1.8 Challenge - resources may not be cleaned up; ensure no Challenges exist or delete them - once `valid`.', "Container internal binary paths changed due to Bazel\u2192\ - Make container layout; scripts or init containers that referenced old deep\ - \ Bazel paths will break.", Leader election now uses only Lease objects; - old ConfigMap-based leader election objects may remain and require manual - cleanup (upgrade-from-very-old versions not supported).] + chart_updates: + - 'Default nodeSelector changed to linux (`kubernetes.io/os: linux`).' + - New values to add labels to ServiceAccounts across components. + - 'Chart sets `allowPrivilegeEscalation: false` by default for core pods and + startupapicheck job.' + features: + - Alpha server-side-apply support behind `ServerSideApply=true` feature gate + on Kubernetes 1.22+, reducing optimistic-locking conflicts and log noise. + - "Exponential backoff for failed certificate issuances (1h \u2192 2h \u2192\ + \ 4h \u2026 up to 32h) plus a new `failedIssuanceAttempts` field on Certificates." + - Support for Kubernetes CSR `spec.expirationSeconds` (Kubernetes 1.22+), retaining + the existing duration annotation with a minimum of 600s. + - 'Ingress/Gateway shim enhancements: override whitelist-source-range via Issuer + `ingressTemplate`, and ability to use an external issuer resource as default + for ingress-shim.' + - 'Operational tooling improvements: `cmctl experimental uninstall` and build + system transition from Bazel to Make (primarily developer-facing).' + breaking_changes: + - 'Cert-manager API removals already landed in v1.7: v1alpha2/v1alpha3/v1beta1 + CRDs removed; all resources must be stored as v1 prior to upgrade (run `cmctl + upgrade migrate-api-version`).' + - "v1.8 validates `spec.privateKey.rotationPolicy` on Certificates; only `Never`\ + \ and `Always` are allowed\u2014invalid manifests will be rejected by the\ + \ API/webhook and can break GitOps syncs." + - If enabling `ServerSideApply=true` when upgrading to v1.8, pre-1.8 Challenge + resources may not be cleaned up; ensure no Challenges exist or delete them + once `valid`. + - "Container internal binary paths changed due to Bazel\u2192Make container\ + \ layout; scripts or init containers that referenced old deep Bazel paths\ + \ will break." + - Leader election now uses only Lease objects; old ConfigMap-based leader election + objects may remain and require manual cleanup (upgrade-from-very-old versions + not supported). chart_version: 1.8.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.8.0', 'quay.io/jetstack/cert-manager-controller:v1.8.0', - 'quay.io/jetstack/cert-manager-ctl:v1.8.0', 'quay.io/jetstack/cert-manager-webhook:v1.8.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.8.0 + - quay.io/jetstack/cert-manager-controller:v1.8.0 + - quay.io/jetstack/cert-manager-ctl:v1.8.0 + - quay.io/jetstack/cert-manager-webhook:v1.8.0 - version: 1.7.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: @@ -12330,37 +14516,53 @@ addons: as described in the release notes before retrying. ' - chart_updates: ['CRDs shipped/installed by the chart no longer include deprecated - API versions (`v1alpha2`, `v1alpha3`, `v1beta1`); CRD manifests are smaller - and no longer require a conversion webhook.', Chart includes the service-annotation - handling fix for controller/webhook Services.] - features: [New `Certificate.spec.additionalOutputFormats` supports `CombinedPEM` - (key+chain bundle) and `DER` outputs in addition to existing secret data - formats., Webhook can now be configured via a mounted configuration file - (ConfigMap) instead of only CLI flags., 'Server-Side Apply is now used to - manage Secret labels/annotations and reconcile `secretTemplate`, improving - drift correction.', New flag `--acme-http01-solver-nameservers` allows custom - nameservers for ACME HTTP-01 propagation checks., 'New `cmctl upgrade migrate-api-version` - command helps migrate stored CRs to `apiVersion: v1` before upgrading.'] - breaking_changes: ['**Deprecated APIs removed:** cert-manager no longer serves - `v1alpha2`, `v1alpha3`, or `v1beta1`. All cert-manager CRs must be stored - in etcd as `v1` and CRDs must have only `v1` as the stored version before - upgrading (use `cmctl upgrade migrate-api-version`).', '**Ingress class - semantics changed (reverted):** HTTP-01 solver Ingresses go back to using - the `kubernetes.io/ingress.class` annotation (instead of `spec.ingressClassName`). - If you relied on the newer behavior or use non-default classes/controllers, - validate HTTP-01 behavior after upgrade.', '**Upgrading with Server-Side - Apply:** SSA upgrades can produce invalid CRD configs due to CRD spec changes - (conversion webhook removal). Use client-side apply/Helm for CRDs or patch - CRD managedFields.', '**Flags:** `--dns01-self-check-nameservers` removed; - use `--dns01-recursive-nameservers` instead.', '**Kubernetes compatibility:** - cert-manager 1.7 requires Kubernetes >= 1.18 (due to reliance on Server-Side - Apply).'] + chart_updates: + - CRDs shipped/installed by the chart no longer include deprecated API versions + (`v1alpha2`, `v1alpha3`, `v1beta1`); CRD manifests are smaller and no longer + require a conversion webhook. + - Chart includes the service-annotation handling fix for controller/webhook + Services. + features: + - New `Certificate.spec.additionalOutputFormats` supports `CombinedPEM` (key+chain + bundle) and `DER` outputs in addition to existing secret data formats. + - Webhook can now be configured via a mounted configuration file (ConfigMap) + instead of only CLI flags. + - Server-Side Apply is now used to manage Secret labels/annotations and reconcile + `secretTemplate`, improving drift correction. + - New flag `--acme-http01-solver-nameservers` allows custom nameservers for + ACME HTTP-01 propagation checks. + - 'New `cmctl upgrade migrate-api-version` command helps migrate stored CRs + to `apiVersion: v1` before upgrading.' + breaking_changes: + - '**Deprecated APIs removed:** cert-manager no longer serves `v1alpha2`, `v1alpha3`, + or `v1beta1`. All cert-manager CRs must be stored in etcd as `v1` and CRDs + must have only `v1` as the stored version before upgrading (use `cmctl upgrade + migrate-api-version`).' + - '**Ingress class semantics changed (reverted):** HTTP-01 solver Ingresses + go back to using the `kubernetes.io/ingress.class` annotation (instead of + `spec.ingressClassName`). If you relied on the newer behavior or use non-default + classes/controllers, validate HTTP-01 behavior after upgrade.' + - '**Upgrading with Server-Side Apply:** SSA upgrades can produce invalid CRD + configs due to CRD spec changes (conversion webhook removal). Use client-side + apply/Helm for CRDs or patch CRD managedFields.' + - '**Flags:** `--dns01-self-check-nameservers` removed; use `--dns01-recursive-nameservers` + instead.' + - '**Kubernetes compatibility:** cert-manager 1.7 requires Kubernetes >= 1.18 + (due to reliance on Server-Side Apply).' chart_version: 1.7.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.7.0', 'quay.io/jetstack/cert-manager-controller:v1.7.0', - 'quay.io/jetstack/cert-manager-ctl:v1.7.0', 'quay.io/jetstack/cert-manager-webhook:v1.7.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.7.0 + - quay.io/jetstack/cert-manager-controller:v1.7.0 + - quay.io/jetstack/cert-manager-ctl:v1.7.0 + - quay.io/jetstack/cert-manager-webhook:v1.7.0 - version: 1.6.0 - kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: @@ -12377,70 +14579,99 @@ addons: _No explicit values key renames/removals were called out in the provided notes; validate against your current `values.yaml` and run `helm diff` before applying._' - chart_updates: ["Startup API check hook behavior improved: deletes leftover\ - \ hook resources after failed installs (reduces \u201Calready exists\u201D\ - /hook collision issues on retry).", PodSecurityPolicy added for the startup - API check job (legacy PSP environments)., Service templates updated to allow - custom annotations via chart values.] - features: ['API no longer serves deprecated cert-manager resource versions `v1alpha2`, - `v1alpha3`, `v1beta1` (upgrade enforces using `cert-manager.io/v1`).', New - Prometheus metric exposing Certificate `renewBefore` behavior for monitoring - and alerting., Azure DNS solver can specify a managed identity ID (improves - support for multiple identities)., 'CLI improvements in `cmctl`: shell completion - + better Kubernetes flag exposure, plus build-time configurable command - name.'] - breaking_changes: ["Deprecated cert-manager API versions `v1alpha2`, `v1alpha3`,\ - \ and `v1beta1` are **not served** in 1.6; manifests using them will fail\ - \ after upgrade\u2014convert resources/manifests to `cert-manager.io/v1`\ - \ before upgrading.", 'JKS keystores enforce a minimum password length of - 6 characters in 1.6.0 due to a dependency upgrade; this is fixed in 1.6.1, - so avoid 1.6.0 if you rely on shorter JKS passwords.'] + chart_updates: + - "Startup API check hook behavior improved: deletes leftover hook resources\ + \ after failed installs (reduces \u201Calready exists\u201D/hook collision\ + \ issues on retry)." + - PodSecurityPolicy added for the startup API check job (legacy PSP environments). + - Service templates updated to allow custom annotations via chart values. + features: + - API no longer serves deprecated cert-manager resource versions `v1alpha2`, + `v1alpha3`, `v1beta1` (upgrade enforces using `cert-manager.io/v1`). + - New Prometheus metric exposing Certificate `renewBefore` behavior for monitoring + and alerting. + - Azure DNS solver can specify a managed identity ID (improves support for multiple + identities). + - 'CLI improvements in `cmctl`: shell completion + better Kubernetes flag exposure, + plus build-time configurable command name.' + breaking_changes: + - "Deprecated cert-manager API versions `v1alpha2`, `v1alpha3`, and `v1beta1`\ + \ are **not served** in 1.6; manifests using them will fail after upgrade\u2014\ + convert resources/manifests to `cert-manager.io/v1` before upgrading." + - JKS keystores enforce a minimum password length of 6 characters in 1.6.0 due + to a dependency upgrade; this is fixed in 1.6.1, so avoid 1.6.0 if you rely + on shorter JKS passwords. chart_version: 1.6.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.6.0', 'quay.io/jetstack/cert-manager-controller:v1.6.0', - 'quay.io/jetstack/cert-manager-ctl:v1.6.0', 'quay.io/jetstack/cert-manager-webhook:v1.6.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.6.0 + - quay.io/jetstack/cert-manager-controller:v1.6.0 + - quay.io/jetstack/cert-manager-ctl:v1.6.0 + - quay.io/jetstack/cert-manager-webhook:v1.6.0 - version: 1.5.0 - kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [cert-manager 1.5 is the first release to support Kubernetes - 1.22 (ensure your cluster version/PSPs/security policies are compatible)., - cert-manager now only accepts AdmissionReviewVersion v1 and ConversionReviewVersion - v1 (requires Kubernetes >=1.16; webhook/API server must support v1)., 'Added - a startup API check Job that waits for the cert-manager API to become ready, - plus a `kubectl cert-manager check api` command (may create an extra Job - during startup/upgrade).', New optional controller `gateway-shim` for Gateway - API (can be enabled/disabled; adds additional reconciler behavior if enabled)., - 'Helm-chart level improvements: ability to configure labels on the cert-manager - webhook Service via a Helm value; service port for Prometheus scraping now - has a name (may affect ServiceMonitor scraping selectors); and support for - configuring which annotations are copied from Certificate to CertificateRequest - (with some keys excluded by default).'] - features: [Kubernetes 1.22 support., 'Gateway API support: optional gateway-shim - to auto-create ACME certs for annotated Gateways and Gateway API HTTP01 - solver support.', 'TLS Secret customization: add custom annotations/labels - to the Secret containing the issued key pair.', 'Crypto: Ed25519 private - keys/signatures supported for Certificates.', 'Experimental CSR signing - support for ACME, SelfSigned, Vault, and Venafi issuers behind `--feature-gates=ExperimentalCertificateSigningRequestControllers=true`, - plus a CLI command to create Kubernetes CSRs from Certificate manifests.', - 'Observability/ops: named Prometheus scrape port, new `clock_time_seconds` - metric, improved shutdown/leader election behavior, and new kubectl plugin - commands (`version`, `check api`, `x install`).'] - breaking_changes: [cert-manager webhooks now only support AdmissionReview and - ConversionReview API version v1 (v1beta1 removed); clusters must be Kubernetes - >=1.16 and any integrations expecting v1beta1 will break., "Pre-v1 cert-manager\ - \ resource requests must be convertible to v1 to be validated/mutated by\ - \ admission webhooks; if conversion isn\u2019t in place, older manifests\ - \ may be rejected (relevant if you still apply deprecated API versions).", - 'Forward-looking: APIs deprecated in 1.4 (v1alpha2/v1alpha3/v1beta1) will - stop being served in 1.6; you should complete CRD/resource migration to - v1 during/after this upgrade to avoid being blocked later.'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - cert-manager 1.5 is the first release to support Kubernetes 1.22 (ensure your + cluster version/PSPs/security policies are compatible). + - cert-manager now only accepts AdmissionReviewVersion v1 and ConversionReviewVersion + v1 (requires Kubernetes >=1.16; webhook/API server must support v1). + - Added a startup API check Job that waits for the cert-manager API to become + ready, plus a `kubectl cert-manager check api` command (may create an extra + Job during startup/upgrade). + - New optional controller `gateway-shim` for Gateway API (can be enabled/disabled; + adds additional reconciler behavior if enabled). + - 'Helm-chart level improvements: ability to configure labels on the cert-manager + webhook Service via a Helm value; service port for Prometheus scraping now + has a name (may affect ServiceMonitor scraping selectors); and support for + configuring which annotations are copied from Certificate to CertificateRequest + (with some keys excluded by default).' + features: + - Kubernetes 1.22 support. + - 'Gateway API support: optional gateway-shim to auto-create ACME certs for + annotated Gateways and Gateway API HTTP01 solver support.' + - 'TLS Secret customization: add custom annotations/labels to the Secret containing + the issued key pair.' + - 'Crypto: Ed25519 private keys/signatures supported for Certificates.' + - Experimental CSR signing support for ACME, SelfSigned, Vault, and Venafi issuers + behind `--feature-gates=ExperimentalCertificateSigningRequestControllers=true`, + plus a CLI command to create Kubernetes CSRs from Certificate manifests. + - 'Observability/ops: named Prometheus scrape port, new `clock_time_seconds` + metric, improved shutdown/leader election behavior, and new kubectl plugin + commands (`version`, `check api`, `x install`).' + breaking_changes: + - cert-manager webhooks now only support AdmissionReview and ConversionReview + API version v1 (v1beta1 removed); clusters must be Kubernetes >=1.16 and any + integrations expecting v1beta1 will break. + - "Pre-v1 cert-manager resource requests must be convertible to v1 to be validated/mutated\ + \ by admission webhooks; if conversion isn\u2019t in place, older manifests\ + \ may be rejected (relevant if you still apply deprecated API versions)." + - 'Forward-looking: APIs deprecated in 1.4 (v1alpha2/v1alpha3/v1beta1) will + stop being served in 1.6; you should complete CRD/resource migration to v1 + during/after this upgrade to avoid being blocked later.' chart_version: 1.5.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.5.0', 'quay.io/jetstack/cert-manager-controller:v1.5.0', - 'quay.io/jetstack/cert-manager-ctl:v1.5.0', 'quay.io/jetstack/cert-manager-webhook:v1.5.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.5.0 + - quay.io/jetstack/cert-manager-controller:v1.5.0 + - quay.io/jetstack/cert-manager-ctl:v1.5.0 + - quay.io/jetstack/cert-manager-webhook:v1.5.0 - version: 1.4.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -12453,33 +14684,45 @@ addons: \ note, still relevant if you\u2019re on 1.3.0) **Helm upgrade path:** upgrade\ \ to **v1.3.1 first** to avoid a CRD type conversion issue, then proceed to\ \ v1.4.0." - chart_updates: [Controller leader election lock type changed to `ConfigMapsLeasesResourceLock` - (internal behavior; may affect required RBAC in locked-down clusters)., - Base image updated (distroless/static) and Kubernetes libraries updated to - v1.21.0 (generally transparent but can surface compatibility issues in very - old clusters/tools)., Webhook can be configured to be reachable from outside - the cluster (new capability; requires conscious networking configuration - if enabled).] - features: ['Helm: add `serviceLabels` to apply custom labels to the controller - Service.', 'Security: `runAsNonRoot` enabled by default (hardening); requires - adjustments if any container needs root.', 'Issuers: CA/Vault/Venafi now - build and expose a proper certificate chain and set `CertificateRequest.Status.CA` - to the root-most certificate when available.', New option to implement the - CA Issuer via the Kubernetes `CertificateSigningRequest` controller., Webhook - can be exposed outside the cluster (useful for external API server/webhook - reachability scenarios)., Akamai issuer updated to EdgeDNS v2 API; kubectl - plugin built for darwin/arm64.] - breaking_changes: ['CA Issuer behavior change: `ca.crt` on issued Secrets now - stores the **root CA** (when available) rather than the issuing/intermediate - CA; the intermediate should now appear in `tls.crt` chain. Consumers that - assumed `ca.crt` contained the intermediate may need updates.', 'Helm default - security context change: `runAsNonRoot=true` can break deployments that - add custom root-running containers unless values are overridden.'] + chart_updates: + - Controller leader election lock type changed to `ConfigMapsLeasesResourceLock` + (internal behavior; may affect required RBAC in locked-down clusters). + - Base image updated (distroless/static) and Kubernetes libraries updated to + v1.21.0 (generally transparent but can surface compatibility issues in very + old clusters/tools). + - Webhook can be configured to be reachable from outside the cluster (new capability; + requires conscious networking configuration if enabled). + features: + - 'Helm: add `serviceLabels` to apply custom labels to the controller Service.' + - 'Security: `runAsNonRoot` enabled by default (hardening); requires adjustments + if any container needs root.' + - 'Issuers: CA/Vault/Venafi now build and expose a proper certificate chain + and set `CertificateRequest.Status.CA` to the root-most certificate when available.' + - New option to implement the CA Issuer via the Kubernetes `CertificateSigningRequest` + controller. + - Webhook can be exposed outside the cluster (useful for external API server/webhook + reachability scenarios). + - Akamai issuer updated to EdgeDNS v2 API; kubectl plugin built for darwin/arm64. + breaking_changes: + - 'CA Issuer behavior change: `ca.crt` on issued Secrets now stores the **root + CA** (when available) rather than the issuing/intermediate CA; the intermediate + should now appear in `tls.crt` chain. Consumers that assumed `ca.crt` contained + the intermediate may need updates.' + - 'Helm default security context change: `runAsNonRoot=true` can break deployments + that add custom root-running containers unless values are overridden.' chart_version: 1.4.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.4.0', 'quay.io/jetstack/cert-manager-controller:v1.4.0', - 'quay.io/jetstack/cert-manager-webhook:v1.4.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.4.0 + - quay.io/jetstack/cert-manager-controller:v1.4.0 + - quay.io/jetstack/cert-manager-webhook:v1.4.0 - version: 1.3.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -12498,34 +14741,48 @@ addons: if you override webhook/service ports). ' - chart_updates: ['Helm chart: add `automountServiceAccountToken` field to service - accounts.', 'Helm chart: fix/adjust Helm upgrade behaviors (v1.2 had a type - conversion bug fix; v1.3 notes include additional Helm upgrade fix).', 'Helm - chart/service: ensure `targetPort` uses the value-defined port (may affect - custom port overrides).'] - features: [CertificateRequests now support an `Approved` condition and include - requester `UserInfo` fields (username/groups/uid/extra) for auditing., 'New - kubectl plugin commands: `kubectl cert-manager approve|deny` and improved - default output for `kubectl get certificaterequest`.', Issuers and Certificates - now publish `observedGeneration` in conditions to make status vs. spec drift - easier to detect., Certificates gain `revisionHistoryLimit` to garbage-collect - old CertificateRequests and reduce clutter., 'Controller can selectively - disable specific controllers via `--controllers=\*,-foo`.', Venafi issuer - updated for Venafi Cloud OutagePREDICT compatibility.] - breaking_changes: [Controller flag `--renew-before-expiration-duration` was - **removed** in v1.3; move to `Certificate.spec.renewBefore` / ingress-shim - annotations or manifests will fail to start if still set., "CertificateRequests\ - \ are now **immutable**: `spec` and `metadata.annotations` can\u2019t be\ - \ changed after creation; workflows that patch CertificateRequests must\ - \ be adjusted.", 'Venafi Cloud zone syntax changed due to OutagePREDICT - migration: zone is now `<>\\<>` - (e.g., `My Application\\My CIT`).', "Helm upgrade pitfall: v1.3.0 has a\ - \ CRD type conversion issue\u2014**upgrade to v1.3.1** instead of v1.3.0."] + chart_updates: + - 'Helm chart: add `automountServiceAccountToken` field to service accounts.' + - 'Helm chart: fix/adjust Helm upgrade behaviors (v1.2 had a type conversion + bug fix; v1.3 notes include additional Helm upgrade fix).' + - 'Helm chart/service: ensure `targetPort` uses the value-defined port (may + affect custom port overrides).' + features: + - CertificateRequests now support an `Approved` condition and include requester + `UserInfo` fields (username/groups/uid/extra) for auditing. + - 'New kubectl plugin commands: `kubectl cert-manager approve|deny` and improved + default output for `kubectl get certificaterequest`.' + - Issuers and Certificates now publish `observedGeneration` in conditions to + make status vs. spec drift easier to detect. + - Certificates gain `revisionHistoryLimit` to garbage-collect old CertificateRequests + and reduce clutter. + - Controller can selectively disable specific controllers via `--controllers=\*,-foo`. + - Venafi issuer updated for Venafi Cloud OutagePREDICT compatibility. + breaking_changes: + - Controller flag `--renew-before-expiration-duration` was **removed** in v1.3; + move to `Certificate.spec.renewBefore` / ingress-shim annotations or manifests + will fail to start if still set. + - "CertificateRequests are now **immutable**: `spec` and `metadata.annotations`\ + \ can\u2019t be changed after creation; workflows that patch CertificateRequests\ + \ must be adjusted." + - 'Venafi Cloud zone syntax changed due to OutagePREDICT migration: zone is + now `<>\\<>` (e.g., `My Application\\My + CIT`).' + - "Helm upgrade pitfall: v1.3.0 has a CRD type conversion issue\u2014**upgrade\ + \ to v1.3.1** instead of v1.3.0." chart_version: 1.3.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.3.0', 'quay.io/jetstack/cert-manager-controller:v1.3.0', - 'quay.io/jetstack/cert-manager-webhook:v1.3.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.3.0 + - quay.io/jetstack/cert-manager-controller:v1.3.0 + - quay.io/jetstack/cert-manager-webhook:v1.3.0 - version: 1.2.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -12537,35 +14794,55 @@ addons: \ the provided notes don\u2019t include a full chart values diff; review your\ \ existing values file for any custom flags/args that may now be deprecated\ \ (e.g., `--renew-before-expiration-duration`)." - chart_updates: [Minimum supported Kubernetes version is now **v1.16.0** (v1.2.0)., - Admissionregistration resources now use `admissionregistration.k8s.io/v1` - (v1.2.0)., Ingress-related work moved to newer API group (`networking.k8s.io/v1beta1`) - in code paths (v1.2.0)., User-Agent changed to reflect CNCF ownership transfer - (v1.2.0)., 'Vault issuer secret contents changed: `ca.crt` now stores the - **root CA** instead of the issuing CA (v1.2.0).'] - features: [Ingress-shim can now set key usages via `cert-manager.io/usages` - and includes Server Auth by default., 'New plugin: `kubectl cert-manager - inspect secret` to print certificate info from a Secret.', CRDs now include - category names so you can list them with `kubectl get cert-manager` / `kubectl - get cert-manager-acme`., Controller can generate a PKCS12 truststore (`truststore.p12`) - from a CA., Controller can expose pprof profiling when enabled via `--enable-profiling`., - CA issuer can set a custom OCSP server for issued certificates., Cainjector - leader election timing can be tuned via new flags (lease duration / renew - deadline / retry period)., Ingress-shim now honors `cert-manager.io/duration` - and `cert-manager.io/renew-before` annotations.] - breaking_changes: [Kubernetes **v1.16.0** is now the minimum supported version; - clusters on v1.15 or below must upgrade Kubernetes first or stay on cert-manager - v1.1.x., The controller flag `--renew-before-expiration-duration` is **deprecated** - in favor of `Certificate.spec.renewBefore` and will be removed in the next - release (plan to migrate now)., 'Vault issuer output changed: `ca.crt` now - contains the **root CA** (not the issuing CA), which may break consumers - that expect the previous CA chain behavior.'] + chart_updates: + - Minimum supported Kubernetes version is now **v1.16.0** (v1.2.0). + - Admissionregistration resources now use `admissionregistration.k8s.io/v1` + (v1.2.0). + - Ingress-related work moved to newer API group (`networking.k8s.io/v1beta1`) + in code paths (v1.2.0). + - User-Agent changed to reflect CNCF ownership transfer (v1.2.0). + - 'Vault issuer secret contents changed: `ca.crt` now stores the **root CA** + instead of the issuing CA (v1.2.0).' + features: + - Ingress-shim can now set key usages via `cert-manager.io/usages` and includes + Server Auth by default. + - 'New plugin: `kubectl cert-manager inspect secret` to print certificate info + from a Secret.' + - CRDs now include category names so you can list them with `kubectl get cert-manager` + / `kubectl get cert-manager-acme`. + - Controller can generate a PKCS12 truststore (`truststore.p12`) from a CA. + - Controller can expose pprof profiling when enabled via `--enable-profiling`. + - CA issuer can set a custom OCSP server for issued certificates. + - Cainjector leader election timing can be tuned via new flags (lease duration + / renew deadline / retry period). + - Ingress-shim now honors `cert-manager.io/duration` and `cert-manager.io/renew-before` + annotations. + breaking_changes: + - Kubernetes **v1.16.0** is now the minimum supported version; clusters on v1.15 + or below must upgrade Kubernetes first or stay on cert-manager v1.1.x. + - The controller flag `--renew-before-expiration-duration` is **deprecated** + in favor of `Certificate.spec.renewBefore` and will be removed in the next + release (plan to migrate now). + - 'Vault issuer output changed: `ca.crt` now contains the **root CA** (not the + issuing CA), which may break consumers that expect the previous CA chain behavior.' chart_version: 1.2.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.2.0', 'quay.io/jetstack/cert-manager-controller:v1.2.0', - 'quay.io/jetstack/cert-manager-webhook:v1.2.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.2.0 + - quay.io/jetstack/cert-manager-controller:v1.2.0 + - quay.io/jetstack/cert-manager-webhook:v1.2.0 - version: 1.1.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12577,23 +14854,38 @@ addons: \ for monitoring/PSP/policy selection or you need longer webhook admission\ \ timeouts, consider setting these new values. Otherwise no required values\ \ changes are called out in the provided notes." - chart_updates: ['Helm chart: allow setting custom `podLabels` on `webhook` and - `cainjector` Deployments.', 'Helm chart: allow configuring the webhook timeout - for admission calls.'] - features: ['Certificate spec: `encodeUsagesInRequest` allows disabling encoding - key usages in the CSR.', "ACME: can pass Certificate `duration` to the ACME\ - \ server (not supported by Let\u2019s Encrypt at the time).", 'ACME: support - issuing certificates with IP Subject Alternative Names.', 'ACME DNS-01: - propagation check period is now configurable.', 'Controller tuning: Kubernetes - client QPS throttling is now configurable.', 'Venafi TPP issuer: now supports - access-token credentials.'] + chart_updates: + - 'Helm chart: allow setting custom `podLabels` on `webhook` and `cainjector` + Deployments.' + - 'Helm chart: allow configuring the webhook timeout for admission calls.' + features: + - 'Certificate spec: `encodeUsagesInRequest` allows disabling encoding key usages + in the CSR.' + - "ACME: can pass Certificate `duration` to the ACME server (not supported by\ + \ Let\u2019s Encrypt at the time)." + - 'ACME: support issuing certificates with IP Subject Alternative Names.' + - 'ACME DNS-01: propagation check period is now configurable.' + - 'Controller tuning: Kubernetes client QPS throttling is now configurable.' + - 'Venafi TPP issuer: now supports access-token credentials.' breaking_changes: [] chart_version: 1.1.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.1.0', 'quay.io/jetstack/cert-manager-controller:v1.1.0', - 'quay.io/jetstack/cert-manager-webhook:v1.1.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.1.0 + - quay.io/jetstack/cert-manager-controller:v1.1.0 + - quay.io/jetstack/cert-manager-webhook:v1.1.0 - version: 1.0.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12619,37 +14911,54 @@ addons: - **Use modern `kubectl` and `helm`:** Older versions may fail to update cert-manager CRDs correctly (called out as urgent in both v0.16.0 and v1.0.0 notes).' - chart_updates: [Introduces the stable **v1 API** and makes it the **storage - version** for cert-manager resources; CRDs now include `apiextensions.k8s.io/v1` - variants and controllers are updated accordingly., 'Moves to newer/stable - Kubernetes APIs across the board: admissionregistration.k8s.io/v1 for webhooks - and rbac.authorization.k8s.io/v1 for RBAC.', Improved logging via klog v2 - and log-level usage; internal refactors like cainjector leader election - simplification., 'Enhances kubectl/ctl UX, especially `kubectl cert-manager - status certificate`, adding more related resource and event output for debugging.', - ACME improvements including preferred chain support and better handling of - Retry-After backoff; better error surfacing for Orders/Challenges.] - features: ['Stable `v1` API is introduced and becomes the default/storage version, - improving long-term compatibility expectations.', '`kubectl cert-manager - status certificate` gains richer output (related Secret, Issuer, Orders/Challenges, - and Events) for faster troubleshooting.', 'Helm chart gains options for - webhook host networking, configurable probes, extra webhook annotations, - and image digests for pinning.', 'ACME enhancements: support for `preferredChain` - and improved rate-limit backoff handling via Retry-After.', 'Issuer/provider - improvements: async Venafi issuance (0.16), Vault issuer namespace support - (1.0), and additional HTTP01 podTemplate fields (serviceAccountName/priorityClassName).'] - breaking_changes: ['**Kubernetes version compatibility:** Kubernetes < **v1.16** - requires special upgrade instructions for 0.16 -> 1.0 (per urgent notes).', - '**API removals:** Support for `AuditSink` resources in `auditregistration.k8s.io/v1alpha1` - was removed (v0.16.0).', '**CRD upgrade sensitivity:** Upgrading CRDs can - fail with old `kubectl`/`helm`; treat CRD updates as a critical step and - follow the documented upgrade guides.'] + chart_updates: + - Introduces the stable **v1 API** and makes it the **storage version** for + cert-manager resources; CRDs now include `apiextensions.k8s.io/v1` variants + and controllers are updated accordingly. + - 'Moves to newer/stable Kubernetes APIs across the board: admissionregistration.k8s.io/v1 + for webhooks and rbac.authorization.k8s.io/v1 for RBAC.' + - Improved logging via klog v2 and log-level usage; internal refactors like + cainjector leader election simplification. + - Enhances kubectl/ctl UX, especially `kubectl cert-manager status certificate`, + adding more related resource and event output for debugging. + - ACME improvements including preferred chain support and better handling of + Retry-After backoff; better error surfacing for Orders/Challenges. + features: + - Stable `v1` API is introduced and becomes the default/storage version, improving + long-term compatibility expectations. + - '`kubectl cert-manager status certificate` gains richer output (related Secret, + Issuer, Orders/Challenges, and Events) for faster troubleshooting.' + - Helm chart gains options for webhook host networking, configurable probes, + extra webhook annotations, and image digests for pinning. + - 'ACME enhancements: support for `preferredChain` and improved rate-limit backoff + handling via Retry-After.' + - 'Issuer/provider improvements: async Venafi issuance (0.16), Vault issuer + namespace support (1.0), and additional HTTP01 podTemplate fields (serviceAccountName/priorityClassName).' + breaking_changes: + - '**Kubernetes version compatibility:** Kubernetes < **v1.16** requires special + upgrade instructions for 0.16 -> 1.0 (per urgent notes).' + - '**API removals:** Support for `AuditSink` resources in `auditregistration.k8s.io/v1alpha1` + was removed (v0.16.0).' + - '**CRD upgrade sensitivity:** Upgrading CRDs can fail with old `kubectl`/`helm`; + treat CRD updates as a critical step and follow the documented upgrade guides.' chart_version: 1.0.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v1.0.0', 'quay.io/jetstack/cert-manager-controller:v1.0.0', - 'quay.io/jetstack/cert-manager-webhook:v1.0.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v1.0.0 + - quay.io/jetstack/cert-manager-controller:v1.0.0 + - quay.io/jetstack/cert-manager-webhook:v1.0.0 - version: 0.16.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12659,36 +14968,55 @@ addons: \ via values (for cert-manager, webhook, and cainjector).\n- **Tooling caution**:\ \ v0.16 notes that **older `kubectl`/`helm` struggle to update CRDs**; follow\ \ the 0.15\u21920.16 upgrade doc and ensure your client tooling is new enough.\n" - chart_updates: ['v0.15: Helm chart can optionally install/manage CRDs via `installCRDs` - (was previously external/static-manifest managed).', 'v0.15: ServiceAccount - customization added for webhook and cainjector (chart options).', 'v0.16: - Helm chart exposes container-level `securityContext` configuration per deployment.'] - features: ['Optional Helm-managed CRDs via `installCRDs`, reducing manual CRD - lifecycle steps when installing/upgrading with Helm.', 'Webhook startup - is more reliable because it can bootstrap/manage its own CA/certs (dynamic - authority), reducing dependency on the controller being ready.', JKS and - PKCS#12 keystore support is GA and configurable per-Certificate via `spec.keystores`., - 'New `kubectl cert-manager` (ctl) plugin features: status output improvements, - manual renewal support (0.15 feature-gated; more commands in 0.16), and - creation of CertificateRequests from Certificate YAML.', 'New `v1beta1` - API version is introduced in 0.16, preparing for API stabilization/migrations.', - 'Experimental certificate controller implementations become enabled for all - users in 0.16, bringing features like private key rotation closer to default - behavior.'] - breaking_changes: ["v0.15: Default KeyUsage no longer includes `serverAuth`;\ - \ if you rely on it and your issuer doesn\u2019t set it, you must explicitly\ - \ add `serverAuth` to Certificate/CertificateRequest `usages` to avoid behavior\ - \ changes.", 'v0.16: Support for `AuditSink` (`auditregistration.k8s.io/v1alpha1`) - as a cainjector target is removed; any setups relying on injecting CA bundles - into AuditSink will stop working.', 'v0.16: CRD upgrade can fail with older - Helm/kubectl clients; using outdated tooling may break the upgrade until - clients are updated and CRDs are applied per the documented procedure.'] + chart_updates: + - 'v0.15: Helm chart can optionally install/manage CRDs via `installCRDs` (was + previously external/static-manifest managed).' + - 'v0.15: ServiceAccount customization added for webhook and cainjector (chart + options).' + - 'v0.16: Helm chart exposes container-level `securityContext` configuration + per deployment.' + features: + - Optional Helm-managed CRDs via `installCRDs`, reducing manual CRD lifecycle + steps when installing/upgrading with Helm. + - Webhook startup is more reliable because it can bootstrap/manage its own CA/certs + (dynamic authority), reducing dependency on the controller being ready. + - JKS and PKCS#12 keystore support is GA and configurable per-Certificate via + `spec.keystores`. + - 'New `kubectl cert-manager` (ctl) plugin features: status output improvements, + manual renewal support (0.15 feature-gated; more commands in 0.16), and creation + of CertificateRequests from Certificate YAML.' + - New `v1beta1` API version is introduced in 0.16, preparing for API stabilization/migrations. + - Experimental certificate controller implementations become enabled for all + users in 0.16, bringing features like private key rotation closer to default + behavior. + breaking_changes: + - "v0.15: Default KeyUsage no longer includes `serverAuth`; if you rely on it\ + \ and your issuer doesn\u2019t set it, you must explicitly add `serverAuth`\ + \ to Certificate/CertificateRequest `usages` to avoid behavior changes." + - 'v0.16: Support for `AuditSink` (`auditregistration.k8s.io/v1alpha1`) as a + cainjector target is removed; any setups relying on injecting CA bundles into + AuditSink will stop working.' + - 'v0.16: CRD upgrade can fail with older Helm/kubectl clients; using outdated + tooling may break the upgrade until clients are updated and CRDs are applied + per the documented procedure.' chart_version: 0.16.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.16.0', 'quay.io/jetstack/cert-manager-controller:v0.16.0', - 'quay.io/jetstack/cert-manager-webhook:v0.16.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.16.0 + - quay.io/jetstack/cert-manager-controller:v0.16.0 + - quay.io/jetstack/cert-manager-webhook:v0.16.0 - version: 0.15.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12705,36 +15033,53 @@ addons: \ (controller/cainjector/webhook). If your 0.14 install came from Helm and\ \ you didn\u2019t perform this, validate your current resources/selectors\ \ before the 0.15 upgrade." - chart_updates: [Helm chart gained the `installCRDs` switch to optionally manage - CRDs with Helm (disabled by default)., 'Webhook deployment/process was improved - in 0.15 (DynamicAuthority / self-managed CA for serving certs), reducing - dependency on the controller for webhook startup reliability.', 'Chart supports - additional customization around service accounts (webhook and cainjector), - and a narrower-scoped RBAC role for leader-election configmaps (operational - hardening).'] - features: ['Optional Helm-managed CRDs via `installCRDs`, simplifying installations - that want CRDs lifecycle tied to the Helm release.', Experimental new Certificate - controller architecture (feature-gated) to enable capabilities like private - key rotation and manual renewal triggering., Webhook startup is more reliable - and faster because the webhook now bootstraps/maintains its own CA and serving - certs without waiting on the controller., General availability of per-Certificate - JKS and PKCS#12 keystore output via `certificate.spec.keystores` (no global - experimental flags needed)., New `kubectl cert-manager` (cert-manager-ctl) - plugin adds `convert` (API version conversion) and `renew` (manual renewal; - requires experimental certificate controllers).] - breaking_changes: ['**Urgent:** `serverAuth` key usage was removed from the - default usages set. If your Issuer does not automatically include it and - you require it, you must explicitly add `serverAuth` to `Certificate` and - `CertificateRequest` `usages` to avoid unexpected behavior after upgrade.', - "If you previously relied on v0.14\u2019s global experimental JKS/PKCS12 flags,\ - \ v0.15\u2019s recommended approach is per-Certificate `spec.keystores`;\ - \ plan a migration of configuration/expectations accordingly."] + chart_updates: + - Helm chart gained the `installCRDs` switch to optionally manage CRDs with + Helm (disabled by default). + - Webhook deployment/process was improved in 0.15 (DynamicAuthority / self-managed + CA for serving certs), reducing dependency on the controller for webhook startup + reliability. + - Chart supports additional customization around service accounts (webhook and + cainjector), and a narrower-scoped RBAC role for leader-election configmaps + (operational hardening). + features: + - Optional Helm-managed CRDs via `installCRDs`, simplifying installations that + want CRDs lifecycle tied to the Helm release. + - Experimental new Certificate controller architecture (feature-gated) to enable + capabilities like private key rotation and manual renewal triggering. + - Webhook startup is more reliable and faster because the webhook now bootstraps/maintains + its own CA and serving certs without waiting on the controller. + - General availability of per-Certificate JKS and PKCS#12 keystore output via + `certificate.spec.keystores` (no global experimental flags needed). + - New `kubectl cert-manager` (cert-manager-ctl) plugin adds `convert` (API version + conversion) and `renew` (manual renewal; requires experimental certificate + controllers). + breaking_changes: + - '**Urgent:** `serverAuth` key usage was removed from the default usages set. + If your Issuer does not automatically include it and you require it, you must + explicitly add `serverAuth` to `Certificate` and `CertificateRequest` `usages` + to avoid unexpected behavior after upgrade.' + - "If you previously relied on v0.14\u2019s global experimental JKS/PKCS12 flags,\ + \ v0.15\u2019s recommended approach is per-Certificate `spec.keystores`; plan\ + \ a migration of configuration/expectations accordingly." chart_version: 0.15.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.15.0', 'quay.io/jetstack/cert-manager-controller:v0.15.0', - 'quay.io/jetstack/cert-manager-webhook:v0.15.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.15.0 + - quay.io/jetstack/cert-manager-controller:v0.15.0 + - quay.io/jetstack/cert-manager-webhook:v0.15.0 - version: 0.14.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12751,36 +15096,57 @@ addons: - If you previously disabled cainjector: a bug fix indicates `cainjector.enabled=false`\ \ now works correctly; re-check your values to ensure your intended state\ \ is applied post-upgrade.\n" - chart_updates: [Webhook component is required starting v0.14 (no-webhook variant - removed; webhook enable toggle removed in chart)., "Installation manifests\ - \ reworked into two variants: `cert-manager.yaml` (standard) and `cert-manager-legacy.yaml`\ - \ (for Kubernetes 1.11\u20131.14 / OpenShift 3.11).", 'CRD distribution - changed: `00-crds.yaml` replaced by a release-published CRD manifest; CRD - conversion webhook enabled to serve v1alpha3 alongside v1alpha2.', Deployment - selectors updated (requires deleting existing Deployments prior to Helm - upgrade)., Webhook leader-election RoleBinding now uses leader election - namespace rather than hard-coded `kube-system`., Flags/params added around - webhook TLS cipher suites and improved webhook startup time.] - features: ['CRD conversion webhook enabled and new `v1alpha3` API served alongside - `v1alpha2`, easing future API transitions.', Experimental certificate bundle - output support for **JKS** and **PKCS#12** via controller flags (global - enable)., 'Venafi issuer enhancements: custom fields via `venafi.cert-manager.io/custom-fields` - annotation (TPP 19.2+ required for TPP).', New `emailSANs` field on Certificate - resources., 'Improved install compatibility: support extended to Kubernetes - 1.11 and OpenShift 3.11 (via legacy manifests).'] - breaking_changes: ['**Helm upgrade requires manual intervention**: delete the - three cert-manager Deployments before upgrading due to immutable selector - changes.', '**Webhook cannot be disabled anymore**; environments that relied - on `webhook.enabled=false` or no-webhook installs must now run the webhook - and ensure API server-to-webhook connectivity.', 'API evolution begins (`v1alpha3` - + conversion webhook): while intended to be seamless, any hardcoded assumptions - about field locations/serialization in clients may need validation.'] + chart_updates: + - Webhook component is required starting v0.14 (no-webhook variant removed; + webhook enable toggle removed in chart). + - "Installation manifests reworked into two variants: `cert-manager.yaml` (standard)\ + \ and `cert-manager-legacy.yaml` (for Kubernetes 1.11\u20131.14 / OpenShift\ + \ 3.11)." + - 'CRD distribution changed: `00-crds.yaml` replaced by a release-published + CRD manifest; CRD conversion webhook enabled to serve v1alpha3 alongside v1alpha2.' + - Deployment selectors updated (requires deleting existing Deployments prior + to Helm upgrade). + - Webhook leader-election RoleBinding now uses leader election namespace rather + than hard-coded `kube-system`. + - Flags/params added around webhook TLS cipher suites and improved webhook startup + time. + features: + - CRD conversion webhook enabled and new `v1alpha3` API served alongside `v1alpha2`, + easing future API transitions. + - Experimental certificate bundle output support for **JKS** and **PKCS#12** + via controller flags (global enable). + - 'Venafi issuer enhancements: custom fields via `venafi.cert-manager.io/custom-fields` + annotation (TPP 19.2+ required for TPP).' + - New `emailSANs` field on Certificate resources. + - 'Improved install compatibility: support extended to Kubernetes 1.11 and OpenShift + 3.11 (via legacy manifests).' + breaking_changes: + - '**Helm upgrade requires manual intervention**: delete the three cert-manager + Deployments before upgrading due to immutable selector changes.' + - '**Webhook cannot be disabled anymore**; environments that relied on `webhook.enabled=false` + or no-webhook installs must now run the webhook and ensure API server-to-webhook + connectivity.' + - 'API evolution begins (`v1alpha3` + conversion webhook): while intended to + be seamless, any hardcoded assumptions about field locations/serialization + in clients may need validation.' chart_version: 0.14.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.14.0', 'quay.io/jetstack/cert-manager-controller:v0.14.0', - 'quay.io/jetstack/cert-manager-webhook:v0.14.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.14.0 + - quay.io/jetstack/cert-manager-controller:v0.14.0 + - quay.io/jetstack/cert-manager-webhook:v0.14.0 - version: 0.13.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12794,28 +15160,45 @@ addons: \ explicitly sets `containerPort` protocol.\n\n_No mandatory Helm values changes\ \ are called out for 0.12\u21920.13; v0.13 is described as not requiring special\ \ upgrade steps._" - chart_updates: [Helm chart now supports configuring additional pod `volumes` - and `volumeMounts`., Helm chart supports configurable deployment annotations - for controller/webhook/cainjector., Helm chart supports setting pod securityContext - for controller and separately for webhook/cainjector., Helm chart can disable - AppArmor when using PodSecurityPolicies., Helm chart fixes templating of - false-y values (kubernetes/kubernetes#66450)., Helm chart explicitly defines - `containerPort` protocol.] - features: ['ACME External Account Binding (EAB) support via `spec.acme.externalAccountBinding` - on ACME Issuer/ClusterIssuer, enabling use with ACME providers that require - EAB.', 'Certificate subject supports the full set of standard X.509 subject - fields (e.g., OU, province, serialNumber, country, etc.).', New `InvalidRequest` - status condition on `CertificateRequest` lets external issuers signal a - non-retriable invalid CSR/request to avoid endless retries/quota burn.] - breaking_changes: ["No breaking changes or special upgrade steps are indicated\ - \ for v0.13.0 relative to v0.12.0 in the provided notes (it\u2019s described\ - \ as a minor, incremental update)."] + chart_updates: + - Helm chart now supports configuring additional pod `volumes` and `volumeMounts`. + - Helm chart supports configurable deployment annotations for controller/webhook/cainjector. + - Helm chart supports setting pod securityContext for controller and separately + for webhook/cainjector. + - Helm chart can disable AppArmor when using PodSecurityPolicies. + - Helm chart fixes templating of false-y values (kubernetes/kubernetes#66450). + - Helm chart explicitly defines `containerPort` protocol. + features: + - ACME External Account Binding (EAB) support via `spec.acme.externalAccountBinding` + on ACME Issuer/ClusterIssuer, enabling use with ACME providers that require + EAB. + - Certificate subject supports the full set of standard X.509 subject fields + (e.g., OU, province, serialNumber, country, etc.). + - New `InvalidRequest` status condition on `CertificateRequest` lets external + issuers signal a non-retriable invalid CSR/request to avoid endless retries/quota + burn. + breaking_changes: + - "No breaking changes or special upgrade steps are indicated for v0.13.0 relative\ + \ to v0.12.0 in the provided notes (it\u2019s described as a minor, incremental\ + \ update)." chart_version: 0.13.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.13.0', 'quay.io/jetstack/cert-manager-controller:v0.13.0', - 'quay.io/jetstack/cert-manager-webhook:v0.13.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.13.0 + - quay.io/jetstack/cert-manager-controller:v0.13.0 + - quay.io/jetstack/cert-manager-webhook:v0.13.0 - version: 0.12.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: @@ -12832,43 +15215,54 @@ addons: no user action. ' - chart_updates: ['Webhook component deployment was redesigned to no longer rely - on an `APIService`, reducing risk of cluster-wide issues if the webhook - is unavailable.', Multi-architecture image support is now automatic via - Docker manifest lists (no need for arch-specific images/manifests)., Improved - ACME Challenge diagnostics; more information surfaced on Challenge resources - (`kubectl describe challenge ...`)., 'Various bug fixes: PSP compatibility, - OwnerReferencesPermissionEnforcement admission controller compatibility, - leader election signal handling, and solver/docs fixes.', 'Defaults/behavioral - tweaks: webhook listen address default changed to **10250** for better GKE - private cluster compatibility.', 'Schema/validation tightened: `CertificateRequest.spec.csr` - marked required; additional API resource validation for `status` subresource; - immutability enforced on multiple Order fields.'] - features: [Automatic multi-architecture image selection using Docker manifest - lists (arm/arm64 etc.) without changing manifests., Much better debugging - for ACME authorization failures via richer status/details on Challenge resources., - Webhook simplified (no `APIService`) and now includes support for CRD API - conversion groundwork for future v1beta1., Cloudflare issuer supports API - token authentication., Certificates now include `serverAuth` extended key - usage by default.] - breaking_changes: ['**Vault Kubernetes auth path change:** if you set a custom - Kubernetes Auth Mount Path, you must now specify the full mount path; cert-manager - appends `/login` automatically. Default changed from `kubernetes` to `/v1/auth/kubernetes`.', - 'Order resource fields made immutable; if you have automation that mutates - these fields after creation, it will now fail and must be updated.', '`CertificateRequest.spec.csr` - is now required by schema; any manifests missing it (for CRs you create - directly) will be rejected.'] + chart_updates: + - Webhook component deployment was redesigned to no longer rely on an `APIService`, + reducing risk of cluster-wide issues if the webhook is unavailable. + - Multi-architecture image support is now automatic via Docker manifest lists + (no need for arch-specific images/manifests). + - Improved ACME Challenge diagnostics; more information surfaced on Challenge + resources (`kubectl describe challenge ...`). + - 'Various bug fixes: PSP compatibility, OwnerReferencesPermissionEnforcement + admission controller compatibility, leader election signal handling, and solver/docs + fixes.' + - 'Defaults/behavioral tweaks: webhook listen address default changed to **10250** + for better GKE private cluster compatibility.' + - 'Schema/validation tightened: `CertificateRequest.spec.csr` marked required; + additional API resource validation for `status` subresource; immutability + enforced on multiple Order fields.' + features: + - Automatic multi-architecture image selection using Docker manifest lists (arm/arm64 + etc.) without changing manifests. + - Much better debugging for ACME authorization failures via richer status/details + on Challenge resources. + - Webhook simplified (no `APIService`) and now includes support for CRD API + conversion groundwork for future v1beta1. + - Cloudflare issuer supports API token authentication. + - Certificates now include `serverAuth` extended key usage by default. + breaking_changes: + - '**Vault Kubernetes auth path change:** if you set a custom Kubernetes Auth + Mount Path, you must now specify the full mount path; cert-manager appends + `/login` automatically. Default changed from `kubernetes` to `/v1/auth/kubernetes`.' + - Order resource fields made immutable; if you have automation that mutates + these fields after creation, it will now fail and must be updated. + - '`CertificateRequest.spec.csr` is now required by schema; any manifests missing + it (for CRs you create directly) will be rejected.' chart_version: 0.12.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.12.0', 'quay.io/jetstack/cert-manager-controller:v0.12.0', - 'quay.io/jetstack/cert-manager-webhook:v0.12.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.12.0 + - quay.io/jetstack/cert-manager-controller:v0.12.0 + - quay.io/jetstack/cert-manager-webhook:v0.12.0 - version: 0.11.0 - kube: ['1.9'] + kube: + - '1.9' requirements: [] incompatibilities: [] summary: null chart_version: 0.11.0 - images: ['quay.io/jetstack/cert-manager-cainjector:v0.11.0', 'quay.io/jetstack/cert-manager-controller:v0.11.0', - 'quay.io/jetstack/cert-manager-webhook:v0.11.0'] + images: + - quay.io/jetstack/cert-manager-cainjector:v0.11.0 + - quay.io/jetstack/cert-manager-controller:v0.11.0 + - quay.io/jetstack/cert-manager-webhook:v0.11.0 name: cert-manager - icon: https://avatars.githubusercontent.com/u/21054566?s=48&v=4 release_url: https://github.com/cilium/cilium/releases/tag/v{vsn} @@ -12877,7 +15271,10 @@ addons: eolApiSlug: cilium versions: - version: 1.20.1 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -12889,67 +15286,82 @@ addons: \ old behavior):**\n - Envoy route idle timeout behavior is restored to use\ \ `http-idle-timeout` as the source again; if you had workarounds/tuning around\ \ idle timeouts, re-validate after upgrade." - chart_updates: [ClusterMesh documentation and guidance is updated/overhauled - (Helm-first setup and cert configuration instructions)., Fix for ClusterMesh - MCS-API CRD install/upgrade race when `clustermesh-apiserver` starts before - the CRD version is present., 'Helm templating fix so `envoy.httpUpstreamLingerTimeout: - 0` is rendered into the ConfigMap.', Helm support added to pass through - `endpointPolicyUpdateTimeoutDuration`.] - features: [ClusterMesh documentation is substantially improved with Helm-first - setup and clearer certificate configuration guidance., Faster recovery for - disrupted TCP connections when accessing DSR-enabled Services (improves - resiliency/perceived reliability).] + chart_updates: + - ClusterMesh documentation and guidance is updated/overhauled (Helm-first setup + and cert configuration instructions). + - Fix for ClusterMesh MCS-API CRD install/upgrade race when `clustermesh-apiserver` + starts before the CRD version is present. + - 'Helm templating fix so `envoy.httpUpstreamLingerTimeout: 0` is rendered into + the ConfigMap.' + - Helm support added to pass through `endpointPolicyUpdateTimeoutDuration`. + features: + - ClusterMesh documentation is substantially improved with Helm-first setup + and clearer certificate configuration guidance. + - Faster recovery for disrupted TCP connections when accessing DSR-enabled Services + (improves resiliency/perceived reliability). breaking_changes: [] chart_version: 1.20.1 images: [] - version: 1.20.0 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Gateway API updates: moves to Gateway API v1.6.1 with new/expanded - capabilities including ListenerSets (delegated listeners), BackendTLSPolicy, - TCPRoute/UDPRoute, ExternalAuth filter, CORS and additional redirect codes, - and configurable gRPC-web translation.', Extensible datapath via datapath - plugins for cloud providers to extend/instrument eBPF datapath without forking - Cilium., '`bpf.datapathMode=auto` can automatically select netkit on supported - kernels and fall back to veth (default remains veth).', 'Egress Gateway - improvements: explicit IPv6 egress IP support and IPv4 traffic honors policy-selected - interface like IPv6.', 'BGP improvements: new Hive shell commands and clearer - peer output; control plane updates to GoBGP v4.6.1 with route-policy reconciliation - optimizations.', 'IPAM enhancements: AWS ENI IPAM supports IPv6 prefixes - (beta); migration path from cluster-pool IPAM to multi-pool IPAM without - rebuild.', NodePort can dynamically select preferred source address using - kernel FIB on supported kernels., New `preferIpv6` option applies consistently - to health probes and Hubble peer communication., 'Service/ClusterMesh features: - topology-aware traffic distribution hints (PreferSameZone/PreferSameNode), - weighted Maglev backends via EndpointSlice annotation, more VXLAN per-Service - LB mode options, and stable MCS API support.', 'Security/encryption: improved - ztunnel identity management (internal CA or SPIRE) with new metrics; support - for Kubernetes ClusterNetworkPolicy (KCNP); ICMPv6 unreachable responses - on IPv6 policy denies; new `cluster-mesh` policy entity; AWS VPC group policies - transformed into CiliumCIDRGroup; per-pod source IP verification control - via annotation guarded by namespace opt-in.', 'Day-2/observability: configuration - drift metric (unapplied ConfigMap settings), startup time/resource-sync - metrics, Hubble correlates policy responsible for audit verdicts, standalone - DNS proxy metrics exported through Cilium.', 'Performance/scale: aggregated - load-balancer state for shared backends, more efficient Envoy updates via - ADS/Delta xDS, optimized BPF policy map encoding, and significantly smaller - cilium-cni binary.', 'Updated foundations: Kubernetes v1.36, Envoy v1.37.x, - Gateway API v1.6.1, MCS API v0.5.2, Ubuntu 26.04 base images, and default - CNI config version from 0.3.1 to 1.0.0.'] - breaking_changes: ['Upgrade may require manual action if you use legacy Mutual - Authentication, Envoy Go extensions, Kafka-aware policies, `cilium.io/v2alpha1` - CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration - (see Cilium 1.20 upgrade guide).', 'Default CNI configuration version changes - from 0.3.1 to 1.0.0, which can affect clusters using custom CNI config management - or validating CNI config schema/format.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Gateway API updates: moves to Gateway API v1.6.1 with new/expanded capabilities + including ListenerSets (delegated listeners), BackendTLSPolicy, TCPRoute/UDPRoute, + ExternalAuth filter, CORS and additional redirect codes, and configurable + gRPC-web translation.' + - Extensible datapath via datapath plugins for cloud providers to extend/instrument + eBPF datapath without forking Cilium. + - '`bpf.datapathMode=auto` can automatically select netkit on supported kernels + and fall back to veth (default remains veth).' + - 'Egress Gateway improvements: explicit IPv6 egress IP support and IPv4 traffic + honors policy-selected interface like IPv6.' + - 'BGP improvements: new Hive shell commands and clearer peer output; control + plane updates to GoBGP v4.6.1 with route-policy reconciliation optimizations.' + - 'IPAM enhancements: AWS ENI IPAM supports IPv6 prefixes (beta); migration + path from cluster-pool IPAM to multi-pool IPAM without rebuild.' + - NodePort can dynamically select preferred source address using kernel FIB + on supported kernels. + - New `preferIpv6` option applies consistently to health probes and Hubble peer + communication. + - 'Service/ClusterMesh features: topology-aware traffic distribution hints (PreferSameZone/PreferSameNode), + weighted Maglev backends via EndpointSlice annotation, more VXLAN per-Service + LB mode options, and stable MCS API support.' + - 'Security/encryption: improved ztunnel identity management (internal CA or + SPIRE) with new metrics; support for Kubernetes ClusterNetworkPolicy (KCNP); + ICMPv6 unreachable responses on IPv6 policy denies; new `cluster-mesh` policy + entity; AWS VPC group policies transformed into CiliumCIDRGroup; per-pod source + IP verification control via annotation guarded by namespace opt-in.' + - 'Day-2/observability: configuration drift metric (unapplied ConfigMap settings), + startup time/resource-sync metrics, Hubble correlates policy responsible for + audit verdicts, standalone DNS proxy metrics exported through Cilium.' + - 'Performance/scale: aggregated load-balancer state for shared backends, more + efficient Envoy updates via ADS/Delta xDS, optimized BPF policy map encoding, + and significantly smaller cilium-cni binary.' + - 'Updated foundations: Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, + MCS API v0.5.2, Ubuntu 26.04 base images, and default CNI config version from + 0.3.1 to 1.0.0.' + breaking_changes: + - Upgrade may require manual action if you use legacy Mutual Authentication, + Envoy Go extensions, Kafka-aware policies, `cilium.io/v2alpha1` CiliumNodeConfig + API, the libnetwork integration, or a custom CNI configuration (see Cilium + 1.20 upgrade guide). + - Default CNI configuration version changes from 0.3.1 to 1.0.0, which can affect + clusters using custom CNI config management or validating CNI config schema/format. chart_version: 1.20.0 images: [] - version: 1.19.4 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -12966,72 +15378,88 @@ addons: - **Helm chart enhancement**: You can now **override external images** used by the charts (useful for private registries / air-gapped installs).' - chart_updates: ['Cilium Agent and service reflectors now filter `EndpointSlice` - watches by the `service.kubernetes.io/service-proxy-name` label when `--k8s-service-proxy-name` - is configured, aligning `EndpointSlice` and `Service` filtering behavior.', - Chart now avoids setting the operator health port as `hostPort` unless `hostNetwork` - is enabled., Chart allows overriding external images referenced by the Helm - charts (helps with mirroring images).] - features: [EndpointSlice watch filtering now matches Service filtering when - `k8s-service-proxy-name` is used; this reduces unnecessary watch traffic - but requires correct labeling on manually managed EndpointSlices., iptables - masquerading with `enable-masquerade-to-route-source` now sorts routes by - mask length to respect longest-prefix match (more correct source selection)., - SPIRE client settings for ztunnel can now be configured (better flexibility - for service-mesh-style deployments).] - breaking_changes: ['Behavioral change when `k8s-service-proxy-name` is set: - EndpointSlices missing `service.kubernetes.io/service-proxy-name` may be - ignored, which can break Services backed by manually created EndpointSlices.', - 'If you depended on the operator health port being exposed via `hostPort` - while `hostNetwork` was disabled, that exposure no longer happens by default - in this chart version.'] + chart_updates: + - Cilium Agent and service reflectors now filter `EndpointSlice` watches by + the `service.kubernetes.io/service-proxy-name` label when `--k8s-service-proxy-name` + is configured, aligning `EndpointSlice` and `Service` filtering behavior. + - Chart now avoids setting the operator health port as `hostPort` unless `hostNetwork` + is enabled. + - Chart allows overriding external images referenced by the Helm charts (helps + with mirroring images). + features: + - EndpointSlice watch filtering now matches Service filtering when `k8s-service-proxy-name` + is used; this reduces unnecessary watch traffic but requires correct labeling + on manually managed EndpointSlices. + - iptables masquerading with `enable-masquerade-to-route-source` now sorts routes + by mask length to respect longest-prefix match (more correct source selection). + - SPIRE client settings for ztunnel can now be configured (better flexibility + for service-mesh-style deployments). + breaking_changes: + - 'Behavioral change when `k8s-service-proxy-name` is set: EndpointSlices missing + `service.kubernetes.io/service-proxy-name` may be ignored, which can break + Services backed by manually created EndpointSlices.' + - If you depended on the operator health port being exposed via `hostPort` while + `hostNetwork` was disabled, that exposure no longer happens by default in + this chart version. chart_version: 1.19.4 images: [] - version: 1.19.0 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Helm charts are now published to OCI registries, including - `quay.io/cilium/charts/cilium` (in addition to prior distribution methods).', - 'Cilium CLI/Helm preflight no longer includes Envoy ConfigMaps, which may - change what preflight validates in upgrades.'] - features: ['Helm charts are available via OCI registry (`quay.io/cilium/charts/cilium`), - aligning with the 1.18.6 change to publish charts to OCI registries.', 'NetworkPolicy - enhancements: multi-level DNS wildcard prefixes (`**.`), new host firewall - protocol matches (VRRP/IGMP), optional ICMP unreachable on denies, and defaulting - unspecified cluster selectors to local cluster only.', 'Encryption additions: - strict modes for IPsec/WireGuard (drop unencrypted inter-node traffic), - Ztunnel namespace enrollment (beta) for transparent TCP encryption/authentication, - and IPsec support for BPF host routing.', 'Networking improvements: BIG - TCP over UDP tunnels (VXLAN/Geneve), TCP-based PLPMTUD, IPv6 tunnel underlay, - Multi-Pool IPAM promoted to Stable and extended to more modes, and more - configurable masquerade (exclude IPAM pools, cross-subnet options).', 'Services/Gateway: - IPv6 ND advertisements for L2 announcements, IPv6 service loopback, and - Gateway API GAMMA support for GRPCRoute plus HTTPRoute.', 'BGP updates: - new interface-based advertisements, optional withdraw of routes with 0 endpoints, - configurable source IP via `sourceInterface`, and migration to v2 APIs.', - 'Observability: trace packets using IP Options, hubble CLI filters for encrypted/unencrypted - flows, and policy-name tagging for drop events.', 'Operations: TLS/mTLS - for operator Prometheus metrics, auto-install MCS CRDs, and streamlined - cert generation for Cluster Mesh/Hubble; core deps updated (Kubernetes v1.35, - Envoy v1.35, Gateway API v1.4, GoBGP v3.37).'] - breaking_changes: ['BGP: `CiliumBGPPeeringPolicy` v1 API support is removed; - manifests must be migrated to the v2 (`cilium.io/v2`) APIs.', 'NetworkPolicy - behavior change: selectors that do not explicitly specify a cluster now - default to allow only the local cluster, which can reduce previously-allowed - cross-cluster traffic in Cluster Mesh setups.', 'NetworkPolicy deprecations: - Kafka protocol match fields (beta) and `ToRequires`/`FromRequires` fields - are deprecated; plan to remove/replace usage before they are dropped in - a future release.', Mutual Authentication is now disabled by default; environments - relying on it for mTLS must explicitly re-enable it or migrate to Ztunnel., - Encryption strict mode (if enabled) will drop unencrypted inter-node traffic; - ensure all nodes are correctly enrolled/compatible before turning it on.] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm charts are now published to OCI registries, including `quay.io/cilium/charts/cilium` + (in addition to prior distribution methods). + - Cilium CLI/Helm preflight no longer includes Envoy ConfigMaps, which may change + what preflight validates in upgrades. + features: + - Helm charts are available via OCI registry (`quay.io/cilium/charts/cilium`), + aligning with the 1.18.6 change to publish charts to OCI registries. + - 'NetworkPolicy enhancements: multi-level DNS wildcard prefixes (`**.`), new + host firewall protocol matches (VRRP/IGMP), optional ICMP unreachable on denies, + and defaulting unspecified cluster selectors to local cluster only.' + - 'Encryption additions: strict modes for IPsec/WireGuard (drop unencrypted + inter-node traffic), Ztunnel namespace enrollment (beta) for transparent TCP + encryption/authentication, and IPsec support for BPF host routing.' + - 'Networking improvements: BIG TCP over UDP tunnels (VXLAN/Geneve), TCP-based + PLPMTUD, IPv6 tunnel underlay, Multi-Pool IPAM promoted to Stable and extended + to more modes, and more configurable masquerade (exclude IPAM pools, cross-subnet + options).' + - 'Services/Gateway: IPv6 ND advertisements for L2 announcements, IPv6 service + loopback, and Gateway API GAMMA support for GRPCRoute plus HTTPRoute.' + - 'BGP updates: new interface-based advertisements, optional withdraw of routes + with 0 endpoints, configurable source IP via `sourceInterface`, and migration + to v2 APIs.' + - 'Observability: trace packets using IP Options, hubble CLI filters for encrypted/unencrypted + flows, and policy-name tagging for drop events.' + - 'Operations: TLS/mTLS for operator Prometheus metrics, auto-install MCS CRDs, + and streamlined cert generation for Cluster Mesh/Hubble; core deps updated + (Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, GoBGP v3.37).' + breaking_changes: + - 'BGP: `CiliumBGPPeeringPolicy` v1 API support is removed; manifests must be + migrated to the v2 (`cilium.io/v2`) APIs.' + - 'NetworkPolicy behavior change: selectors that do not explicitly specify a + cluster now default to allow only the local cluster, which can reduce previously-allowed + cross-cluster traffic in Cluster Mesh setups.' + - 'NetworkPolicy deprecations: Kafka protocol match fields (beta) and `ToRequires`/`FromRequires` + fields are deprecated; plan to remove/replace usage before they are dropped + in a future release.' + - Mutual Authentication is now disabled by default; environments relying on + it for mTLS must explicitly re-enable it or migrate to Ztunnel. + - Encryption strict mode (if enabled) will drop unencrypted inter-node traffic; + ensure all nodes are correctly enrolled/compatible before turning it on. chart_version: 1.19.0 images: [] - version: 1.18.10 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -13044,50 +15472,63 @@ addons: \ distribution method.\n- No explicit value renames/removals are mentioned\ \ in the provided notes; treat this as a patch upgrade and focus on image/tag/digest\ \ updates and any new optional knobs around external images." - chart_updates: ['Helm chart enhancement: allow overriding of external images - in charts (useful for air-gapped / private-registry environments).', 'Operational/documentation - update: added documentation and warnings on DNS interception (review if - you use DNS proxy/interception features).', Various dependency and base-image - updates; image digests updated for the patch release (ensure your deployment - uses the intended v1.18.10 images/digests).] - features: ['Helm chart can now override external/ancillary images, improving - compatibility with private registries and image allowlists.', Additional - documentation/warnings around DNS interception to reduce misconfiguration - risk.] + chart_updates: + - 'Helm chart enhancement: allow overriding of external images in charts (useful + for air-gapped / private-registry environments).' + - 'Operational/documentation update: added documentation and warnings on DNS + interception (review if you use DNS proxy/interception features).' + - Various dependency and base-image updates; image digests updated for the patch + release (ensure your deployment uses the intended v1.18.10 images/digests). + features: + - Helm chart can now override external/ancillary images, improving compatibility + with private registries and image allowlists. + - Additional documentation/warnings around DNS interception to reduce misconfiguration + risk. breaking_changes: [] chart_version: 1.18.10 - images: ['quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3', - 'quay.io/cilium/cilium:v1.18.10@sha256:dd573bc2f7213dbd978e564a363ecaad060e9578ed557b92b53e42eeeb0f2294', - 'quay.io/cilium/operator-generic:v1.18.10@sha256:ab08d58fd12e98d9a9601d4b52beee839ff2537fba73d262aabad222454a16b3'] + images: + - quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3 + - quay.io/cilium/cilium:v1.18.10@sha256:dd573bc2f7213dbd978e564a363ecaad060e9578ed557b92b53e42eeeb0f2294 + - quay.io/cilium/operator-generic:v1.18.10@sha256:ab08d58fd12e98d9a9601d4b52beee839ff2537fba73d262aabad222454a16b3 - version: 1.18.6 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm charts are now published to OCI registries (in addition - to existing distribution methods)., 'Preflight check no longer includes - Envoy ConfigMaps, simplifying running preflight in clusters where Envoy - configmaps caused issues/false positives.', Runtime image now includes `libatomic1` - to satisfy a `cilium-envoy` dependency., Operator Secret sync now re-synchronizes - synced Secrets after 1 hour (periodic resync behavior)., Fixes a regression - in the new services control plane where `loadBalancerSourceRanges` was incorrectly - applied by default to all Service types., 'WireGuard + L7 proxy: installs - ingress proxy routes correctly; and delivers host packets to `bpf_host` - for ingress policies.'] - features: ['Helm charts can be consumed from OCI registries, enabling standard - `helm pull oci://...` workflows and easier mirroring in private registries.', - 'CiliumNetworkPolicy `egressDeny` has added documentation/examples (policy - authoring aid, not a functional breaking change by itself).', Hubble BPF - supports policy verdicts from L3 devices (improves visibility in certain - L3 device paths).] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm charts are now published to OCI registries (in addition to existing distribution + methods). + - Preflight check no longer includes Envoy ConfigMaps, simplifying running preflight + in clusters where Envoy configmaps caused issues/false positives. + - Runtime image now includes `libatomic1` to satisfy a `cilium-envoy` dependency. + - Operator Secret sync now re-synchronizes synced Secrets after 1 hour (periodic + resync behavior). + - Fixes a regression in the new services control plane where `loadBalancerSourceRanges` + was incorrectly applied by default to all Service types. + - 'WireGuard + L7 proxy: installs ingress proxy routes correctly; and delivers + host packets to `bpf_host` for ingress policies.' + features: + - Helm charts can be consumed from OCI registries, enabling standard `helm pull + oci://...` workflows and easier mirroring in private registries. + - CiliumNetworkPolicy `egressDeny` has added documentation/examples (policy + authoring aid, not a functional breaking change by itself). + - Hubble BPF supports policy verdicts from L3 devices (improves visibility in + certain L3 device paths). breaking_changes: [] chart_version: 1.18.6 - images: ['quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86', - 'quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4', - 'quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af'] + images: + - quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86 + - quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4 + - quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af - version: 1.18.2 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -13104,76 +15545,96 @@ addons: chart/packaging). ' - chart_updates: [Cilium Operator includes an additional toleration for `node.cloudprovider.kubernetes.io/uninitialized` - (improves scheduling during cloud-provider init)., 'API-server load reduction: - unnecessary headless Service watching is disabled when not using Gateway - API/Ingress features (behavioral change aimed at reducing apiserver load).', - 'LB IPAM stability improvements: operator restart or pool selector/CIDR widening - no longer triggers LoadBalancer IP reallocations.', 'Envoy behavior: listeners - are served only after clusters have been ACKed (helps avoid transient traffic - failures during xDS convergence).'] - features: ['BGP Control Plane v2: configurable BGP **origin attribute** for - LoadBalancer IPs to ease migration from MetalLB integration.', 'Operational - efficiency: reduced kube-apiserver watch load in clusters not using Gateway - API/Ingress by avoiding unnecessary headless service watching.'] - breaking_changes: ['Policy validation is stricter: namespaced `CiliumNetworkPolicy` - objects with `nodeSelector` inside a `specs[]` entry are now **rejected** - (previously accepted but ignored). This can break installs that unknowingly - relied on the old behavior; fix policies before/with the upgrade.'] + chart_updates: + - Cilium Operator includes an additional toleration for `node.cloudprovider.kubernetes.io/uninitialized` + (improves scheduling during cloud-provider init). + - 'API-server load reduction: unnecessary headless Service watching is disabled + when not using Gateway API/Ingress features (behavioral change aimed at reducing + apiserver load).' + - 'LB IPAM stability improvements: operator restart or pool selector/CIDR widening + no longer triggers LoadBalancer IP reallocations.' + - 'Envoy behavior: listeners are served only after clusters have been ACKed + (helps avoid transient traffic failures during xDS convergence).' + features: + - 'BGP Control Plane v2: configurable BGP **origin attribute** for LoadBalancer + IPs to ease migration from MetalLB integration.' + - 'Operational efficiency: reduced kube-apiserver watch load in clusters not + using Gateway API/Ingress by avoiding unnecessary headless service watching.' + breaking_changes: + - 'Policy validation is stricter: namespaced `CiliumNetworkPolicy` objects with + `nodeSelector` inside a `specs[]` entry are now **rejected** (previously accepted + but ignored). This can break installs that unknowingly relied on the old behavior; + fix policies before/with the upgrade.' chart_version: 1.18.2 - images: ['quay.io/cilium/cilium-envoy:v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324@sha256:7932d656b63f6f866b6732099d33355184322123cfe1182e6f05175a3bc2e0e0', - 'quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667', - 'quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805'] + images: + - quay.io/cilium/cilium-envoy:v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324@sha256:7932d656b63f6f866b6732099d33355184322123cfe1182e6f05175a3bc2e0e0 + - quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667 + - quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805 - version: 1.18.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Service load-balancing control-plane redesigned to reduce agent memory - usage and provide a better foundation for future load-balancing features., - "Support added for new virtual network device configurations (e.g., VXLAN-in-IPsec\ - \ \u201CVinE\u201D and IPIP tunnels).", 'Egress Gateway policies can now - select multiple gateway nodes for a single policy, enabling HA/scale-out - egress.', Bandwidth manager adds ingress rate limiting support., L2 pod - announcement can announce from multiple network devices., Neighbor subsystem - reworked with reconciliation between desired neighbor entries and kernel - state to improve resilience., 'IPv6 tunneling datapath supports IPv6 underlay, - including with IPsec transparent encryption; kube-proxy replacement also - supports IPv6 underlay service translation.', Delegated IPAM can configure - IPv6 routes when the delegated plugin supports IPv6; ordered IPv6 fragments - are now processed for policy/routing; egress gateway CIDR matching supports - IPv6 ranges., 'Hubble/hubble-cli improvements: policy names shown in flows, - a new free-text policy log field is exposed in flows, and encapsulated traffic - decoding improves observability.', ClusterMesh adds an option to restrict - the "cluster" entity to the local cluster only; Grafana policy dashboards - improved., Operational improvements include better kube-apiserver connection - handling at scale and optional ConfigMap sync into the agent with drift - metrics., 'Several CRDs promoted to stable: CiliumCIDRGroup, CiliumLoadBalancerIPPool, - and all BGP CRDs; Gateway API support bumped to v1.3.0 with new CiliumGatewayClassConfig - and improved reconciliation.', IPAM enhancements include AWS ENI prefix - delegation on bare metal and multi-pool IPAM support in external KVStore - mode and with IPsec/tunnel routing., 'BGP enhancements include route aggregation, - overlapping selector matches in CiliumBGPAdvertisement, and new router-id - generation modes.', 'Performance improvements include faster policy/service - processing at scale, smaller arm64 images, optimized egress gateway matching, - and batched CT map GC.'] - breaking_changes: ['Minimum supported Linux kernel for the 1.18 release series - is now 5.10 (or equivalent, e.g., RHEL 8.6); clusters with older kernels - must upgrade nodes before upgrading Cilium.', The local unix-socket Policy - REST API is deprecated; prefer Kubernetes CRDs or filesystem-based policy - mechanisms going forward., 'Some underused features are deprecated (Custom - Calls, Recorder API, External Workloads); if you rely on them, plan migration - before they are removed in a future release.', 'Cilium dependencies were - updated (Kubernetes v1.33, Envoy v1.34, LLVM 19.1, CNI v1.1), which can - surface compatibility constraints with older clusters or custom integrations.'] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Service load-balancing control-plane redesigned to reduce agent memory usage + and provide a better foundation for future load-balancing features. + - "Support added for new virtual network device configurations (e.g., VXLAN-in-IPsec\ + \ \u201CVinE\u201D and IPIP tunnels)." + - Egress Gateway policies can now select multiple gateway nodes for a single + policy, enabling HA/scale-out egress. + - Bandwidth manager adds ingress rate limiting support. + - L2 pod announcement can announce from multiple network devices. + - Neighbor subsystem reworked with reconciliation between desired neighbor entries + and kernel state to improve resilience. + - IPv6 tunneling datapath supports IPv6 underlay, including with IPsec transparent + encryption; kube-proxy replacement also supports IPv6 underlay service translation. + - Delegated IPAM can configure IPv6 routes when the delegated plugin supports + IPv6; ordered IPv6 fragments are now processed for policy/routing; egress + gateway CIDR matching supports IPv6 ranges. + - 'Hubble/hubble-cli improvements: policy names shown in flows, a new free-text + policy log field is exposed in flows, and encapsulated traffic decoding improves + observability.' + - ClusterMesh adds an option to restrict the "cluster" entity to the local cluster + only; Grafana policy dashboards improved. + - Operational improvements include better kube-apiserver connection handling + at scale and optional ConfigMap sync into the agent with drift metrics. + - 'Several CRDs promoted to stable: CiliumCIDRGroup, CiliumLoadBalancerIPPool, + and all BGP CRDs; Gateway API support bumped to v1.3.0 with new CiliumGatewayClassConfig + and improved reconciliation.' + - IPAM enhancements include AWS ENI prefix delegation on bare metal and multi-pool + IPAM support in external KVStore mode and with IPsec/tunnel routing. + - BGP enhancements include route aggregation, overlapping selector matches in + CiliumBGPAdvertisement, and new router-id generation modes. + - Performance improvements include faster policy/service processing at scale, + smaller arm64 images, optimized egress gateway matching, and batched CT map + GC. + breaking_changes: + - Minimum supported Linux kernel for the 1.18 release series is now 5.10 (or + equivalent, e.g., RHEL 8.6); clusters with older kernels must upgrade nodes + before upgrading Cilium. + - The local unix-socket Policy REST API is deprecated; prefer Kubernetes CRDs + or filesystem-based policy mechanisms going forward. + - Some underused features are deprecated (Custom Calls, Recorder API, External + Workloads); if you rely on them, plan migration before they are removed in + a future release. + - Cilium dependencies were updated (Kubernetes v1.33, Envoy v1.34, LLVM 19.1, + CNI v1.1), which can surface compatibility constraints with older clusters + or custom integrations. chart_version: 1.18.0 - images: ['quay.io/cilium/cilium-envoy:v1.34.4-1753677767-266d5a01d1d55bd1d60148f991b98dac0390d363@sha256:231b5bd9682dfc648ae97f33dcdc5225c5a526194dda08124f5eded833bf02bf', - 'quay.io/cilium/cilium:v1.18.0@sha256:dfea023972d06ec183cfa3c9e7809716f85daaff042e573ef366e9ec6a0c0ab2', - 'quay.io/cilium/operator-generic:v1.18.0@sha256:398378b4507b6e9db22be2f4455d8f8e509b189470061b0f813f0fabaf944f51'] + images: + - quay.io/cilium/cilium-envoy:v1.34.4-1753677767-266d5a01d1d55bd1d60148f991b98dac0390d363@sha256:231b5bd9682dfc648ae97f33dcdc5225c5a526194dda08124f5eded833bf02bf + - quay.io/cilium/cilium:v1.18.0@sha256:dfea023972d06ec183cfa3c9e7809716f85daaff042e573ef366e9ec6a0c0ab2 + - quay.io/cilium/operator-generic:v1.18.0@sha256:398378b4507b6e9db22be2f4455d8f8e509b189470061b0f813f0fabaf944f51 - version: 1.17.16 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -13187,57 +15648,73 @@ addons: \ registries / air-gapped setups). If you currently pin/override images, review\ \ chart values for new/expanded image override options (introduced via `helm:\ \ allow overriding of external images in charts`)." - chart_updates: [Security hardening/behavior fix around LRP addressMatcher to - avoid overriding Service frontends by default (opt-in legacy override flag - available)., 'IPsec robustness: prevent panic in `parseSPI` on malformed - input.', 'Cluster-pool IPAM: register additional metrics for CiliumNode - synchronization with Kubernetes.', 'Static pod identity: fix endpoint identity - resolution when CNI pod UID differs from Kubernetes mirror pod UID.', 'Dependency - updates: OpenTelemetry to 1.41.0; x/net to v0.53; various base image and - action dependency bumps; envoy image updates.', 'CI/build plumbing: registry - configurability, workflow runner tweaks, cert-manager pull via OCI for clustermesh - CI.', 'Release artifact refresh: updated image digests across Cilium components - (agent, operator variants, hubble-relay, clustermesh-apiserver, etc.).'] - features: ["Helm chart can publish/use OCI registries (not new to 1.17.16 but\ - \ relevant since you\u2019re coming from 1.17.12 which introduced it).", - 'Helm chart now allows overriding of external images, improving support for - private registries and controlled supply chains.', New/expanded cluster-pool - IPAM metrics around CiliumNode sync help with observability of IPAM state - propagation.] - breaking_changes: [Local Redirect Policy (LRP) addressMatcher no longer overrides - an existing Service frontend by default. Environments that depended on that - override behavior must explicitly enable it via `--enable-lrp-address-matcher-override=true` - (otherwise traffic steering may change).] + chart_updates: + - Security hardening/behavior fix around LRP addressMatcher to avoid overriding + Service frontends by default (opt-in legacy override flag available). + - 'IPsec robustness: prevent panic in `parseSPI` on malformed input.' + - 'Cluster-pool IPAM: register additional metrics for CiliumNode synchronization + with Kubernetes.' + - 'Static pod identity: fix endpoint identity resolution when CNI pod UID differs + from Kubernetes mirror pod UID.' + - 'Dependency updates: OpenTelemetry to 1.41.0; x/net to v0.53; various base + image and action dependency bumps; envoy image updates.' + - 'CI/build plumbing: registry configurability, workflow runner tweaks, cert-manager + pull via OCI for clustermesh CI.' + - 'Release artifact refresh: updated image digests across Cilium components + (agent, operator variants, hubble-relay, clustermesh-apiserver, etc.).' + features: + - "Helm chart can publish/use OCI registries (not new to 1.17.16 but relevant\ + \ since you\u2019re coming from 1.17.12 which introduced it)." + - Helm chart now allows overriding of external images, improving support for + private registries and controlled supply chains. + - New/expanded cluster-pool IPAM metrics around CiliumNode sync help with observability + of IPAM state propagation. + breaking_changes: + - Local Redirect Policy (LRP) addressMatcher no longer overrides an existing + Service frontend by default. Environments that depended on that override behavior + must explicitly enable it via `--enable-lrp-address-matcher-override=true` + (otherwise traffic steering may change). chart_version: 1.17.16 - images: ['quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3', - 'quay.io/cilium/cilium:v1.17.16@sha256:4efb37b791561bc5a2c6d746bdd6f52a9c393623d2426e8c0877cc389610477c', - 'quay.io/cilium/operator-generic:v1.17.16@sha256:42955931dd62c9c2ea906d78eed0b651b22e70d59cd4877381f57bb98e4a09ae'] + images: + - quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3 + - quay.io/cilium/cilium:v1.17.16@sha256:4efb37b791561bc5a2c6d746bdd6f52a9c393623d2426e8c0877cc389610477c + - quay.io/cilium/operator-generic:v1.17.16@sha256:42955931dd62c9c2ea906d78eed0b651b22e70d59cd4877381f57bb98e4a09ae eolAt: '2026-07-29' - version: 1.17.12 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Helm charts are now published to OCI registries; release process/registry\ - \ details changed (also noted as \u201Crelease: change OCI registry\u201D\ - ).", Image digests and dependent component images updated as part of patch - releases.] - features: [Helm charts are now published to OCI registries (may require changing - how you fetch/install the chart if you previously used the Helm repo URL)., - Documentation/examples added for using the `egressDeny` field in `CiliumNetworkPolicy`., - BPF Hubble gains support for policy verdicts from L3 devices (noted under - other changes)., CNI plugins dependency bumped to v1.9.0 (internal/packaged - dependency update)., 'Route handling: ingress proxy routes are installed - when using WireGuard + L7 proxy (behavioral improvement).'] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Helm charts are now published to OCI registries; release process/registry\ + \ details changed (also noted as \u201Crelease: change OCI registry\u201D\ + )." + - Image digests and dependent component images updated as part of patch releases. + features: + - Helm charts are now published to OCI registries (may require changing how + you fetch/install the chart if you previously used the Helm repo URL). + - Documentation/examples added for using the `egressDeny` field in `CiliumNetworkPolicy`. + - BPF Hubble gains support for policy verdicts from L3 devices (noted under + other changes). + - CNI plugins dependency bumped to v1.9.0 (internal/packaged dependency update). + - 'Route handling: ingress proxy routes are installed when using WireGuard + + L7 proxy (behavioral improvement).' breaking_changes: [] chart_version: 1.17.12 - images: ['quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f', - 'quay.io/cilium/cilium:v1.17.12@sha256:f525e12698149b3958024599493d9cc56fadbc46c9250cbced8016e9b9b679e5', - 'quay.io/cilium/operator-generic:v1.17.12@sha256:0b675406b1e43b198962d4f9c3a5ba6bb68fc98836cba05b224860109112f6d9'] + images: + - quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f + - quay.io/cilium/cilium:v1.17.12@sha256:f525e12698149b3958024599493d9cc56fadbc46c9250cbced8016e9b9b679e5 + - quay.io/cilium/operator-generic:v1.17.12@sha256:0b675406b1e43b198962d4f9c3a5ba6bb68fc98836cba05b224860109112f6d9 eolAt: '2026-07-29' - version: 1.17.8 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -13251,35 +15728,44 @@ addons: - **Packaging/templating:** v1.17.8 includes support for downstream packagers\ \ to **extend `cilium-agent` `dnsPolicy`**. This is primarily relevant if\ \ you vendor/patch the chart; most users won\u2019t change values for this." - chart_updates: ['Cilium Agent liveness probe behavior changed: it no longer - fails solely due to Kubernetes API server unreachability (helps avoid agent - restarts during apiserver downtime).', 'Gateway API robustness: reconciler - handles missing TLSRoute CRD more gracefully and fixes parentRef matching - logic.', 'Envoy/xDS reliability: fixes cases where updated resources were - not sent to Envoy; in v1.17.8, Envoy starts serving listeners only after - clusters are ACKed (reduces race conditions on rollout).', 'Kernel compatibility: - fix for pre-v5.7 kernels where LocalRedirectPolicy could trigger BPF verifier - rejection.', 'NAT/masquerade robustness: improvements to NAT LRU fallback - paths; addresses flakes and should reduce edge-case failures under pressure.', - 'Various datapath fixes: NodePort NAT46x64 clash avoidance, ipip MTU fix, - device controller netfilter dependency fix, WireGuard overlay cleanup, IPSec - key derivation hardening, and deadlock/panic fixes around missing IPv4 and - ipset reconciliation.', 'Policy correctness: fixes for invalid CNP/CCNP - status reporting and an important fix where L7 rules could override `enableDefaultDeny: - false` and incorrectly drop traffic.'] - features: ['Adds new WireGuard observability points (`TRACE_FROM/TO_CRYPTO`) - and BPF metrics for packets to/from WireGuard, improving troubleshooting/monitoring.', - 'GAMMA (Gateway API for Mesh Management and Administration) reconciler can - now attach multiple HTTPRoutes to the same Service, expanding Gateway API - routing flexibility.'] + chart_updates: + - 'Cilium Agent liveness probe behavior changed: it no longer fails solely due + to Kubernetes API server unreachability (helps avoid agent restarts during + apiserver downtime).' + - 'Gateway API robustness: reconciler handles missing TLSRoute CRD more gracefully + and fixes parentRef matching logic.' + - 'Envoy/xDS reliability: fixes cases where updated resources were not sent + to Envoy; in v1.17.8, Envoy starts serving listeners only after clusters are + ACKed (reduces race conditions on rollout).' + - 'Kernel compatibility: fix for pre-v5.7 kernels where LocalRedirectPolicy + could trigger BPF verifier rejection.' + - 'NAT/masquerade robustness: improvements to NAT LRU fallback paths; addresses + flakes and should reduce edge-case failures under pressure.' + - 'Various datapath fixes: NodePort NAT46x64 clash avoidance, ipip MTU fix, + device controller netfilter dependency fix, WireGuard overlay cleanup, IPSec + key derivation hardening, and deadlock/panic fixes around missing IPv4 and + ipset reconciliation.' + - 'Policy correctness: fixes for invalid CNP/CCNP status reporting and an important + fix where L7 rules could override `enableDefaultDeny: false` and incorrectly + drop traffic.' + features: + - Adds new WireGuard observability points (`TRACE_FROM/TO_CRYPTO`) and BPF metrics + for packets to/from WireGuard, improving troubleshooting/monitoring. + - GAMMA (Gateway API for Mesh Management and Administration) reconciler can + now attach multiple HTTPRoutes to the same Service, expanding Gateway API + routing flexibility. breaking_changes: [] chart_version: 1.17.8 - images: ['quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28', - 'quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636', - 'quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c'] + images: + - quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28 + - quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636 + - quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c eolAt: '2026-07-29' - version: 1.17.4 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -13293,69 +15779,88 @@ addons: to 1.17.4 should reduce config collisions. ' - chart_updates: [Hubble dynamic metrics Helm templating/config conflict fix landed - (v1.17.4)., 'Kafka-related Helm default/value updated: `kafka.apiKey=true` - (v1.17.4).'] - features: [(1.17.0) Pod egress QoS via annotations for traffic priority (Guaranteed/Burstable/BestEffort)., - (1.17.0) Kubernetes Multi-Cluster Services (MCS) API support for global services - in ClusterMesh., (1.17.0) L4 protocol-based service load balancing (differentiate - TCP vs UDP on same port) plus per-service LB algorithm selection (maglev/random)., - (1.17.0) IPAM enhancements (AWS tag-based static allocation; multi-pool improvements) - and dynamic MTU detection without agent restart., '(1.17.0) Observability - upgrades: new Hubble metrics ConfigMap workflow and new Prometheus metrics - exposing enabled features.'] + chart_updates: + - Hubble dynamic metrics Helm templating/config conflict fix landed (v1.17.4). + - 'Kafka-related Helm default/value updated: `kafka.apiKey=true` (v1.17.4).' + features: + - (1.17.0) Pod egress QoS via annotations for traffic priority (Guaranteed/Burstable/BestEffort). + - (1.17.0) Kubernetes Multi-Cluster Services (MCS) API support for global services + in ClusterMesh. + - (1.17.0) L4 protocol-based service load balancing (differentiate TCP vs UDP + on same port) plus per-service LB algorithm selection (maglev/random). + - (1.17.0) IPAM enhancements (AWS tag-based static allocation; multi-pool improvements) + and dynamic MTU detection without agent restart. + - '(1.17.0) Observability upgrades: new Hubble metrics ConfigMap workflow and + new Prometheus metrics exposing enabled features.' breaking_changes: [] chart_version: 1.17.4 - images: ['quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182', - 'quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a', - 'quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5'] + images: + - quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182 + - quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a + - quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5 eolAt: '2026-07-29' - version: 1.17.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Quality of Service for egress: pod annotations can set egress priority - (Guaranteed/Burstable/BestEffort) to influence traffic handling.', Multi-Cluster - Service (MCS) API support for Cluster Mesh to manage global services across - clusters., 'L4 protocol-aware load balancing: can distinguish TCP vs UDP - (and similar) on the same port to route to different backends.', 'Per-Service - load-balancing algorithm selection (e.g., Maglev vs random) on a per-service - basis.', LoadBalancer source ranges can be treated as deny lists instead - of only allow lists., 'Improved IPAM controls: support static allocation - via AWS tags and improved multi-pool handling of single IP ranges.', 'Dynamic - MTU detection: agent adapts to runtime MTU changes without restart.', 'Network - policy performance improvements for complex policy combinations, reducing - CPU cost.', CiliumEndpointSlices can prioritize critical namespaces using - Kubernetes priorityNamespaces to speed endpoint propagation., Better NetworkPolicy - validation feedback via Kubernetes (more/better validation)., CIDRGroups - can be labeled and selected by label in network policies., 'ToServices policy - enhancements: services with selectors can be targeted by ToServices rules.', - FQDN/L7 filtering for hostNetwork via CiliumClusterwideNetworkPolicy for node-originated - DNS traffic., HTTP L7 policies can apply to port ranges (multiple ports - redirected to Envoy)., Gateway API support updated to v1.2.1 including HTTP - retries and mirror fractions., 'Static gateway addressing: allow statically - specifying gateway addresses.', 'Improved Envoy TLS handling via SDS, speeding - policy calculation and improving secrets access for TLS visibility.', Dynamic - Hubble metrics configuration via a hubble-metrics-config ConfigMap., 'New - Prometheus metrics exposing which features are enabled in cilium-agent and - cilium-operator; plus many new metrics across BGP, connections, policy, - and component health.', cilium-health tuned for more reliable high-scale - connectivity checks., Rate-limited monitor events to balance eBPF event - volume vs CPU usage., Double-Write Identity mode to ease migration between - CRD and KVStore identity backends.] - breaking_changes: [No explicit breaking changes were included in the provided - release-note excerpts; review the full v1.17.0 CHANGELOG.md for any required - config/behavior changes before upgrading.] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Quality of Service for egress: pod annotations can set egress priority (Guaranteed/Burstable/BestEffort) + to influence traffic handling.' + - Multi-Cluster Service (MCS) API support for Cluster Mesh to manage global + services across clusters. + - 'L4 protocol-aware load balancing: can distinguish TCP vs UDP (and similar) + on the same port to route to different backends.' + - Per-Service load-balancing algorithm selection (e.g., Maglev vs random) on + a per-service basis. + - LoadBalancer source ranges can be treated as deny lists instead of only allow + lists. + - 'Improved IPAM controls: support static allocation via AWS tags and improved + multi-pool handling of single IP ranges.' + - 'Dynamic MTU detection: agent adapts to runtime MTU changes without restart.' + - Network policy performance improvements for complex policy combinations, reducing + CPU cost. + - CiliumEndpointSlices can prioritize critical namespaces using Kubernetes priorityNamespaces + to speed endpoint propagation. + - Better NetworkPolicy validation feedback via Kubernetes (more/better validation). + - CIDRGroups can be labeled and selected by label in network policies. + - 'ToServices policy enhancements: services with selectors can be targeted by + ToServices rules.' + - FQDN/L7 filtering for hostNetwork via CiliumClusterwideNetworkPolicy for node-originated + DNS traffic. + - HTTP L7 policies can apply to port ranges (multiple ports redirected to Envoy). + - Gateway API support updated to v1.2.1 including HTTP retries and mirror fractions. + - 'Static gateway addressing: allow statically specifying gateway addresses.' + - Improved Envoy TLS handling via SDS, speeding policy calculation and improving + secrets access for TLS visibility. + - Dynamic Hubble metrics configuration via a hubble-metrics-config ConfigMap. + - New Prometheus metrics exposing which features are enabled in cilium-agent + and cilium-operator; plus many new metrics across BGP, connections, policy, + and component health. + - cilium-health tuned for more reliable high-scale connectivity checks. + - Rate-limited monitor events to balance eBPF event volume vs CPU usage. + - Double-Write Identity mode to ease migration between CRD and KVStore identity + backends. + breaking_changes: + - No explicit breaking changes were included in the provided release-note excerpts; + review the full v1.17.0 CHANGELOG.md for any required config/behavior changes + before upgrading. chart_version: 1.17.0 - images: ['quay.io/cilium/cilium-envoy:v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e@sha256:57a3aa6355a3223da360395e3a109802867ff635cb852aa0afe03ec7bf04e545', - 'quay.io/cilium/cilium:v1.17.0@sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d', - 'quay.io/cilium/operator-generic:v1.17.0@sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8'] + images: + - quay.io/cilium/cilium-envoy:v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e@sha256:57a3aa6355a3223da360395e3a109802867ff635cb852aa0afe03ec7bf04e545 + - quay.io/cilium/cilium:v1.17.0@sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d + - quay.io/cilium/operator-generic:v1.17.0@sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8 eolAt: '2026-07-29' - version: 1.16.19 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: @@ -13365,18 +15870,24 @@ addons: \ install`) depending on your current workflow.\n - Note: the release notes\ \ don\u2019t list specific `values.yaml` key changes between 1.16.15 and 1.16.19;\ \ verify with `helm diff` against your current values." - chart_updates: [Helm charts are now published to OCI registries (v1.16.19).] - features: [Helm chart publishing to OCI registries (distribution/consumption - improvement)., Documentation/examples added for using `egressDeny` in `CiliumNetworkPolicy`., - CNI plugins bumped to v1.9.0 (packaged dependency update).] + chart_updates: + - Helm charts are now published to OCI registries (v1.16.19). + features: + - Helm chart publishing to OCI registries (distribution/consumption improvement). + - Documentation/examples added for using `egressDeny` in `CiliumNetworkPolicy`. + - CNI plugins bumped to v1.9.0 (packaged dependency update). breaking_changes: [] chart_version: 1.16.19 - images: ['quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f', - 'quay.io/cilium/cilium:v1.16.19@sha256:f0c260e30ef97ce3e45e833e702ab47efbbb1dadd0a394969c0a65553e98fefb', - 'quay.io/cilium/operator-generic:v1.16.19@sha256:8879e792c5566f6349b5f2865e07c0dd690eb32638afc4417b51b0ec574fa5f0'] + images: + - quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f + - quay.io/cilium/cilium:v1.16.19@sha256:f0c260e30ef97ce3e45e833e702ab47efbbb1dadd0a394969c0a65553e98fefb + - quay.io/cilium/operator-generic:v1.16.19@sha256:8879e792c5566f6349b5f2865e07c0dd690eb32638afc4417b51b0ec574fa5f0 eolAt: '2026-02-03' - version: 1.16.15 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -13388,23 +15899,29 @@ addons: \ Kafka L7 policy behavior after the upgrade.\n\n> Note: This summary only\ \ reflects what was included in the text you provided; it does not include\ \ any additional Helm chart changelog entries." - chart_updates: [v1.16.15 is mostly CI/build/release tooling and dependency churn; - no chart-facing feature changes were highlighted in the provided notes., - 'v1.16.15 includes an Envoy behavior fix: listeners are served only after - clusters have been ACKed, which can affect L7/LB readiness timing in practice.', - v1.16.15 fixes a kernel verifier rejection on pre-5.7 kernels when LocalRedirectPolicy - is enabled (stability fix for older kernels).] - features: ['Envoy now delays serving listeners until clusters have been ACKed, - improving correctness during (re)configuration and potentially reducing - transient L7 failures during rollout.'] + chart_updates: + - v1.16.15 is mostly CI/build/release tooling and dependency churn; no chart-facing + feature changes were highlighted in the provided notes. + - 'v1.16.15 includes an Envoy behavior fix: listeners are served only after + clusters have been ACKed, which can affect L7/LB readiness timing in practice.' + - v1.16.15 fixes a kernel verifier rejection on pre-5.7 kernels when LocalRedirectPolicy + is enabled (stability fix for older kernels). + features: + - Envoy now delays serving listeners until clusters have been ACKed, improving + correctness during (re)configuration and potentially reducing transient L7 + failures during rollout. breaking_changes: [] chart_version: 1.16.15 - images: ['quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28', - 'quay.io/cilium/cilium:v1.16.15@sha256:c0fa87d70a7ba624fbe581d40a7b7e9e8773a6efd4bb17d0bd14ff854039ec75', - 'quay.io/cilium/operator-generic:v1.16.15@sha256:fea37022f858272c27cefe6b4959d45e2ca03d957decbfa210ce35931f346ecd'] + images: + - quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28 + - quay.io/cilium/cilium:v1.16.15@sha256:c0fa87d70a7ba624fbe581d40a7b7e9e8773a6efd4bb17d0bd14ff854039ec75 + - quay.io/cilium/operator-generic:v1.16.15@sha256:fea37022f858272c27cefe6b4959d45e2ca03d957decbfa210ce35931f346ecd eolAt: '2026-02-03' - version: 1.16.10 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -13414,23 +15931,29 @@ addons: after upgrade. ' - chart_updates: ['Daemon status reporting changed: `cilium status` is now independent - of Kubernetes status (agent/daemon-side behavior change).', "Hubble/Helm\ - \ related robustness: Hubble peer-service endpoint uses an absolute FQDN\ - \ (already present by 1.16.5, but relevant if you\u2019re comparing older\ - \ installs)."] - features: ['Operational improvement: `cilium status` no longer depends on Kubernetes - status, which can make troubleshooting clearer when the apiserver is degraded.', - 'Improved policy feedback: invalid CiliumNetworkPolicy / CiliumClusterwideNetworkPolicy - rules are now correctly reported as invalid.'] + chart_updates: + - 'Daemon status reporting changed: `cilium status` is now independent of Kubernetes + status (agent/daemon-side behavior change).' + - "Hubble/Helm related robustness: Hubble peer-service endpoint uses an absolute\ + \ FQDN (already present by 1.16.5, but relevant if you\u2019re comparing older\ + \ installs)." + features: + - 'Operational improvement: `cilium status` no longer depends on Kubernetes + status, which can make troubleshooting clearer when the apiserver is degraded.' + - 'Improved policy feedback: invalid CiliumNetworkPolicy / CiliumClusterwideNetworkPolicy + rules are now correctly reported as invalid.' breaking_changes: [] chart_version: 1.16.10 - images: ['quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182', - 'quay.io/cilium/cilium:v1.16.10@sha256:fc4ccc494c4a381439162fd3684c07ba9c26d3c2670a2b2e1623acee99097461', - 'quay.io/cilium/operator-generic:v1.16.10@sha256:05e5f5e676aa51ae5e3bf6be3594ecf52958f46f07f9f55368a7a952012a13c1'] + images: + - quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182 + - quay.io/cilium/cilium:v1.16.10@sha256:fc4ccc494c4a381439162fd3684c07ba9c26d3c2670a2b2e1623acee99097461 + - quay.io/cilium/operator-generic:v1.16.10@sha256:05e5f5e676aa51ae5e3bf6be3594ecf52958f46f07f9f55368a7a952012a13c1 eolAt: '2026-02-03' - version: 1.16.5 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -13458,33 +15981,41 @@ addons: - **CronJob appArmorProfile template condition fix (1.16.1).** No values change required, but if you use that CronJob + AppArmor, confirm manifests render as expected.' - chart_updates: ['Deprecation: Providing Hubble TLS secrets directly in Helm - values is deprecated; update your installation approach accordingly.', 'Chart/templating: - Added Gateway API required labels/annotations and fixed internal listener - reference qualification (namespace + CEC name).', 'Chart options: Added - NAT map stats interval/entries configuration fields.', 'Chart options: Added - imagePullSecrets support for SPIRE agent/server pods.', 'Chart behavior: - Hubble peer-service endpoint is rendered as an absolute FQDN to avoid incorrect - DNS resolution.', 'Templating: Fixed CronJob AppArmor profile condition - rendering.'] - features: ['Gateway API support gets additional required labels/annotations - and better handling of internal listener references, improving correctness - in multi-namespace/CEC scenarios.', 'Optional new tuning knobs were added - for NAT map statistics reporting (interval/entries), useful for observability/performance - tuning.', 'SPIRE components can now be configured with imagePullSecrets, - simplifying private registry use cases.'] - breaking_changes: ['Hubble TLS secrets provided directly via Helm values are - now deprecated; while not an immediate hard break, you should migrate before - it becomes unsupported in a future release.', 'Hubble no longer builds 32-bit - binaries (1.16.5). If you run Hubble components on 32-bit architectures, - this is effectively breaking.'] + chart_updates: + - 'Deprecation: Providing Hubble TLS secrets directly in Helm values is deprecated; + update your installation approach accordingly.' + - 'Chart/templating: Added Gateway API required labels/annotations and fixed + internal listener reference qualification (namespace + CEC name).' + - 'Chart options: Added NAT map stats interval/entries configuration fields.' + - 'Chart options: Added imagePullSecrets support for SPIRE agent/server pods.' + - 'Chart behavior: Hubble peer-service endpoint is rendered as an absolute FQDN + to avoid incorrect DNS resolution.' + - 'Templating: Fixed CronJob AppArmor profile condition rendering.' + features: + - Gateway API support gets additional required labels/annotations and better + handling of internal listener references, improving correctness in multi-namespace/CEC + scenarios. + - Optional new tuning knobs were added for NAT map statistics reporting (interval/entries), + useful for observability/performance tuning. + - SPIRE components can now be configured with imagePullSecrets, simplifying + private registry use cases. + breaking_changes: + - Hubble TLS secrets provided directly via Helm values are now deprecated; while + not an immediate hard break, you should migrate before it becomes unsupported + in a future release. + - Hubble no longer builds 32-bit binaries (1.16.5). If you run Hubble components + on 32-bit architectures, this is effectively breaking. chart_version: 1.16.5 - images: ['quay.io/cilium/cilium-envoy:v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8@sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced', - 'quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d', - 'quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039'] + images: + - quay.io/cilium/cilium-envoy:v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8@sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced + - quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d + - quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039 eolAt: '2026-02-03' - version: 1.16.1 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -13508,29 +16039,37 @@ addons: \ configurable for agent/server pods** (1.16.1).\n - If you run SPIRE integration\ \ and pull from private registries, you can now set imagePullSecrets for those\ \ pods via Helm values.\n" - chart_updates: ['Gateway API manifests: add required labels and annotations - (metadata changes).', 'Helm templates: fix appArmorProfile conditional in - CronJob template.', 'Helm: expose NAT map stats interval/entries as configurable - values.', 'Helm: add support to configure imagePullSecrets for SPIRE agent/server - pods.', 'Helm/docs: improve Hubble TLS configuration guidance; deprecate - value-driven TLS secret provisioning.'] - features: ['Security fixes: 1.16.1 addresses two published advisories (GHSA-vwf8-q6fw-4wcm, - GHSA-qcm3-7879-xcww).', 'Operational tuning: Helm can now configure NAT - map stats interval/entries for better observability/tuning of NAT map behavior.', - 'SPIRE integration: chart now supports setting imagePullSecrets for SPIRE - agent/server pods (useful for private registries).', 'Gateway API: required - labels/annotations added and route sorting now considers HTTP method conditions - for more correct routing behavior.'] - breaking_changes: ['Deprecation: Providing Hubble TLS secrets via Helm values - is deprecated in 1.16.1; future chart versions may remove this path, so - migrate to Kubernetes Secrets/references now.'] + chart_updates: + - 'Gateway API manifests: add required labels and annotations (metadata changes).' + - 'Helm templates: fix appArmorProfile conditional in CronJob template.' + - 'Helm: expose NAT map stats interval/entries as configurable values.' + - 'Helm: add support to configure imagePullSecrets for SPIRE agent/server pods.' + - 'Helm/docs: improve Hubble TLS configuration guidance; deprecate value-driven + TLS secret provisioning.' + features: + - 'Security fixes: 1.16.1 addresses two published advisories (GHSA-vwf8-q6fw-4wcm, + GHSA-qcm3-7879-xcww).' + - 'Operational tuning: Helm can now configure NAT map stats interval/entries + for better observability/tuning of NAT map behavior.' + - 'SPIRE integration: chart now supports setting imagePullSecrets for SPIRE + agent/server pods (useful for private registries).' + - 'Gateway API: required labels/annotations added and route sorting now considers + HTTP method conditions for more correct routing behavior.' + breaking_changes: + - 'Deprecation: Providing Hubble TLS secrets via Helm values is deprecated in + 1.16.1; future chart versions may remove this path, so migrate to Kubernetes + Secrets/references now.' chart_version: 1.16.1 - images: ['quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b', - 'quay.io/cilium/cilium:v1.16.1@sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39', - 'quay.io/cilium/operator-generic:v1.16.1@sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4'] + images: + - quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b + - quay.io/cilium/cilium:v1.16.1@sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39 + - quay.io/cilium/operator-generic:v1.16.1@sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4 eolAt: '2026-02-03' - version: 1.16.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -13543,45 +16082,56 @@ addons: \ your rendered manifests (`helm template`) against current to catch any renamed/removed\ \ values (especially around Envoy, Gateway API, and ClusterMesh/KVStoreMesh\ \ defaults)." - chart_updates: ['Cilium 1.16.0 introduces/expands features across networking, - BGP, Gateway API/Ingress, policy, operations, and Hubble observability.', - 'No chart-structure changes are explicitly called out in the supplied notes, - but behavior may change due to new defaults (notably Envoy deployment model - for new installs, and ClusterMesh KVStoreMesh default).'] - features: [Cilium NetKit to improve container-network throughput/latency closer - to host networking performance., 'BGPv2 with a new API, plus BGP advertisement - support for ExternalIP and ClusterIP services.', Kubernetes 1.30 Service - Traffic Distribution can be configured via Service spec (not annotations)., - 'Local Redirect Policy is promoted to Stable for redirecting service traffic - to local backends (e.g., node-local DNS).', Multicast datapath support for - defining multicast groups in Cilium., Per-pod fixed MAC address support., - 'Gateway API enhancements: GAMMA support (east-west), Gateway API 1.1 support, - and ExternalTrafficPolicy support for Ingress/Gateway API.', Envoy proxy - can run as a dedicated DaemonSet (separate lifecycle); enabled by default - for new installs., CiliumEnvoyConfig now supports nodeSelector to target - specific nodes., 'Network policy improvements: port ranges, validation status - in `kubectl describe`, per-policy control of default-deny behavior, CIDRGroups - in egress/deny, loading default policies from filesystem, and node-based - selectors (ToNodes/FromNodes).', 'Operational improvements: new ELF loader - logic reduces median memory usage; improved DNS-based policy performance; - KVStoreMesh becomes the default ClusterMesh deployment option.', 'Hubble/observability - improvements: CEL flow filters, improved HTTP metrics, improved BPF map - pressure metrics, more egress-path observability metrics, k8s event generation - on packet drops, and filtering flows by node labels.'] - breaking_changes: ['The supplied 1.16.0 release-notes excerpt does not explicitly - list breaking changes. Treat the following as **potential behavior changes - to validate** during upgrade testing: KVStoreMesh becoming the default for - ClusterMesh deployments, and the move to a dedicated Envoy DaemonSet being - default for new installs (may affect how you manage/upgrade Envoy if you - adopt it). Review the full v1.16.0 CHANGELOG.md for any explicit breaking - changes that apply to your deployment.'] + chart_updates: + - Cilium 1.16.0 introduces/expands features across networking, BGP, Gateway + API/Ingress, policy, operations, and Hubble observability. + - No chart-structure changes are explicitly called out in the supplied notes, + but behavior may change due to new defaults (notably Envoy deployment model + for new installs, and ClusterMesh KVStoreMesh default). + features: + - Cilium NetKit to improve container-network throughput/latency closer to host + networking performance. + - BGPv2 with a new API, plus BGP advertisement support for ExternalIP and ClusterIP + services. + - Kubernetes 1.30 Service Traffic Distribution can be configured via Service + spec (not annotations). + - Local Redirect Policy is promoted to Stable for redirecting service traffic + to local backends (e.g., node-local DNS). + - Multicast datapath support for defining multicast groups in Cilium. + - Per-pod fixed MAC address support. + - 'Gateway API enhancements: GAMMA support (east-west), Gateway API 1.1 support, + and ExternalTrafficPolicy support for Ingress/Gateway API.' + - Envoy proxy can run as a dedicated DaemonSet (separate lifecycle); enabled + by default for new installs. + - CiliumEnvoyConfig now supports nodeSelector to target specific nodes. + - 'Network policy improvements: port ranges, validation status in `kubectl describe`, + per-policy control of default-deny behavior, CIDRGroups in egress/deny, loading + default policies from filesystem, and node-based selectors (ToNodes/FromNodes).' + - 'Operational improvements: new ELF loader logic reduces median memory usage; + improved DNS-based policy performance; KVStoreMesh becomes the default ClusterMesh + deployment option.' + - 'Hubble/observability improvements: CEL flow filters, improved HTTP metrics, + improved BPF map pressure metrics, more egress-path observability metrics, + k8s event generation on packet drops, and filtering flows by node labels.' + breaking_changes: + - 'The supplied 1.16.0 release-notes excerpt does not explicitly list breaking + changes. Treat the following as **potential behavior changes to validate** + during upgrade testing: KVStoreMesh becoming the default for ClusterMesh deployments, + and the move to a dedicated Envoy DaemonSet being default for new installs + (may affect how you manage/upgrade Envoy if you adopt it). Review the full + v1.16.0 CHANGELOG.md for any explicit breaking changes that apply to your + deployment.' chart_version: 1.16.0 - images: ['quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b', - 'quay.io/cilium/cilium:v1.16.0@sha256:46ffa4ef3cf6d8885dcc4af5963b0683f7d59daa90d49ed9fb68d3b1627fe058', - 'quay.io/cilium/operator-generic:v1.16.0@sha256:d6621c11c4e4943bf2998af7febe05be5ed6fdcf812b27ad4388f47022190316'] + images: + - quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b + - quay.io/cilium/cilium:v1.16.0@sha256:46ffa4ef3cf6d8885dcc4af5963b0683f7d59daa90d49ed9fb68d3b1627fe058 + - quay.io/cilium/operator-generic:v1.16.0@sha256:d6621c11c4e4943bf2998af7febe05be5ed6fdcf812b27ad4388f47022190316 eolAt: '2026-02-03' - version: 1.15.17 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -13590,19 +16140,25 @@ addons: \ set this value today, keep your current behavior by pinning it in `values.yaml`.\n\ \ - If you did **not** set it, expect behavior to follow the new default\ \ in 1.15.17; validate Kafka L7 policies/traffic in staging." - chart_updates: ['Helm chart defaults updated for Kafka (`apiKey: true`) in 1.15.17 - (may affect Kafka L7 policy behavior).'] - features: [No major new user-facing features called out in the provided notes; - this patch set is primarily bugfixes and dependency/image updates.] - breaking_changes: [Potential behavior change for Kafka L7 policy users due to - Helm default `apiKey` being set to `true` in 1.15.17 if you relied on the - previous default.] + chart_updates: + - 'Helm chart defaults updated for Kafka (`apiKey: true`) in 1.15.17 (may affect + Kafka L7 policy behavior).' + features: + - No major new user-facing features called out in the provided notes; this patch + set is primarily bugfixes and dependency/image updates. + breaking_changes: + - Potential behavior change for Kafka L7 policy users due to Helm default `apiKey` + being set to `true` in 1.15.17 if you relied on the previous default. chart_version: 1.15.17 - images: ['quay.io/cilium/cilium:v1.15.17@sha256:8824313a6f17d934b4e63902fee71e6ca36be6f69d68ae174df28f1b0705e587', - 'quay.io/cilium/operator-generic:v1.15.17@sha256:a0f5b5dc8cecd4e5ead7d3bddb3756e4b34beba8e7aa089e7e2fb761725defe1'] + images: + - quay.io/cilium/cilium:v1.15.17@sha256:8824313a6f17d934b4e63902fee71e6ca36be6f69d68ae174df28f1b0705e587 + - quay.io/cilium/operator-generic:v1.15.17@sha256:a0f5b5dc8cecd4e5ead7d3bddb3756e4b34beba8e7aa089e7e2fb761725defe1 eolAt: '2025-07-29' - version: 1.15.12 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -13628,24 +16184,32 @@ addons: If it errors, remove/rename the flagged deprecated values.' - chart_updates: [No chart-template changes were explicitly listed for 1.15.12 - in the provided excerpt (mostly CI/docs/dependency bumps)., '1.15.12 updates - image digests and bumps bundled dependencies (notably CNI plugins to v1.6.0, - Envoy image tags, Go patch version), which can affect runtime behavior only - insofar as bugfixes/security patches apply.'] - features: [cilium-health-ep controller made more robust against successive failures - (improves health endpoint/controller resilience)., Gateway API checks fixed - for namespace handling (improves correctness for Gateway API users).] - breaking_changes: ['No breaking changes were mentioned in the provided release - notes for the target patch release (1.15.12). Patch upgrades in the same - minor series are expected to be non-breaking, but Helm schema validation - may block upgrades if you still use removed/deprecated values.'] + chart_updates: + - No chart-template changes were explicitly listed for 1.15.12 in the provided + excerpt (mostly CI/docs/dependency bumps). + - 1.15.12 updates image digests and bumps bundled dependencies (notably CNI + plugins to v1.6.0, Envoy image tags, Go patch version), which can affect runtime + behavior only insofar as bugfixes/security patches apply. + features: + - cilium-health-ep controller made more robust against successive failures (improves + health endpoint/controller resilience). + - Gateway API checks fixed for namespace handling (improves correctness for + Gateway API users). + breaking_changes: + - No breaking changes were mentioned in the provided release notes for the target + patch release (1.15.12). Patch upgrades in the same minor series are expected + to be non-breaking, but Helm schema validation may block upgrades if you still + use removed/deprecated values. chart_version: 1.15.12 - images: ['quay.io/cilium/cilium:v1.15.12@sha256:d1793b67d976e1bc0a4ab01b34c94adfcd35a8be7612d04c6d618bf25f50f0d1', - 'quay.io/cilium/operator-generic:v1.15.12@sha256:e48d863367bfd39843917400aa7454ca6a4af74f995cf29a2edb81d7d13c7277'] + images: + - quay.io/cilium/cilium:v1.15.12@sha256:d1793b67d976e1bc0a4ab01b34c94adfcd35a8be7612d04c6d618bf25f50f0d1 + - quay.io/cilium/operator-generic:v1.15.12@sha256:e48d863367bfd39843917400aa7454ca6a4af74f995cf29a2edb81d7d13c7277 eolAt: '2025-07-29' - version: 1.15.8 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -13661,24 +16225,31 @@ addons: \ types for comparison\u201D indicates the chart became stricter about value\ \ types; keep booleans/ints/strings consistent with chart expectations to\ \ avoid template errors.\n" - chart_updates: ['Helm: add validation to block removed/deprecated values (upgrade - may now hard-fail on stale values).', 'Helm: cleanup deprecated attributes - and old Kubernetes version checks.', 'Helm: remove duplicate Envoy pod metrics - output.', 'Docs/values: allow setting DNS proxy socket linger timeout to - zero via Helm (enables explicitly disabling linger).'] - features: ['Hubble Relay is more resilient to transient errors, improving stability - in flaky network/control-plane conditions.', 'Gateway API routing improvements: - routes can be sorted with HTTP method conditions and react to ReferenceGrant - changes more reliably.'] - breaking_changes: [Helm upgrades may now fail if you still use values that were - previously deprecated and are now removed; you must remove/replace them - before upgrading.] + chart_updates: + - 'Helm: add validation to block removed/deprecated values (upgrade may now + hard-fail on stale values).' + - 'Helm: cleanup deprecated attributes and old Kubernetes version checks.' + - 'Helm: remove duplicate Envoy pod metrics output.' + - 'Docs/values: allow setting DNS proxy socket linger timeout to zero via Helm + (enables explicitly disabling linger).' + features: + - Hubble Relay is more resilient to transient errors, improving stability in + flaky network/control-plane conditions. + - 'Gateway API routing improvements: routes can be sorted with HTTP method conditions + and react to ReferenceGrant changes more reliably.' + breaking_changes: + - Helm upgrades may now fail if you still use values that were previously deprecated + and are now removed; you must remove/replace them before upgrading. chart_version: 1.15.8 - images: ['quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7', - 'quay.io/cilium/operator-generic:v1.15.8@sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18'] + images: + - quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7 + - quay.io/cilium/operator-generic:v1.15.8@sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18 eolAt: '2025-07-29' - version: 1.15.5 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -13712,36 +16283,47 @@ addons: \ comparison` \u2014 indicates some previously tolerated value type mismatches\ \ may have caused issues; ensure your values types match the chart expectations\ \ (strings vs bools vs ints).\n" - chart_updates: ['Chart now removes deprecated clustermesh CA configuration from - the Helm chart (if you relied on the old CA options, migrate to the supported - clustermesh CA/config approach).', "clustermesh-apiserver and kvstoremesh\ - \ images were merged into a single image in 1.15.0; verify your deployments/overrides\ - \ don\u2019t assume separate images.", 'Default metrics enablement changed: - operator and clustermesh/kvstore metrics are enabled by default in Helm - (may affect Prometheus scraping and RBAC).', Chart includes extraVolumeMounts - support for the cilium-config init container and a securityContext for SPIRE - pods (verify if you override these templates)., 'Ingress/Gateway features - and related Helm wiring expanded (e.g., trusted LB hops, proxy protocol - support, SSL passthrough annotation support).'] - features: [Dynamic flowlog exporters can now be configured via a YAML file (ConfigMap) - without restarting the agent., 'Gateway API support was extended up to v1.0, - including GRPCRoute support and additional Gateway API capabilities.', ClusterMesh - can be extended up to 511 clusters via `--max-connected-clusters=511` (with - identity-space tradeoffs)., 'BGP control plane enhancements: new routes - API/CLI commands and support for BGP MD5/passwords and advertised path attributes.', - 'Improved Hubble functionality (filters, redaction options, new dashboards/metrics) - and additional observability metrics across components.'] - breaking_changes: [Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` - were removed; upgrades will fail if they remain in your values., '`kubeProxyReplacement` - Helm value usage changed (no longer `strict`); adjust values to the current - expected type/value.', A deprecated tunnel option (and its Helm value) was - removed; remove/replace any legacy tunnel-related values before upgrading.] + chart_updates: + - Chart now removes deprecated clustermesh CA configuration from the Helm chart + (if you relied on the old CA options, migrate to the supported clustermesh + CA/config approach). + - "clustermesh-apiserver and kvstoremesh images were merged into a single image\ + \ in 1.15.0; verify your deployments/overrides don\u2019t assume separate\ + \ images." + - 'Default metrics enablement changed: operator and clustermesh/kvstore metrics + are enabled by default in Helm (may affect Prometheus scraping and RBAC).' + - Chart includes extraVolumeMounts support for the cilium-config init container + and a securityContext for SPIRE pods (verify if you override these templates). + - Ingress/Gateway features and related Helm wiring expanded (e.g., trusted LB + hops, proxy protocol support, SSL passthrough annotation support). + features: + - Dynamic flowlog exporters can now be configured via a YAML file (ConfigMap) + without restarting the agent. + - Gateway API support was extended up to v1.0, including GRPCRoute support and + additional Gateway API capabilities. + - ClusterMesh can be extended up to 511 clusters via `--max-connected-clusters=511` + (with identity-space tradeoffs). + - 'BGP control plane enhancements: new routes API/CLI commands and support for + BGP MD5/passwords and advertised path attributes.' + - Improved Hubble functionality (filters, redaction options, new dashboards/metrics) + and additional observability metrics across components. + breaking_changes: + - Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` + were removed; upgrades will fail if they remain in your values. + - '`kubeProxyReplacement` Helm value usage changed (no longer `strict`); adjust + values to the current expected type/value.' + - A deprecated tunnel option (and its Helm value) was removed; remove/replace + any legacy tunnel-related values before upgrading. chart_version: 1.15.5 - images: ['quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40', - 'quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8'] + images: + - quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40 + - quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8 eolAt: '2025-07-29' - version: 1.15.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -13773,45 +16355,59 @@ addons: \ affect Helm\n- **clustermesh-apiserver + kvstoremesh image merge**: the\ \ components were merged into a single image; verify your Helm values for\ \ image overrides, deployments, and metrics toggles if you run clustermesh/kvstoremesh.\n" - chart_updates: [Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` - removed (upgrade will fail if still set)., Deprecated tunnel Helm value - removed; must use routing-mode/tunnel-protocol style config., Helm chart - updated to use `strict=true` semantics for kubeProxyReplacement-related - configuration (avoid old enum-like settings)., SPIRE Helm values schema - changed to align with other image configuration patterns (verify any custom - SPIRE image overrides/securityContext)., Deprecated clustermesh CA configuration - removed from chart; use global CA config., Operator + clustermesh kvstore - metrics enabled by default via Helm; confirm your Prometheus scraping expectations., - clustermesh-apiserver and kvstoremesh consolidated into one image; validate - your clustermesh-related Helm values and upgrades.] - features: [Dynamic FlowLog exporters can be updated via a ConfigMap-backed YAML - file without restarting cilium-agent., 'Gateway API v1.0 support, including - GRPCRoute, plus multiple Gateway API controller improvements and startup - CRD checks.', ClusterMesh scalability increased up to 511 clusters via `--max-connected-clusters=511` - (with identity tradeoff)., 'BGP improvements including new `bgp/routes` - API endpoint, `cilium bgp routes` CLI, passwords/MD5 secret handling improvements, - and route policy tooling.', 'Observability enhancements: new Hubble dashboards, - more Hubble filtering (HTTP URLs/headers), and improved relay health/readiness - behavior.', Egress Gateway changed to BPF-based interface selection; `--install-egress-gateway-routes` - is no longer needed., 'Modularization and module health reporting improvements - in `cilium status`, plus more Prometheus metrics across components.'] - breaking_changes: ['If you set Helm values `enableK8sEventHandover` or `enableCnpStatusUpdates`, - the upgrade will break because these options and their corresponding agent/operator - flags were removed.', 'If you relied on the deprecated `tunnel` Helm/flag - configuration, it is removed; you must migrate to routing-mode/tunnel-protocol - configuration.', Egress Gateway no longer needs (and effectively deprecates) - the `--install-egress-gateway-routes` behavior; operational expectations - for route setup change., 'ClusterMesh 511-cluster mode is only for new clusters - and must be consistent across all clusters; enabling it reduces available - cluster-local identities to 32,768.', clustermesh-apiserver/kvstoremesh - packaging changed (single image); custom image overrides and deployment - assumptions may need adjustment.] + chart_updates: + - Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` + removed (upgrade will fail if still set). + - Deprecated tunnel Helm value removed; must use routing-mode/tunnel-protocol + style config. + - Helm chart updated to use `strict=true` semantics for kubeProxyReplacement-related + configuration (avoid old enum-like settings). + - SPIRE Helm values schema changed to align with other image configuration patterns + (verify any custom SPIRE image overrides/securityContext). + - Deprecated clustermesh CA configuration removed from chart; use global CA + config. + - Operator + clustermesh kvstore metrics enabled by default via Helm; confirm + your Prometheus scraping expectations. + - clustermesh-apiserver and kvstoremesh consolidated into one image; validate + your clustermesh-related Helm values and upgrades. + features: + - Dynamic FlowLog exporters can be updated via a ConfigMap-backed YAML file + without restarting cilium-agent. + - Gateway API v1.0 support, including GRPCRoute, plus multiple Gateway API controller + improvements and startup CRD checks. + - ClusterMesh scalability increased up to 511 clusters via `--max-connected-clusters=511` + (with identity tradeoff). + - BGP improvements including new `bgp/routes` API endpoint, `cilium bgp routes` + CLI, passwords/MD5 secret handling improvements, and route policy tooling. + - 'Observability enhancements: new Hubble dashboards, more Hubble filtering + (HTTP URLs/headers), and improved relay health/readiness behavior.' + - Egress Gateway changed to BPF-based interface selection; `--install-egress-gateway-routes` + is no longer needed. + - Modularization and module health reporting improvements in `cilium status`, + plus more Prometheus metrics across components. + breaking_changes: + - If you set Helm values `enableK8sEventHandover` or `enableCnpStatusUpdates`, + the upgrade will break because these options and their corresponding agent/operator + flags were removed. + - If you relied on the deprecated `tunnel` Helm/flag configuration, it is removed; + you must migrate to routing-mode/tunnel-protocol configuration. + - Egress Gateway no longer needs (and effectively deprecates) the `--install-egress-gateway-routes` + behavior; operational expectations for route setup change. + - ClusterMesh 511-cluster mode is only for new clusters and must be consistent + across all clusters; enabling it reduces available cluster-local identities + to 32,768. + - clustermesh-apiserver/kvstoremesh packaging changed (single image); custom + image overrides and deployment assumptions may need adjustment. chart_version: 1.15.0 - images: ['quay.io/cilium/cilium:v1.15.0@sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619', - 'quay.io/cilium/operator-generic:v1.15.0@sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79'] + images: + - quay.io/cilium/cilium:v1.15.0@sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619 + - quay.io/cilium/operator-generic:v1.15.0@sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79 eolAt: '2025-07-29' - version: 1.14.18 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -13822,23 +16418,30 @@ addons: \ (e.g., omit the value or use a small positive number), you can now explicitly\ \ set `0`.\n\nNo other Helm-values changes are called out in the notes you\ \ provided for 1.14.14 \u2192 1.14.18." - chart_updates: [No functional Helm chart template changes were called out in - the excerpts provided (most Helm-related items were CI/linting oriented)., - Image digests/tags advance to `v1.14.18` for all Cilium components; ensure - any private registry mirroring or allowlists are updated accordingly.] - features: ['No notable new user-facing features are highlighted in the provided - patch release notes; the focus is on bugfixes, dependency bumps, and minor - operational robustness improvements.', 'XDP: `cilium_calls_xdp` map is now - per-endpoint (internal change that may improve correctness/isolation for - some XDP datapath scenarios).'] - breaking_changes: ["None called out in the provided release note excerpts for\ - \ these patch versions (1.14.14 \u2192 1.14.18)."] + chart_updates: + - No functional Helm chart template changes were called out in the excerpts + provided (most Helm-related items were CI/linting oriented). + - Image digests/tags advance to `v1.14.18` for all Cilium components; ensure + any private registry mirroring or allowlists are updated accordingly. + features: + - No notable new user-facing features are highlighted in the provided patch + release notes; the focus is on bugfixes, dependency bumps, and minor operational + robustness improvements. + - 'XDP: `cilium_calls_xdp` map is now per-endpoint (internal change that may + improve correctness/isolation for some XDP datapath scenarios).' + breaking_changes: + - "None called out in the provided release note excerpts for these patch versions\ + \ (1.14.14 \u2192 1.14.18)." chart_version: 1.14.18 - images: ['quay.io/cilium/cilium:v1.14.18@sha256:a09bd4ee7345ccdb42679985bf3e5a696ad8416e31a70a3609129bc745804123', - 'quay.io/cilium/operator-generic:v1.14.18@sha256:f41a9f3d899e14ba34a9696e7327147cd9811fc563c255668d59658ad90aa69e'] + images: + - quay.io/cilium/cilium:v1.14.18@sha256:a09bd4ee7345ccdb42679985bf3e5a696ad8416e31a70a3609129bc745804123 + - quay.io/cilium/operator-generic:v1.14.18@sha256:f41a9f3d899e14ba34a9696e7327147cd9811fc563c255668d59658ad90aa69e eolAt: '2025-02-04' - version: 1.14.14 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -13849,43 +16452,56 @@ addons: _No other Helm values changes were mentioned in the provided notes for 1.14.14._' - chart_updates: ['Helm chart: allow configuring DNS proxy upstream socket linger - timeout to `0` (enables fully disabling the linger behavior via values).'] - features: ["Security fix included for advisory GHSA-q7w8-72mr-vpgw (upgrade\ - \ recommended even if you don\u2019t change config).", 'Improved resilience - in high node-churn clusters: agent can recover from stale nodeID mappings - that could lead to dropped IPsec traffic.', 'More accurate observability: - report correct drop reason when packets are dropped by `bpf_lxc`.'] + chart_updates: + - 'Helm chart: allow configuring DNS proxy upstream socket linger timeout to + `0` (enables fully disabling the linger behavior via values).' + features: + - "Security fix included for advisory GHSA-q7w8-72mr-vpgw (upgrade recommended\ + \ even if you don\u2019t change config)." + - 'Improved resilience in high node-churn clusters: agent can recover from stale + nodeID mappings that could lead to dropped IPsec traffic.' + - 'More accurate observability: report correct drop reason when packets are + dropped by `bpf_lxc`.' breaking_changes: [] chart_version: 1.14.14 - images: ['quay.io/cilium/cilium:v1.14.14@sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637', - 'quay.io/cilium/operator-generic:v1.14.14@sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2'] + images: + - quay.io/cilium/cilium:v1.14.14@sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637 + - quay.io/cilium/operator-generic:v1.14.14@sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2 eolAt: '2025-02-04' - version: 1.14.11 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Reduces BPF conntrack/NAT map pressure by skipping overlay traffic - in BPF SNAT processing, which can help stability under high connection churn - and in overlay/tunnel-heavy clusters.', 'Improves DNS proxy behavior, including - reserving ports that conflict with the transparent DNS proxy and fixing - timeouts/memory leak scenarios.', 'Envoy/L7 improvements: upstream connections - can be made unique per downstream when preserving original pod source IP, - plus additional Envoy configuration knobs (idle timeout, trusted XFF hops).', - Operational robustness fixes for cloud IPAM modes (ENI/Azure/Alibaba) including - correct route MTU selection and netlink retries during ENI device setup., - 'Operator/metrics and general reliability improvements (e.g., operator error/warn - metrics, reduced noisy logs, safer taint handling in chained CNI mode).'] + features: + - Reduces BPF conntrack/NAT map pressure by skipping overlay traffic in BPF + SNAT processing, which can help stability under high connection churn and + in overlay/tunnel-heavy clusters. + - Improves DNS proxy behavior, including reserving ports that conflict with + the transparent DNS proxy and fixing timeouts/memory leak scenarios. + - 'Envoy/L7 improvements: upstream connections can be made unique per downstream + when preserving original pod source IP, plus additional Envoy configuration + knobs (idle timeout, trusted XFF hops).' + - Operational robustness fixes for cloud IPAM modes (ENI/Azure/Alibaba) including + correct route MTU selection and netlink retries during ENI device setup. + - Operator/metrics and general reliability improvements (e.g., operator error/warn + metrics, reduced noisy logs, safer taint handling in chained CNI mode). breaking_changes: [] chart_version: 1.14.11 - images: ['quay.io/cilium/cilium:v1.14.11@sha256:2b2118042dc6efe88dbc40c78909b6afd72b369896782ce38d132435724ee269', - 'quay.io/cilium/operator-generic:v1.14.11@sha256:df76f71a06f1c681848bfa86fdd99243af593d33034c9e2057c6af969bc25109'] + images: + - quay.io/cilium/cilium:v1.14.11@sha256:2b2118042dc6efe88dbc40c78909b6afd72b369896782ce38d132435724ee269 + - quay.io/cilium/operator-generic:v1.14.11@sha256:df76f71a06f1c681848bfa86fdd99243af593d33034c9e2057c6af969bc25109 eolAt: '2025-02-04' - version: 1.14.6 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -13900,24 +16516,31 @@ addons: \ any custom `prometheus.metrics` formatting.\n- **SPIRE agent scheduling:**\ \ Adds a **default toleration** for SPIRE agent on control-plane nodes (only\ \ relevant if you deploy SPIRE/SPIFFE integration)." - chart_updates: [Envoy `ServiceMonitor` template typo + annotation fix (Prometheus - Operator users)., Chart validation/logic tightened for managed Kubernetes - toggles (GKE / AKS BYOCNI) to prevent invalid routing-mode combos., 'Improved - Helm/flag parsing for list-like metrics settings (e.g., `prometheus.metrics`).', - Default toleration added for SPIRE agent to run on control-plane nodes.] - features: ['Adds a `proxy_type` label to L7 proxy metrics, improving visibility - and filtering of L7 metrics.', Cilium DNS proxy can operate in a transparent - mode (`--dnsproxy-enable-transparent-mode`) so queries can use the original - pod IP as the source toward upstream DNS servers., 'Adds BGPv1 routes API - endpoint plus `cilium bgp routes` CLI command, and integrates it into `bugtool` - for easier troubleshooting.'] + chart_updates: + - Envoy `ServiceMonitor` template typo + annotation fix (Prometheus Operator + users). + - Chart validation/logic tightened for managed Kubernetes toggles (GKE / AKS + BYOCNI) to prevent invalid routing-mode combos. + - Improved Helm/flag parsing for list-like metrics settings (e.g., `prometheus.metrics`). + - Default toleration added for SPIRE agent to run on control-plane nodes. + features: + - Adds a `proxy_type` label to L7 proxy metrics, improving visibility and filtering + of L7 metrics. + - Cilium DNS proxy can operate in a transparent mode (`--dnsproxy-enable-transparent-mode`) + so queries can use the original pod IP as the source toward upstream DNS servers. + - Adds BGPv1 routes API endpoint plus `cilium bgp routes` CLI command, and integrates + it into `bugtool` for easier troubleshooting. breaking_changes: [] chart_version: 1.14.6 - images: ['quay.io/cilium/cilium:v1.14.6@sha256:37a49f1abb333279a9b802ee8a21c61cde9dd9138b5ac55f77bdfca733ba852a', - 'quay.io/cilium/operator-generic:v1.14.6@sha256:2f0bf8fb8362c7379f3bf95036b90ad5b67378ed05cd8eb0410c1afc13423848'] + images: + - quay.io/cilium/cilium:v1.14.6@sha256:37a49f1abb333279a9b802ee8a21c61cde9dd9138b5ac55f77bdfca733ba852a + - quay.io/cilium/operator-generic:v1.14.6@sha256:2f0bf8fb8362c7379f3bf95036b90ad5b67378ed05cd8eb0410c1afc13423848 eolAt: '2025-02-04' - version: 1.14.2 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -13950,26 +16573,33 @@ addons: - **`enableEndpointCRD` Helm option type changed from string to boolean.** If you had `' - chart_updates: ['1.14.2 is a patch release focused on stability: multiple IPsec - fixes, Gateway API fixes, NodePort datapath fixes, and smaller operational - improvements.', 'Minor Helm chart change in 1.14.2: fixes Envoy DaemonSet - log level handling when multiple verbose debug groups are configured.'] - features: ['Gateway API: support for additional/extended Gateway API features - (more complete feature coverage) compared to earlier 1.14.x.', 'Operational - visibility: `cilium status` now shows SPIRE connection information (helps - validate mutual-auth/SPIRE deployments).'] - breaking_changes: ["1.14.0 had a strong warning: do not upgrade to 1.14.0 if\ - \ you are using IPsec. For a 1.14.0 \u2192 1.14.2 target, treat IPsec as\ - \ a key risk area and ensure you land on 1.14.2 quickly (or upgrade directly\ - \ to 1.14.2).", 'Helm value type change: `enableEndpointCRD` changed from - string to boolean in 1.14.0; existing values files may fail template rendering - or silently misconfigure if not updated.'] + chart_updates: + - '1.14.2 is a patch release focused on stability: multiple IPsec fixes, Gateway + API fixes, NodePort datapath fixes, and smaller operational improvements.' + - 'Minor Helm chart change in 1.14.2: fixes Envoy DaemonSet log level handling + when multiple verbose debug groups are configured.' + features: + - 'Gateway API: support for additional/extended Gateway API features (more complete + feature coverage) compared to earlier 1.14.x.' + - 'Operational visibility: `cilium status` now shows SPIRE connection information + (helps validate mutual-auth/SPIRE deployments).' + breaking_changes: + - "1.14.0 had a strong warning: do not upgrade to 1.14.0 if you are using IPsec.\ + \ For a 1.14.0 \u2192 1.14.2 target, treat IPsec as a key risk area and ensure\ + \ you land on 1.14.2 quickly (or upgrade directly to 1.14.2)." + - 'Helm value type change: `enableEndpointCRD` changed from string to boolean + in 1.14.0; existing values files may fail template rendering or silently misconfigure + if not updated.' chart_version: 1.14.2 - images: ['quay.io/cilium/cilium:v1.14.2@sha256:6263f3a3d5d63b267b538298dbeb5ae87da3efacf09a2c620446c873ba807d35', - 'quay.io/cilium/operator-generic:v1.14.2@sha256:52f70250dea22e506959439a7c4ea31b10fe8375db62f5c27ab746e3a2af866d'] + images: + - quay.io/cilium/cilium:v1.14.2@sha256:6263f3a3d5d63b267b538298dbeb5ae87da3efacf09a2c620446c873ba807d35 + - quay.io/cilium/operator-generic:v1.14.2@sha256:52f70250dea22e506959439a7c4ea31b10fe8375db62f5c27ab746e3a2af866d eolAt: '2025-02-04' - version: 1.14.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -14012,92 +16642,113 @@ addons: \ CA handling improvements**\n - Chart adds support for specifying a CA bundle\ \ and allowing `caBundle` to come from a Secret.\n - Action: if you have\ \ custom PKI for webhooks/API services, review these new options.\n" - chart_updates: [Adds optional new component **kvstoremesh** and corresponding - Helm configuration to improve clustermesh scalability., 'Adds support for - deploying **Envoy (L7 proxy) as an independent DaemonSet**, decoupling it - from the agent for availability/performance/security benefits.', Helm chart - includes additional dashboards / dashboard integrations (Hubble dashboards - and sample dashboards integration)., 'Chart validation tightened: enabling - Ingress/Gateway API while L7 proxy disabled now fails fast (prevents broken - installs).', 'Various Helm cleanups: deprecated values removed/cleaned up; - clustermesh CA configuration deprecated in favor of global CA configuration; - TLS configuration simplified for clustermesh peers.', 'Adds service account - for nodeinit daemonset and other minor chart template fixes (e.g., indentation - fixes).'] - features: ['**Gateway API improvements**: adds TLSRoute support and supports - newer Gateway API versions (v0.6.x/v0.7.0 called out in notes).', '**L2 - announcements**: introduces L2 announcement functionality including gratuitous - ARP (gARP) pod announcements for on-LAN advertisement use cases.', '**WireGuard - enhancements**: adds host-to-host and load balancer traffic encryption capabilities.', - '**High-scale IPCache mode**: new mode designed for very large clustermeshes - (millions of pods), plus compatibility with encapsulation/DSR scenarios.', - '**mTLS policy authentication options**: adds `mtls-spiffe` as a CiliumNetworkPolicy - auth mode and related SPIRE integrations for cert rotation/identity delivery.', - '**CNI chaining improvements**: supports chaining with arbitrary CNI plugins - and changes how/when the CNI config file is managed for more reliable upgrades.', - '**IPv6 datapath enhancements**: BPF-based IPv6 masquerading and IPv4 BIG - TCP support (plus continued BIG TCP work).', "**Operational safety**: operator\ - \ can taint nodes when Cilium isn\u2019t running to prevent scheduling onto\ - \ unnetworked nodes; CNI conf no longer removed on agent shutdown to avoid\ - \ stuck pod deletions during upgrades."] - breaking_changes: ['**Hard stop for IPsec**: 1.14.0 release notes explicitly - warn not to upgrade when using IPsec; treat this as a blocking upgrade constraint.', - '**CLI/flags removals**: the deprecated `policy_trace` command is removed; - if you rely on it in runbooks/scripts, update them.', '**Hubble metrics - change**: the deprecated `pod-short` context option in Hubble metrics is - removed; dashboards/alerts depending on it need updating.', '**CNI config - management behavioral change**: Cilium now manages/overwrites the CNI config - by default; if you used to manually modify the CNI config file or rely on - other chained plugins, you must adjust (`cni.exclusive=false` and/or `cni.chainingTarget`) - to avoid unexpected overwrites.', '**Value type change**: `enableEndpointCRD` - Helm value changed from string to boolean; incorrect type may break templating - or behavior.'] + chart_updates: + - Adds optional new component **kvstoremesh** and corresponding Helm configuration + to improve clustermesh scalability. + - Adds support for deploying **Envoy (L7 proxy) as an independent DaemonSet**, + decoupling it from the agent for availability/performance/security benefits. + - Helm chart includes additional dashboards / dashboard integrations (Hubble + dashboards and sample dashboards integration). + - 'Chart validation tightened: enabling Ingress/Gateway API while L7 proxy disabled + now fails fast (prevents broken installs).' + - 'Various Helm cleanups: deprecated values removed/cleaned up; clustermesh + CA configuration deprecated in favor of global CA configuration; TLS configuration + simplified for clustermesh peers.' + - Adds service account for nodeinit daemonset and other minor chart template + fixes (e.g., indentation fixes). + features: + - '**Gateway API improvements**: adds TLSRoute support and supports newer Gateway + API versions (v0.6.x/v0.7.0 called out in notes).' + - '**L2 announcements**: introduces L2 announcement functionality including + gratuitous ARP (gARP) pod announcements for on-LAN advertisement use cases.' + - '**WireGuard enhancements**: adds host-to-host and load balancer traffic encryption + capabilities.' + - '**High-scale IPCache mode**: new mode designed for very large clustermeshes + (millions of pods), plus compatibility with encapsulation/DSR scenarios.' + - '**mTLS policy authentication options**: adds `mtls-spiffe` as a CiliumNetworkPolicy + auth mode and related SPIRE integrations for cert rotation/identity delivery.' + - '**CNI chaining improvements**: supports chaining with arbitrary CNI plugins + and changes how/when the CNI config file is managed for more reliable upgrades.' + - '**IPv6 datapath enhancements**: BPF-based IPv6 masquerading and IPv4 BIG + TCP support (plus continued BIG TCP work).' + - "**Operational safety**: operator can taint nodes when Cilium isn\u2019t running\ + \ to prevent scheduling onto unnetworked nodes; CNI conf no longer removed\ + \ on agent shutdown to avoid stuck pod deletions during upgrades." + breaking_changes: + - '**Hard stop for IPsec**: 1.14.0 release notes explicitly warn not to upgrade + when using IPsec; treat this as a blocking upgrade constraint.' + - '**CLI/flags removals**: the deprecated `policy_trace` command is removed; + if you rely on it in runbooks/scripts, update them.' + - '**Hubble metrics change**: the deprecated `pod-short` context option in Hubble + metrics is removed; dashboards/alerts depending on it need updating.' + - '**CNI config management behavioral change**: Cilium now manages/overwrites + the CNI config by default; if you used to manually modify the CNI config file + or rely on other chained plugins, you must adjust (`cni.exclusive=false` and/or + `cni.chainingTarget`) to avoid unexpected overwrites.' + - '**Value type change**: `enableEndpointCRD` Helm value changed from string + to boolean; incorrect type may break templating or behavior.' chart_version: 1.14.0 - images: ['quay.io/cilium/cilium:v1.14.0@sha256:5a94b561f4651fcfd85970a50bc78b201cfbd6e2ab1a03848eab25a82832653a', - 'quay.io/cilium/operator-generic:v1.14.0@sha256:3014d4bcb8352f0ddef90fa3b5eb1bbf179b91024813a90a0066eb4517ba93c9'] + images: + - quay.io/cilium/cilium:v1.14.0@sha256:5a94b561f4651fcfd85970a50bc78b201cfbd6e2ab1a03848eab25a82832653a + - quay.io/cilium/operator-generic:v1.14.0@sha256:3014d4bcb8352f0ddef90fa3b5eb1bbf179b91024813a90a0066eb4517ba93c9 eolAt: '2025-02-04' - version: 1.13.16 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Improved observability tooling: bugtool can now collect Hubble metrics, - making it easier to capture flow/metrics context during incident triage.', - 'Security and dependency refresh: includes fixes for published vulnerabilities - (Envoy-related) and bumps core dependencies (Envoy version, Go toolchain - used in components).', "Reliability/performance improvements across datapath\ - \ and control-plane edges: better handling of BPF service map retries, fewer\ - \ noisy \u201Cstale identity observed\u201D messages, and multiple fixes\ - \ in DNS proxying, IPAM, and Envoy/xDS behavior."] + features: + - 'Improved observability tooling: bugtool can now collect Hubble metrics, making + it easier to capture flow/metrics context during incident triage.' + - 'Security and dependency refresh: includes fixes for published vulnerabilities + (Envoy-related) and bumps core dependencies (Envoy version, Go toolchain used + in components).' + - "Reliability/performance improvements across datapath and control-plane edges:\ + \ better handling of BPF service map retries, fewer noisy \u201Cstale identity\ + \ observed\u201D messages, and multiple fixes in DNS proxying, IPAM, and Envoy/xDS\ + \ behavior." breaking_changes: [] chart_version: 1.13.16 - images: ['quay.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629', - 'quay.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b'] + images: + - quay.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629 + - quay.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b eolAt: '2024-07-24' - version: 1.13.11 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Improved observability signal-to-noise: reduces \u201Cstale identity\ - \ observed\u201D warnings (and further reduces related Hubble debug noise),\ - \ making logs/alerts less chatty.", 'DNS proxy enhancement: optional transparent - mode (--dnsproxy-enable-transparent-mode) allows the DNS proxy to preserve - the original pod source IP when talking to upstream DNS servers.', 'Performance - improvement/fix for heavy-load datapath: further fixes to prevent pod-to-pod - throughput drops when tunneling and IPsec are both enabled, including reducing - trace/monitor event volume when aggregation is enabled.'] + features: + - "Improved observability signal-to-noise: reduces \u201Cstale identity observed\u201D\ + \ warnings (and further reduces related Hubble debug noise), making logs/alerts\ + \ less chatty." + - 'DNS proxy enhancement: optional transparent mode (--dnsproxy-enable-transparent-mode) + allows the DNS proxy to preserve the original pod source IP when talking to + upstream DNS servers.' + - 'Performance improvement/fix for heavy-load datapath: further fixes to prevent + pod-to-pod throughput drops when tunneling and IPsec are both enabled, including + reducing trace/monitor event volume when aggregation is enabled.' breaking_changes: [] chart_version: 1.13.11 - images: ['quay.io/cilium/cilium:v1.13.11@sha256:3b117c7a6be212e2723813b44b909c757b76943cb0e9fdd0ec2aa4475bfcadb5', - 'quay.io/cilium/operator-generic:v1.13.11@sha256:730e2209b8777f1525186c602f77d5f22259ec4f1f6a2e923f4c03809ab7b0b1'] + images: + - quay.io/cilium/cilium:v1.13.11@sha256:3b117c7a6be212e2723813b44b909c757b76943cb0e9fdd0ec2aa4475bfcadb5 + - quay.io/cilium/operator-generic:v1.13.11@sha256:730e2209b8777f1525186c602f77d5f22259ec4f1f6a2e923f4c03809ab7b0b1 eolAt: '2024-07-24' - version: 1.13.7 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -14107,21 +16758,29 @@ addons: - **cert-manager users:** Helm now **mandates issuer configuration** when\ \ using cert-manager to generate certificates (1.13.2 bugfix note). Verify\ \ your values include the required issuer settings if you rely on cert-manager.\n" - chart_updates: [No explicit Helm chart template/structure changes were included - in the provided notes beyond the cert-manager issuer requirement and the - general reminder to use the matching chart version.] - features: ['Better observability for NAT map allocation drops: Cilium now reports - the kernel error code when drops occur due to failures creating NAT map - entries (1.13.7).', 'BGP operations visibility: `cilium bgp peers` now shows - operational state of BGP peers (1.13.2).', 'Host routing/fast-forward support - expanded: fast-forward (BPF host routing) can work on L2-less devices (1.13.2).'] + chart_updates: + - No explicit Helm chart template/structure changes were included in the provided + notes beyond the cert-manager issuer requirement and the general reminder + to use the matching chart version. + features: + - 'Better observability for NAT map allocation drops: Cilium now reports the + kernel error code when drops occur due to failures creating NAT map entries + (1.13.7).' + - 'BGP operations visibility: `cilium bgp peers` now shows operational state + of BGP peers (1.13.2).' + - 'Host routing/fast-forward support expanded: fast-forward (BPF host routing) + can work on L2-less devices (1.13.2).' breaking_changes: [] chart_version: 1.13.7 - images: ['quay.io/cilium/cilium:v1.13.7@sha256:3b084617febd708aa9d88de2472c6faf9aee71884112725e8511bca628ce5cf1', - 'quay.io/cilium/operator-generic:v1.13.7@sha256:0ec1bc5d9ecc444a890aaa2e0f397e77d15f1832910f1c20be3adc535688baba'] + images: + - quay.io/cilium/cilium:v1.13.7@sha256:3b084617febd708aa9d88de2472c6faf9aee71884112725e8511bca628ce5cf1 + - quay.io/cilium/operator-generic:v1.13.7@sha256:0ec1bc5d9ecc444a890aaa2e0f397e77d15f1832910f1c20be3adc535688baba eolAt: '2024-07-24' - version: 1.13.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -14147,34 +16806,47 @@ addons: \ was deprecated in favor of `CiliumEgressGatewayPolicy`.\n - In 1.13, **support\ \ for `CiliumEgressNATPolicy` is dropped**. You must migrate manifests before\ \ upgrading.\n" - chart_updates: [Ingress/Gateway API improvements including shared LoadBalancer - mode and expanded Service configuration for Ingress., Helm validations added - for ingress controller values (bad combinations may block the upgrade)., - Optional reduction of Linux capabilities and more securityContext configurability - (including SELinux)., Support for adding extra containers to cilium-agent - DaemonSet via values., Defaults updated for Hubble UI images (v0.10.0).] - features: [LB-IPAM (LoadBalancer IP address management) to allocate/assign LoadBalancer - IPs without an external controller., BGP Control Plane can announce Kubernetes - LoadBalancer services (useful for on-prem/BGP-based LBs)., Gateway API support - updated (v0.5.1) and Ingress shared LoadBalancer mode added., CiliumNetworkPolicy - adds TLS SNI enforcement and expands TLS origination/termination capabilities., - Per-node configuration overrides via new `CiliumNodeConfig` CRD for label-selected - node-specific tuning., 'Improved observability: socket-LB tracing, TraceID - support in Hubble flows/metrics, and additional Hubble metrics contexts.'] - breaking_changes: [Linux minimum version bumped to **4.19.57** (or equivalent); - older kernels are unsupported and must be upgraded before Cilium 1.13., - 'Egress Gateway: `CiliumEgressNATPolicy` support removed; clusters using it - must migrate to `CiliumEgressGatewayPolicy` prior to upgrade.', IPVLAN support - removed (it was deprecated earlier); environments relying on IPVLAN datapath - must switch to a supported mode., SockOps deprecated (plan to avoid depending - on it long-term); expect future removal and validate if any workload depends - on sockops-based features.] + chart_updates: + - Ingress/Gateway API improvements including shared LoadBalancer mode and expanded + Service configuration for Ingress. + - Helm validations added for ingress controller values (bad combinations may + block the upgrade). + - Optional reduction of Linux capabilities and more securityContext configurability + (including SELinux). + - Support for adding extra containers to cilium-agent DaemonSet via values. + - Defaults updated for Hubble UI images (v0.10.0). + features: + - LB-IPAM (LoadBalancer IP address management) to allocate/assign LoadBalancer + IPs without an external controller. + - BGP Control Plane can announce Kubernetes LoadBalancer services (useful for + on-prem/BGP-based LBs). + - Gateway API support updated (v0.5.1) and Ingress shared LoadBalancer mode + added. + - CiliumNetworkPolicy adds TLS SNI enforcement and expands TLS origination/termination + capabilities. + - Per-node configuration overrides via new `CiliumNodeConfig` CRD for label-selected + node-specific tuning. + - 'Improved observability: socket-LB tracing, TraceID support in Hubble flows/metrics, + and additional Hubble metrics contexts.' + breaking_changes: + - Linux minimum version bumped to **4.19.57** (or equivalent); older kernels + are unsupported and must be upgraded before Cilium 1.13. + - 'Egress Gateway: `CiliumEgressNATPolicy` support removed; clusters using it + must migrate to `CiliumEgressGatewayPolicy` prior to upgrade.' + - IPVLAN support removed (it was deprecated earlier); environments relying on + IPVLAN datapath must switch to a supported mode. + - SockOps deprecated (plan to avoid depending on it long-term); expect future + removal and validate if any workload depends on sockops-based features. chart_version: 1.13.0 - images: ['quay.io/cilium/cilium:v1.13.0@sha256:6544a3441b086a2e09005d3e21d1a4afb216fae19c5a60b35793c8a9438f8f68', - 'quay.io/cilium/operator-generic:v1.13.0@sha256:4b58d5b33e53378355f6e8ceb525ccf938b7b6f5384b35373f1f46787467ebf5'] + images: + - quay.io/cilium/cilium:v1.13.0@sha256:6544a3441b086a2e09005d3e21d1a4afb216fae19c5a60b35793c8a9438f8f68 + - quay.io/cilium/operator-generic:v1.13.0@sha256:4b58d5b33e53378355f6e8ceb525ccf938b7b6f5384b35373f1f46787467ebf5 eolAt: '2024-07-24' - version: 1.12.18 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -14189,34 +16861,45 @@ addons: ' chart_updates: [] - features: ['DNS proxy: new transparent mode (`--dnsproxy-enable-transparent-mode`) - allows the DNS proxy to use the original pod IP as the source when talking - to upstream DNS servers.', 'Operability: you can now configure resource - requests/limits for the cgroups automount initContainer in the Cilium agent - DaemonSet (helps with strict PodSecurity/ResourceQuota environments).'] + features: + - 'DNS proxy: new transparent mode (`--dnsproxy-enable-transparent-mode`) allows + the DNS proxy to use the original pod IP as the source when talking to upstream + DNS servers.' + - 'Operability: you can now configure resource requests/limits for the cgroups + automount initContainer in the Cilium agent DaemonSet (helps with strict PodSecurity/ResourceQuota + environments).' breaking_changes: [] chart_version: 1.12.18 - images: ['quay.io/cilium/cilium:v1.12.18@sha256:71218d52b2b9a63525e31e9be716810605696cbc02008e658953212f638d6b6b', - 'quay.io/cilium/operator-generic:v1.12.18@sha256:ac9b8a95d6faddacc1bca4145562c5143543dfbbc41b244383b52b8be83238ab'] + images: + - quay.io/cilium/cilium:v1.12.18@sha256:71218d52b2b9a63525e31e9be716810605696cbc02008e658953212f638d6b6b + - quay.io/cilium/operator-generic:v1.12.18@sha256:ac9b8a95d6faddacc1bca4145562c5143543dfbbc41b244383b52b8be83238ab - version: 1.12.14 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ["No Helm chart changelog was provided in the notes you pasted,\ - \ so I can\u2019t list exact chart/values changes for 1.12.9\u21921.12.14\ - \ from source material here.", 'From the v1.12.9 release notes: when updating - to 1.12.9 you must also use the corresponding new Helm chart version (implies - chart/version coupling; verify chart version for 1.12.14 in the Cilium Helm - chart release notes).'] + chart_updates: + - "No Helm chart changelog was provided in the notes you pasted, so I can\u2019\ + t list exact chart/values changes for 1.12.9\u21921.12.14 from source material\ + \ here." + - 'From the v1.12.9 release notes: when updating to 1.12.9 you must also use + the corresponding new Helm chart version (implies chart/version coupling; + verify chart version for 1.12.14 in the Cilium Helm chart release notes).' features: [] breaking_changes: [] chart_version: 1.12.14 - images: ['quay.io/cilium/cilium:v1.12.14@sha256:a54b28a5c15e14f3491c772ca7cfa86266a2b1efb85326bc1ab6c95b91aeaa77', - 'quay.io/cilium/operator-generic:v1.12.14@sha256:b9ce66384c74f79a2982ef3a4602f649d49e9b8b79b58db5faa344c7451cb7c9'] + images: + - quay.io/cilium/cilium:v1.12.14@sha256:a54b28a5c15e14f3491c772ca7cfa86266a2b1efb85326bc1ab6c95b91aeaa77 + - quay.io/cilium/operator-generic:v1.12.14@sha256:b9ce66384c74f79a2982ef3a4602f649d49e9b8b79b58db5faa344c7451cb7c9 - version: 1.12.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -14249,36 +16932,48 @@ addons: \ wider **cilium-cli Helm-based install/upgrade** support. Decide whether\ \ you stick with your existing Helm pipeline or standardize on cilium-cli\ \ for validation/preflight.\n" - chart_updates: [Integrated Ingress Controller shipped and corresponding Helm - templates/IngressClass support added., Chart now applies Linux nodeSelectors - to nodeinit and preflight components (important for mixed OS clusters)., - Prometheus metrics ports default changed to reserved Cilium ports (update - scrape configs)., 'Helm chart gained additional values for bpf root, Hubble - Relay/UI service exposure (type/nodePort), and Hubble securityContexts.', - 'Chart fixes around resource generation (e.g., PodDisruptionBudgets) and several - template/value alignment cleanups.'] - features: [Integrated Cilium Ingress Controller (no separate ingress controller - needed) with optional Helm-created IngressClass., Cilium Service Mesh support - including CiliumEnvoyConfig CRD to manage Envoy behavior via Kubernetes - resources., Egress Gateway promoted to stable and new Egress Gateway CRD - introduced for configuration., BGP control plane backed by GoBGP plus IPv6-related - routing/BGP enhancements., NAT46/64 support for Services and bandwidth manager - improvements including optional BBR congestion control.] - breaking_changes: ['Egress Gateway CRD migration: new `CiliumEgressGatewayPolicy` - CRD added and the older `CiliumEgressNATPolicy` is deprecated; plan to migrate - manifests.', "DaemonSet no longer runs in privileged mode; verify your cluster\u2019\ - s security policies/PSPs/OPA/Gatekeeper rules allow required capabilities\ - \ and mounts.", 'Default Prometheus metrics ports changed; any hardcoded - scrapes, firewall rules, or NetworkPolicies must be updated.', 'Config rename: - `bpf.hostRouting` renamed to `bpf.hostLegacyRouting`; update any custom - CiliumConfig/values referencing the old name.', 'Deprecated options removed - (e.g., deprecated `native-routing-cidr` option and prefilter-* options); - if you still use old flags, the agent may fail to start after upgrade.'] + chart_updates: + - Integrated Ingress Controller shipped and corresponding Helm templates/IngressClass + support added. + - Chart now applies Linux nodeSelectors to nodeinit and preflight components + (important for mixed OS clusters). + - Prometheus metrics ports default changed to reserved Cilium ports (update + scrape configs). + - Helm chart gained additional values for bpf root, Hubble Relay/UI service + exposure (type/nodePort), and Hubble securityContexts. + - Chart fixes around resource generation (e.g., PodDisruptionBudgets) and several + template/value alignment cleanups. + features: + - Integrated Cilium Ingress Controller (no separate ingress controller needed) + with optional Helm-created IngressClass. + - Cilium Service Mesh support including CiliumEnvoyConfig CRD to manage Envoy + behavior via Kubernetes resources. + - Egress Gateway promoted to stable and new Egress Gateway CRD introduced for + configuration. + - BGP control plane backed by GoBGP plus IPv6-related routing/BGP enhancements. + - NAT46/64 support for Services and bandwidth manager improvements including + optional BBR congestion control. + breaking_changes: + - 'Egress Gateway CRD migration: new `CiliumEgressGatewayPolicy` CRD added and + the older `CiliumEgressNATPolicy` is deprecated; plan to migrate manifests.' + - "DaemonSet no longer runs in privileged mode; verify your cluster\u2019s security\ + \ policies/PSPs/OPA/Gatekeeper rules allow required capabilities and mounts." + - Default Prometheus metrics ports changed; any hardcoded scrapes, firewall + rules, or NetworkPolicies must be updated. + - 'Config rename: `bpf.hostRouting` renamed to `bpf.hostLegacyRouting`; update + any custom CiliumConfig/values referencing the old name.' + - Deprecated options removed (e.g., deprecated `native-routing-cidr` option + and prefilter-* options); if you still use old flags, the agent may fail to + start after upgrade. chart_version: 1.12.0 - images: ['quay.io/cilium/cilium:v1.12.0@sha256:079baa4fa1b9fe638f96084f4e0297c84dd4fb215d29d2321dcbe54273f63ade', - 'quay.io/cilium/operator-generic:v1.12.0@sha256:bb2a42eda766e5d4a87ee8a5433f089db81b72dd04acf6b59fcbb445a95f9410'] + images: + - quay.io/cilium/cilium:v1.12.0@sha256:079baa4fa1b9fe638f96084f4e0297c84dd4fb215d29d2321dcbe54273f63ade + - quay.io/cilium/operator-generic:v1.12.0@sha256:bb2a42eda766e5d4a87ee8a5433f089db81b72dd04acf6b59fcbb445a95f9410 - version: 1.11.6 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -14300,33 +16995,41 @@ addons: \ ServiceMonitor customization:** v1.11.2 adds Helm values for **custom ServiceMonitor\ \ annotations**. If you need to integrate with Prometheus Operator/managed\ \ monitoring, you may now be able to set these via values instead of post-rendering.\n" - chart_updates: ['Envoy (Cilium host proxy) version bump across the patch series: - v1.21.1 noted in v1.11.2, and v1.21.3 in v1.11.6 to address multiple CVEs.', - Hubble UI image update to v0.9.0 and removal of the extra Envoy proxy container - for the UI (could change resource footprint and what pods/containers you - see)., 'Default agent health check port changed to avoid conflicts (verify - any NetworkPolicies, firewalls, or health-check scraping assumptions).', - Fix/repair deprecated Kubernetes priority scheduling annotation to ensure - CNI agent is scheduled at high priority on newer Kubernetes versions.] - features: ['Security: Envoy updated to v1.21.3 in v1.11.6 to address moderate/high/critical - CVEs (host proxy hardening).', 'FQDN/DNS scalability: concurrency limiting - for DNS message processing plus multiple optimizations to reduce CPU/memory - under high FQDN policy load.', 'Observability/metrics: new/expanded metrics - around identities and FQDN datapath timeouts; improved DNS proxy error metrics - and active FQDN connection metrics.', 'Ops tooling: cilium-bugtool includes - more tc (traffic control) data and structured node/health output.'] - breaking_changes: ['Operational behavior change called out in v1.11.2: **GKE - users should change the node taint effect from `NoSchedule` to `NoExecute`** - for `node.cilium.io/agent-not-ready=true`. This can affect eviction behavior - during agent-not-ready windows.', 'Potentially user-visible default changes: - **agent health check port default changed** and **Hubble peer service default - ports changed to 80/443**; if you had network policies, firewall rules, - or custom scraping/health checks tied to prior defaults, validate and adjust.'] + chart_updates: + - 'Envoy (Cilium host proxy) version bump across the patch series: v1.21.1 noted + in v1.11.2, and v1.21.3 in v1.11.6 to address multiple CVEs.' + - Hubble UI image update to v0.9.0 and removal of the extra Envoy proxy container + for the UI (could change resource footprint and what pods/containers you see). + - Default agent health check port changed to avoid conflicts (verify any NetworkPolicies, + firewalls, or health-check scraping assumptions). + - Fix/repair deprecated Kubernetes priority scheduling annotation to ensure + CNI agent is scheduled at high priority on newer Kubernetes versions. + features: + - 'Security: Envoy updated to v1.21.3 in v1.11.6 to address moderate/high/critical + CVEs (host proxy hardening).' + - 'FQDN/DNS scalability: concurrency limiting for DNS message processing plus + multiple optimizations to reduce CPU/memory under high FQDN policy load.' + - 'Observability/metrics: new/expanded metrics around identities and FQDN datapath + timeouts; improved DNS proxy error metrics and active FQDN connection metrics.' + - 'Ops tooling: cilium-bugtool includes more tc (traffic control) data and structured + node/health output.' + breaking_changes: + - 'Operational behavior change called out in v1.11.2: **GKE users should change + the node taint effect from `NoSchedule` to `NoExecute`** for `node.cilium.io/agent-not-ready=true`. + This can affect eviction behavior during agent-not-ready windows.' + - 'Potentially user-visible default changes: **agent health check port default + changed** and **Hubble peer service default ports changed to 80/443**; if + you had network policies, firewall rules, or custom scraping/health checks + tied to prior defaults, validate and adjust.' chart_version: 1.11.6 - images: ['quay.io/cilium/cilium:v1.11.6@sha256:f7f93c26739b6641a3fa3d76b1e1605b15989f25d06625260099e01c8243f54c', - 'quay.io/cilium/operator-generic:v1.11.6@sha256:9f6063c7bcaede801a39315ec7c166309f6a6783e98665f6693939cf1701bc17'] + images: + - quay.io/cilium/cilium:v1.11.6@sha256:f7f93c26739b6641a3fa3d76b1e1605b15989f25d06625260099e01c8243f54c + - quay.io/cilium/operator-generic:v1.11.6@sha256:9f6063c7bcaede801a39315ec7c166309f6a6783e98665f6693939cf1701bc17 - version: 1.11.2 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -14339,27 +17042,36 @@ addons: \ `--reuse-values` during upgrades (from 1.11.1 notes). For this patch upgrade,\ \ prefer an explicit `values.yaml` (or `helm get values` \u2192 review \u2192\ \ apply) to avoid carrying forward deprecated/incorrect defaults." - chart_updates: ['Helm: add values to allow custom ServiceMonitor annotations.', - 'Helm: minor updates/maintenance (e.g., values.yaml link updates, release - tooling improvements) carried into this patch release.'] - features: ['Envoy in the Cilium host proxy is updated to **v1.21.1**, addressing - multiple CVEs (low/moderate/high severity).', 'Prometheus metrics: expose - additional **XFRM (IPsec) statistics**.', 'Daemon: allow enabling the **Hubble - PCAP recorder** even when not running in load-balancer mode.', 'Config flexibility: - `install-no-conntrack-iptables-rules` can be used when **all masquerading - is disabled**.'] - breaking_changes: ['**Operational change for GKE users:** update node taint - from `node.cilium.io/agent-not-ready=true:NoSchedule` to `node.cilium.io/agent-not-ready=true:NoExecute` - to avoid scheduling/cleanup issues when the agent is not ready. This is - the most important action item in 1.11.2.', '**Behavioral gotcha after first - reboot (GKE/containerd flavors):** after applying the fix, the *first* node - reboot may still see pods get IPs from the default CNI because `cilium-node-init` - runs later; subsequent reboots should behave correctly.'] + chart_updates: + - 'Helm: add values to allow custom ServiceMonitor annotations.' + - 'Helm: minor updates/maintenance (e.g., values.yaml link updates, release + tooling improvements) carried into this patch release.' + features: + - Envoy in the Cilium host proxy is updated to **v1.21.1**, addressing multiple + CVEs (low/moderate/high severity). + - 'Prometheus metrics: expose additional **XFRM (IPsec) statistics**.' + - 'Daemon: allow enabling the **Hubble PCAP recorder** even when not running + in load-balancer mode.' + - 'Config flexibility: `install-no-conntrack-iptables-rules` can be used when + **all masquerading is disabled**.' + breaking_changes: + - '**Operational change for GKE users:** update node taint from `node.cilium.io/agent-not-ready=true:NoSchedule` + to `node.cilium.io/agent-not-ready=true:NoExecute` to avoid scheduling/cleanup + issues when the agent is not ready. This is the most important action item + in 1.11.2.' + - '**Behavioral gotcha after first reboot (GKE/containerd flavors):** after + applying the fix, the *first* node reboot may still see pods get IPs from + the default CNI because `cilium-node-init` runs later; subsequent reboots + should behave correctly.' chart_version: 1.11.2 - images: ['quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60', - 'quay.io/cilium/operator-generic:v1.11.2@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7'] + images: + - quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60 + - quay.io/cilium/operator-generic:v1.11.2@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7 - version: 1.11.1 - kube: ['1.26', '1.25', '1.23'] + kube: + - '1.26' + - '1.25' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -14372,20 +17084,32 @@ addons: \ (doc change but operationally important):** Cilium explicitly warns **against\ \ using Helm `--reuse-values` during upgrades**; prefer a clean values file\ \ and/or `helm get values` + review.\n" - chart_updates: [Fix Helm template for externalWorkloads., Fix Helm chart annotations - for CRDs installed by Cilium.] - features: [No new user-facing features in 1.11.1; this is primarily a patch - release focused on stability and bugfixes., Underlying container images - include upstream OS updates (security/bugfix refresh).] - breaking_changes: ['No explicit breaking changes called out for 1.11.1 (patch - release). However, behavior may change if you rely on buggy prior behavior - in areas fixed here (FQDN policy, egress gateway, IPAM/IP release handshake, - kube-proxy replacement init/finalization).'] + chart_updates: + - Fix Helm template for externalWorkloads. + - Fix Helm chart annotations for CRDs installed by Cilium. + features: + - No new user-facing features in 1.11.1; this is primarily a patch release focused + on stability and bugfixes. + - Underlying container images include upstream OS updates (security/bugfix refresh). + breaking_changes: + - No explicit breaking changes called out for 1.11.1 (patch release). However, + behavior may change if you rely on buggy prior behavior in areas fixed here + (FQDN policy, egress gateway, IPAM/IP release handshake, kube-proxy replacement + init/finalization). chart_version: 1.11.1 - images: ['quay.io/cilium/cilium:v1.11.1@sha256:251ff274acf22fd2067b29a31e9fda94253d2961c061577203621583d7e85bd2', - 'quay.io/cilium/operator-generic:v1.11.1@sha256:977240a4783c7be821e215ead515da3093a10f4a7baea9f803511a2c2b44a235'] + images: + - quay.io/cilium/cilium:v1.11.1@sha256:251ff274acf22fd2067b29a31e9fda94253d2961c061577203621583d7e85bd2 + - quay.io/cilium/operator-generic:v1.11.1@sha256:977240a4783c7be821e215ead515da3093a10f4a7baea9f803511a2c2b44a235 - version: 1.11.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -14429,44 +17153,58 @@ addons: \ release notes; Helm chart version/changelog specifics aren\u2019t included.\ \ Treat the above as \u201Cthings to verify in values.yaml\u201D rather than\ \ an exhaustive Helm diff." - chart_updates: ["Envoy/Proxy components updated across the stack; note that\ - \ 1.10.8 updated the host proxy to Envoy 1.21.1 for CVEs, while 1.11.0\u2019\ - s listed Envoy integration version is 1.18.4 (verify which applies to your\ - \ deployed components and images).", 'Helm chart cleanup and restructuring - work is referenced (`cleanup helm chart`, `Restructure helm chart into components`), - which can change rendered object names/labels and the shape of values.', - Improved device auto-detection (route-based) and expanded multi-device support - (notably for XDP acceleration) can change which interfaces Cilium programs - by default; re-check `devices` / `directRoutingDevice` overrides if you - set them previously., CiliumEndpointSlice feature introduced for scalability - in CRD-only clusters; may introduce additional CRDs/resources and changes - in control-plane behavior when enabled., 'Host firewall promoted to stable; - if you enable host firewall, ensure your policies and expectations match - the now-stable feature status.'] - features: ["OpenTelemetry export for Hubble L3\u2013L7 observability data (traces\ - \ and metrics).", New `kube-apiserver` policy entity to simplify modeling - policy to/from the Kubernetes API server., "Topology-aware load balancing\ - \ using Kubernetes service topology hints to prefer \u201Cclosest\u201D\ - \ backends.", BGP PodCIDR route advertisement support., Graceful service - backend termination to drain connections when endpoints are removed/terminated., - Host firewall promoted to stable for production use., Load balancer scalability - improvements (supporting >64K backends) and improved XDP fast-path support - for bonded/multi-device setups., CiliumEndpointSlice for improved scalability - in CRD-only clusters (1000+ nodes without requiring an etcd kvstore).] - breaking_changes: ['Default install behavior changes: kube-proxy replacement - is **disabled by default** in 1.11; clusters relying on it must explicitly - enable it during/after upgrade.', 'Some flags/configuration names changed - or deprecated (notably egress gateway flag rename to `enable-ipv4-egress-gateway`, - and `nativeRoutingCIDR` deprecation in favor of `ipv4NativeRoutingCIDR`), - which can break upgrades if you pass old flags via Helm.', 'Known issue: - ToFQDN rules can become ineffective after modifying a policy selecting a - pod; mitigation is to apply all policies then restart the agent or affected - pods.'] + chart_updates: + - "Envoy/Proxy components updated across the stack; note that 1.10.8 updated\ + \ the host proxy to Envoy 1.21.1 for CVEs, while 1.11.0\u2019s listed Envoy\ + \ integration version is 1.18.4 (verify which applies to your deployed components\ + \ and images)." + - Helm chart cleanup and restructuring work is referenced (`cleanup helm chart`, + `Restructure helm chart into components`), which can change rendered object + names/labels and the shape of values. + - Improved device auto-detection (route-based) and expanded multi-device support + (notably for XDP acceleration) can change which interfaces Cilium programs + by default; re-check `devices` / `directRoutingDevice` overrides if you set + them previously. + - CiliumEndpointSlice feature introduced for scalability in CRD-only clusters; + may introduce additional CRDs/resources and changes in control-plane behavior + when enabled. + - Host firewall promoted to stable; if you enable host firewall, ensure your + policies and expectations match the now-stable feature status. + features: + - "OpenTelemetry export for Hubble L3\u2013L7 observability data (traces and\ + \ metrics)." + - New `kube-apiserver` policy entity to simplify modeling policy to/from the + Kubernetes API server. + - "Topology-aware load balancing using Kubernetes service topology hints to\ + \ prefer \u201Cclosest\u201D backends." + - BGP PodCIDR route advertisement support. + - Graceful service backend termination to drain connections when endpoints are + removed/terminated. + - Host firewall promoted to stable for production use. + - Load balancer scalability improvements (supporting >64K backends) and improved + XDP fast-path support for bonded/multi-device setups. + - CiliumEndpointSlice for improved scalability in CRD-only clusters (1000+ nodes + without requiring an etcd kvstore). + breaking_changes: + - 'Default install behavior changes: kube-proxy replacement is **disabled by + default** in 1.11; clusters relying on it must explicitly enable it during/after + upgrade.' + - Some flags/configuration names changed or deprecated (notably egress gateway + flag rename to `enable-ipv4-egress-gateway`, and `nativeRoutingCIDR` deprecation + in favor of `ipv4NativeRoutingCIDR`), which can break upgrades if you pass + old flags via Helm. + - 'Known issue: ToFQDN rules can become ineffective after modifying a policy + selecting a pod; mitigation is to apply all policies then restart the agent + or affected pods.' chart_version: 1.11.0 - images: ['quay.io/cilium/cilium:v1.11.0@sha256:ea677508010800214b0b5497055f38ed3bff57963fa2399bcb1c69cf9476453a', - 'quay.io/cilium/operator-generic:v1.11.0@sha256:b522279577d0d5f1ad7cadaacb7321d1b172d8ae8c8bc816e503c897b420cfe3'] + images: + - quay.io/cilium/cilium:v1.11.0@sha256:ea677508010800214b0b5497055f38ed3bff57963fa2399bcb1c69cf9476453a + - quay.io/cilium/operator-generic:v1.11.0@sha256:b522279577d0d5f1ad7cadaacb7321d1b172d8ae8c8bc816e503c897b420cfe3 - version: 1.10.12 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -14482,30 +17220,37 @@ addons: \ introduced for this purpose.\n\n> Note: The provided notes are from application\ \ release notes and include a few `helm:` items; confirm the exact key names\ \ in the chart values for your specific chart version." - chart_updates: [Envoy sidecar/proxy image for Cilium updated to **v1.21.3** - (security CVE fixes)., Cilium UI updated to **v0.9.0** images and **drops - the Envoy proxy container** for the UI deployment (pod spec changes)., Bugtool - output expanded (additional `tc` data; structured node/health output)., - 'Clustermesh: `CiliumNode` objects get `ownerReferences` (K8s object lifecycle/GC - behavior change).', Kubernetes library versions updated (to v1.21.11 in - this patch line).] - features: ['Improved FQDN scalability under load: concurrency limiting for DNS - message processing and reduced lock contention during bursty DNS traffic.', - 'New/expanded observability: additional metrics for identity type labels, - active FQDN connections per endpoint, improved DNS proxy error metrics, - and a counter for datapath timeouts due to FQDN IP updates.'] - breaking_changes: ['Potential behavior changes due to **default port changes** - (agent health check port; Hubble peer service default ports 80/443). If - you have firewalls, NetworkPolicies, or monitoring scraping the old ports, - update them accordingly.', 'UI deployment change: UI images updated and - the **Envoy proxy container removed**; if you had customizations or assumptions - about that container (resources, security context, sidecar-based routing), - re-validate after upgrade.'] + chart_updates: + - Envoy sidecar/proxy image for Cilium updated to **v1.21.3** (security CVE + fixes). + - Cilium UI updated to **v0.9.0** images and **drops the Envoy proxy container** + for the UI deployment (pod spec changes). + - Bugtool output expanded (additional `tc` data; structured node/health output). + - 'Clustermesh: `CiliumNode` objects get `ownerReferences` (K8s object lifecycle/GC + behavior change).' + - Kubernetes library versions updated (to v1.21.11 in this patch line). + features: + - 'Improved FQDN scalability under load: concurrency limiting for DNS message + processing and reduced lock contention during bursty DNS traffic.' + - 'New/expanded observability: additional metrics for identity type labels, + active FQDN connections per endpoint, improved DNS proxy error metrics, and + a counter for datapath timeouts due to FQDN IP updates.' + breaking_changes: + - Potential behavior changes due to **default port changes** (agent health check + port; Hubble peer service default ports 80/443). If you have firewalls, NetworkPolicies, + or monitoring scraping the old ports, update them accordingly. + - 'UI deployment change: UI images updated and the **Envoy proxy container removed**; + if you had customizations or assumptions about that container (resources, + security context, sidecar-based routing), re-validate after upgrade.' chart_version: 1.10.12 - images: ['quay.io/cilium/cilium:v1.10.12@sha256:6a119c4f249d42df0d5654295ac9466da117f9b838ff48b4bc64234f7ab20b80', - 'quay.io/cilium/operator-generic:v1.10.12@sha256:35288de36cd1b6fe65e55a9b878100c2ab92ac88ed6a3ab04326e00326cff3f7'] + images: + - quay.io/cilium/cilium:v1.10.12@sha256:6a119c4f249d42df0d5654295ac9466da117f9b838ff48b4bc64234f7ab20b80 + - quay.io/cilium/operator-generic:v1.10.12@sha256:35288de36cd1b6fe65e55a9b878100c2ab92ac88ed6a3ab04326e00326cff3f7 - version: 1.10.8 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -14516,20 +17261,27 @@ addons: \ Release notes reiterate **avoid `helm upgrade --reuse-values`** for Cilium.\ \ Prefer supplying an explicit values file (or diffing defaults between chart\ \ versions) to avoid silently carrying forward deprecated/changed defaults." - chart_updates: [Helm chart exposes new knobs for ServiceMonitor annotations - (Prometheus Operator integration)., 'Installation manifests/images updated: - Envoy (host proxy) bumped to v1.21.1; base images and image digests refreshed - for v1.10.8.'] - features: ['Prometheus metrics now include **XFRM (IPsec) statistics**, improving - visibility into IPsec/XFRM behavior and troubleshooting.', 'Helm chart can - now **apply custom annotations to ServiceMonitors**, useful for Prometheus - Operator setups (scrape configs, relabeling, tenant metadata, etc.).'] + chart_updates: + - Helm chart exposes new knobs for ServiceMonitor annotations (Prometheus Operator + integration). + - 'Installation manifests/images updated: Envoy (host proxy) bumped to v1.21.1; + base images and image digests refreshed for v1.10.8.' + features: + - Prometheus metrics now include **XFRM (IPsec) statistics**, improving visibility + into IPsec/XFRM behavior and troubleshooting. + - Helm chart can now **apply custom annotations to ServiceMonitors**, useful + for Prometheus Operator setups (scrape configs, relabeling, tenant metadata, + etc.). breaking_changes: [] chart_version: 1.10.8 - images: ['quay.io/cilium/cilium:v1.10.8@sha256:e6147e39a03c685e5f1225c5642e1358dcd4899bbd94e8a043bb4be52cd2f008', - 'quay.io/cilium/operator-generic:v1.10.8@sha256:a77dff6103d047d8810ea5e80067b2fade6d099771c8dda197bdba5e4e2f0255'] + images: + - quay.io/cilium/cilium:v1.10.8@sha256:e6147e39a03c685e5f1225c5642e1358dcd4899bbd94e8a043bb4be52cd2f008 + - quay.io/cilium/operator-generic:v1.10.8@sha256:a77dff6103d047d8810ea5e80067b2fade6d099771c8dda197bdba5e4e2f0255 - version: 1.10.7 - kube: ['1.26', '1.25', '1.23'] + kube: + - '1.26' + - '1.25' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -14556,32 +17308,43 @@ addons: \ service)\n - Support for **external serviceAccounts** (if you manage RBAC\ \ externally)\n\nIf you share your current `values.yaml`, we can map old keys\ \ to new ones precisely." - chart_updates: ['Cilium 1.10 introduced multiple Helm chart refactors that still - apply when upgrading within the 1.10 patch line, including moving/renaming - values blocks (notably encryption and ENI).', 1.10.7 includes a manifest - change adding `mountPropagation` to the `bpf-maps` volume in the Cilium - DaemonSet (important if you rely on BPF map mounts/persistence)., "1.10.7\ - \ refreshes underlying container image digests (agent, operator variants,\ - \ hubble-relay, etc.), so expect new image SHAs even if your values don\u2019\ - t change."] - features: [Standalone load-balancer datapath mode (`--datapath-mode=lb`) for - running Cilium as an L4 LB without full CNI duties., WireGuard pod-to-pod - encryption integration and Helm consolidation of encryption configuration - options., 'BGP-based LoadBalancer external IP allocation/announcement, plus - the egress gateway feature toggle in Helm for controlled rollout.', ARM64 - support (multi-arch images) enabling Cilium to run on arm64 nodes., Kubernetes - 1.21 support and raised minimum supported Kubernetes version to 1.16.] - breaking_changes: [Kubernetes minimum supported version increased to **1.16** - (from older 1.9.x support); clusters below 1.16 cannot upgrade to 1.10.x., - "Helm values breaking changes: `extraArgs` changed structure (object \u2192\ - \ array) and encryption/IPSec settings were moved under `encryption.*`;\ - \ upgrades that blindly reuse old values can fail or silently misconfigure\ - \ encryption."] + chart_updates: + - Cilium 1.10 introduced multiple Helm chart refactors that still apply when + upgrading within the 1.10 patch line, including moving/renaming values blocks + (notably encryption and ENI). + - 1.10.7 includes a manifest change adding `mountPropagation` to the `bpf-maps` + volume in the Cilium DaemonSet (important if you rely on BPF map mounts/persistence). + - "1.10.7 refreshes underlying container image digests (agent, operator variants,\ + \ hubble-relay, etc.), so expect new image SHAs even if your values don\u2019\ + t change." + features: + - Standalone load-balancer datapath mode (`--datapath-mode=lb`) for running + Cilium as an L4 LB without full CNI duties. + - WireGuard pod-to-pod encryption integration and Helm consolidation of encryption + configuration options. + - BGP-based LoadBalancer external IP allocation/announcement, plus the egress + gateway feature toggle in Helm for controlled rollout. + - ARM64 support (multi-arch images) enabling Cilium to run on arm64 nodes. + - Kubernetes 1.21 support and raised minimum supported Kubernetes version to + 1.16. + breaking_changes: + - Kubernetes minimum supported version increased to **1.16** (from older 1.9.x + support); clusters below 1.16 cannot upgrade to 1.10.x. + - "Helm values breaking changes: `extraArgs` changed structure (object \u2192\ + \ array) and encryption/IPSec settings were moved under `encryption.*`; upgrades\ + \ that blindly reuse old values can fail or silently misconfigure encryption." chart_version: 1.10.7 - images: ['quay.io/cilium/cilium:v1.10.7@sha256:e23f55e80e1988db083397987a89967aa204ad6fc32da243b9160fbcea29b0ca', - 'quay.io/cilium/operator-generic:v1.10.7@sha256:d0b491d8d8cb45862ed7f0410f65e7c141832f0f95262643fa5ff1edfcddcafe'] + images: + - quay.io/cilium/cilium:v1.10.7@sha256:e23f55e80e1988db083397987a89967aa204ad6fc32da243b9160fbcea29b0ca + - quay.io/cilium/operator-generic:v1.10.7@sha256:d0b491d8d8cb45862ed7f0410f65e7c141832f0f95262643fa5ff1edfcddcafe - version: 1.10.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: @@ -14609,68 +17372,97 @@ addons: \ using IAM roles for service accounts on `cilium-operator`.\n\n- **TLS secret\ \ content**:\n - Helm adds `ca.crt` to TLS secrets (relevant if you manage/override\ \ those secrets).\n" - chart_updates: ['Helm chart refactors for 1.10: encryption values consolidation - and IPsec values moved under `encryption.ipsec`.', Helm `extraArgs` values - schema changed from map/object to array/list form., Helm added support for - pinning images via digest flags., 'Helm added options for egress gateway, - k8s event handover, proxy Prometheus service toggle, EndpointStatus, and - expanded ServiceAccount controls (including external SAs).', Helm reorganized/expanded - ENI configuration into a top-level `eni` block and added `eni.iamRole` for - IRSA-style setups., Helm TLS secrets now include `ca.crt`.] - features: [Standalone load balancer datapath mode via `--datapath-mode=lb` (run - cilium-agent as an LB without full CNI)., 'WireGuard integration for pod-to-pod - encryption, including support for managed Kubernetes environments.', Service - LoadBalancer external IP allocation and announcement via BGP., 'Egress Gateway - support (control plane + datapath), exposed via a Helm option.', 'NodePort - BPF support on L2-less devices (e.g., WireGuard/tun).', ARM64 support for - building and installing Cilium., 'Kubernetes support updated: adds support - for K8s 1.21 and raises minimum supported K8s to 1.16.'] - breaking_changes: [Minimum supported Kubernetes version is now **1.16** (clusters - older than 1.16 are unsupported)., '`kube-proxy-replacement` is **disabled - by default** for new installs (if you relied on kube-proxy replacement previously, - you must explicitly enable/configure it).', "Helm values breaking change:\ - \ `extraArgs` schema changed (map/object \u279C array/list), requiring `values.yaml`\ - \ updates.", 'Helm values breaking change: IPsec/WireGuard encryption options - were reorganized (IPsec options moved under `encryption.ipsec`).', Managed - etcd mode is deprecated (plan migration away if you are using Cilium-managed - etcd)., Legacy flannel integration was removed (clusters depending on it - must use supported CNI/chaining modes).] + chart_updates: + - 'Helm chart refactors for 1.10: encryption values consolidation and IPsec + values moved under `encryption.ipsec`.' + - Helm `extraArgs` values schema changed from map/object to array/list form. + - Helm added support for pinning images via digest flags. + - Helm added options for egress gateway, k8s event handover, proxy Prometheus + service toggle, EndpointStatus, and expanded ServiceAccount controls (including + external SAs). + - Helm reorganized/expanded ENI configuration into a top-level `eni` block and + added `eni.iamRole` for IRSA-style setups. + - Helm TLS secrets now include `ca.crt`. + features: + - Standalone load balancer datapath mode via `--datapath-mode=lb` (run cilium-agent + as an LB without full CNI). + - WireGuard integration for pod-to-pod encryption, including support for managed + Kubernetes environments. + - Service LoadBalancer external IP allocation and announcement via BGP. + - Egress Gateway support (control plane + datapath), exposed via a Helm option. + - NodePort BPF support on L2-less devices (e.g., WireGuard/tun). + - ARM64 support for building and installing Cilium. + - 'Kubernetes support updated: adds support for K8s 1.21 and raises minimum + supported K8s to 1.16.' + breaking_changes: + - Minimum supported Kubernetes version is now **1.16** (clusters older than + 1.16 are unsupported). + - '`kube-proxy-replacement` is **disabled by default** for new installs (if + you relied on kube-proxy replacement previously, you must explicitly enable/configure + it).' + - "Helm values breaking change: `extraArgs` schema changed (map/object \u279C\ + \ array/list), requiring `values.yaml` updates." + - 'Helm values breaking change: IPsec/WireGuard encryption options were reorganized + (IPsec options moved under `encryption.ipsec`).' + - Managed etcd mode is deprecated (plan migration away if you are using Cilium-managed + etcd). + - Legacy flannel integration was removed (clusters depending on it must use + supported CNI/chaining modes). chart_version: 1.10.0 - images: ['quay.io/cilium/cilium:v1.10.0@sha256:587627d909ffe0418c0bd907516496844867a21812946af82096d367760e4c1e', - 'quay.io/cilium/operator-generic:v1.10.0@sha256:65143311a62a95dbe23c69ff2f624e0fdf030eb225e6375d889da66a955dd828'] + images: + - quay.io/cilium/cilium:v1.10.0@sha256:587627d909ffe0418c0bd907516496844867a21812946af82096d367760e4c1e + - quay.io/cilium/operator-generic:v1.10.0@sha256:65143311a62a95dbe23c69ff2f624e0fdf030eb225e6375d889da66a955dd828 - version: 1.9.17 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Envoy (Cilium host proxy) is updated across the patch range (v1.21.1 - in 1.9.13; v1.21.3 by 1.9.17) to address multiple CVEs., Improved DNS proxy - error metrics/observability in 1.9.17.] + features: + - Envoy (Cilium host proxy) is updated across the patch range (v1.21.1 in 1.9.13; + v1.21.3 by 1.9.17) to address multiple CVEs. + - Improved DNS proxy error metrics/observability in 1.9.17. breaking_changes: [] chart_version: 1.9.17 - images: ['quay.io/cilium/cilium:v1.9.17', 'quay.io/cilium/operator-generic:v1.9.17'] + images: + - quay.io/cilium/cilium:v1.9.17 + - quay.io/cilium/operator-generic:v1.9.17 - version: 1.9.13 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [No Helm chart changelog was provided in the notes; only application - (Cilium) release notes were included., 'Expect container image tags/digests - to change to v1.9.13 for cilium, operator, hubble-relay, clustermesh-apiserver, - etc. If you pin digests, update them accordingly.', 'Envoy (Cilium host - proxy) is updated; if you run L7 policies/ingress with the host proxy, plan - for a rolling restart and validate Envoy config compatibility.'] - features: ['Security update: Cilium host proxy (Envoy) updated to v1.21.1 to - address multiple CVEs.', Operational reliability improvements via several - bug fixes affecting networking and node lifecycle edge-cases.] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart changelog was provided in the notes; only application (Cilium) + release notes were included. + - Expect container image tags/digests to change to v1.9.13 for cilium, operator, + hubble-relay, clustermesh-apiserver, etc. If you pin digests, update them + accordingly. + - Envoy (Cilium host proxy) is updated; if you run L7 policies/ingress with + the host proxy, plan for a rolling restart and validate Envoy config compatibility. + features: + - 'Security update: Cilium host proxy (Envoy) updated to v1.21.1 to address + multiple CVEs.' + - Operational reliability improvements via several bug fixes affecting networking + and node lifecycle edge-cases. breaking_changes: [] chart_version: 1.9.13 - images: ['quay.io/cilium/cilium:v1.9.13', 'quay.io/cilium/operator-generic:v1.9.13'] + images: + - quay.io/cilium/cilium:v1.9.13 + - quay.io/cilium/operator-generic:v1.9.13 - version: 1.9.12 - kube: ['1.26', '1.25', '1.23'] + kube: + - '1.26' + - '1.25' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -14691,37 +17483,57 @@ addons: \ LB settings).\n- The installation docs mention **hubble-ui image reference\ \ fixes** and repository changes (ensure your Helm values don\u2019t pin old\ \ hubble-ui image repos/tags).\n" - chart_updates: ['1.9.12: Updates underlying container base images and image - digests; includes a fix for hubble-ui-backend image deployment and hubble-ui - image reference corrections.', '1.9.0: Helm charts were fully restructured - into a single `cilium` chart (no subcharts) with many values re-scoped; - Helm 3 minimum enforced and Helm 2 dropped.', '1.9.0: Chart removed PodSecurityPolicy - templates.', '1.9.0: Operator/Agent behavior around CRDs changed: operator - handles CRD operations and agent waits for CRDs to be available.'] - features: ['(1.9.0) Deny policies added (policy can explicitly deny traffic, - not just allow).', (1.9.0) Maglev consistent hashing support for kube-proxy - replacement Services (NodePort/LoadBalancer/externalIPs)., (1.9.0) Cilium - operator HA mode., '(1.9.0) Beta support for external workloads (e.g., VMs) - and Services for those workloads.', (1.9.0) Various observability/Hubble - improvements including (m)TLS support and additional flow filtering/metrics.] - breaking_changes: ['(1.9.0) Helm chart restructuring (single chart, values re-scoped) - can break upgrades if you reuse old `values.yaml` without mapping renamed/moved - keys.', (1.9.0) Helm 2 support removed; requires Helm 3., (1.9.0) PodSecurityPolicy - manifests removed; clusters relying on PSP-based admission need an alternative - (or accept changed security enforcement)., (1.9.0) Removal/deprecation of - several agent/operator options and DNS poller removal may break automation/scripts - that referenced those flags or behavior., (1.9.0) `blacklist-conflicting-routes` - agent option removed; routing conflicts with PodCIDR must now be handled - by the user/operator outside Cilium.] + chart_updates: + - '1.9.12: Updates underlying container base images and image digests; includes + a fix for hubble-ui-backend image deployment and hubble-ui image reference + corrections.' + - '1.9.0: Helm charts were fully restructured into a single `cilium` chart (no + subcharts) with many values re-scoped; Helm 3 minimum enforced and Helm 2 + dropped.' + - '1.9.0: Chart removed PodSecurityPolicy templates.' + - '1.9.0: Operator/Agent behavior around CRDs changed: operator handles CRD + operations and agent waits for CRDs to be available.' + features: + - (1.9.0) Deny policies added (policy can explicitly deny traffic, not just + allow). + - (1.9.0) Maglev consistent hashing support for kube-proxy replacement Services + (NodePort/LoadBalancer/externalIPs). + - (1.9.0) Cilium operator HA mode. + - (1.9.0) Beta support for external workloads (e.g., VMs) and Services for those + workloads. + - (1.9.0) Various observability/Hubble improvements including (m)TLS support + and additional flow filtering/metrics. + breaking_changes: + - (1.9.0) Helm chart restructuring (single chart, values re-scoped) can break + upgrades if you reuse old `values.yaml` without mapping renamed/moved keys. + - (1.9.0) Helm 2 support removed; requires Helm 3. + - (1.9.0) PodSecurityPolicy manifests removed; clusters relying on PSP-based + admission need an alternative (or accept changed security enforcement). + - (1.9.0) Removal/deprecation of several agent/operator options and DNS poller + removal may break automation/scripts that referenced those flags or behavior. + - (1.9.0) `blacklist-conflicting-routes` agent option removed; routing conflicts + with PodCIDR must now be handled by the user/operator outside Cilium. chart_version: 1.9.12 - images: ['quay.io/cilium/cilium:v1.9.12', 'quay.io/cilium/operator-generic:v1.9.12'] + images: + - quay.io/cilium/cilium:v1.9.12 + - quay.io/cilium/operator-generic:v1.9.12 - version: 1.9.0 - kube: ['1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', '1.12'] + kube: + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' requirements: [] incompatibilities: [] summary: null chart_version: 1.9.0 - images: ['quay.io/cilium/cilium:v1.9.0', 'quay.io/cilium/operator-generic:v1.9.0'] + images: + - quay.io/cilium/cilium:v1.9.0 + - quay.io/cilium/operator-generic:v1.9.0 name: cilium - icon: https://avatars.githubusercontent.com/u/54918165?s=48&v=4 git_url: https://github.com/projectcontour/contour @@ -14730,371 +17542,566 @@ addons: eolApiSlug: contour versions: - version: 1.32.1 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Envoy dependency bumped from v1.34.1 to v1.34.4, bringing in upstream - fixes and changes from Envoy 1.34.4.', Go toolchain/runtime bumped from - v1.24.3 to v1.24.6.] + features: + - Envoy dependency bumped from v1.34.1 to v1.34.4, bringing in upstream fixes + and changes from Envoy 1.34.4. + - Go toolchain/runtime bumped from v1.24.3 to v1.24.6. breaking_changes: [] chart_version: 21.1.4 - images: ['docker.io/bitnami/contour:1.32.1-debian-12-r0', 'docker.io/bitnami/envoy:1.34.5-debian-12-r0'] + images: + - docker.io/bitnami/contour:1.32.1-debian-12-r0 + - docker.io/bitnami/envoy:1.34.5-debian-12-r0 - version: 1.32.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Improved performance in clusters with many endpoints by switching - EDS caching to go-control-plane LinearCache., "Bumped supported/tested Kubernetes\ - \ versions to 1.31\u20131.33 and updated CI/e2e kind node image accordingly.", - 'Updated bundled dependencies: Envoy to v1.34.1 and Go to 1.24.3.', 'Fixed - the `contour` CLI xDS discovery behavior so subsequent DiscoveryRequests - include the requested resource names, not only the first request.'] + features: + - Improved performance in clusters with many endpoints by switching EDS caching + to go-control-plane LinearCache. + - "Bumped supported/tested Kubernetes versions to 1.31\u20131.33 and updated\ + \ CI/e2e kind node image accordingly." + - 'Updated bundled dependencies: Envoy to v1.34.1 and Go to 1.24.3.' + - Fixed the `contour` CLI xDS discovery behavior so subsequent DiscoveryRequests + include the requested resource names, not only the first request. breaking_changes: [] chart_version: 21.1.2 - images: ['docker.io/bitnami/contour:1.32.0-debian-12-r8', 'docker.io/bitnami/envoy:1.34.4-debian-12-r0'] + images: + - docker.io/bitnami/contour:1.32.0-debian-12-r8 + - docker.io/bitnami/envoy:1.34.4-debian-12-r0 - version: 1.31.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["External authorization enhancements: you can now disable Global\ - \ ExtAuth by default and selectively re-enable it at vhost/route level;\ - \ additionally, ExtAuth is no longer enforced on HTTP\u2192HTTPS redirect\ - \ responses (avoids 401s on redirect).", "Envoy overload protections: new\ - \ bootstrap flag `overload-downstream-max-conn` enables Envoy\u2019s global\ - \ downstream connection limit; admin listeners ignore the global limit so\ - \ stats/admin remain reachable, and there\u2019s a new health-check config\ - \ option to make readiness/liveness respect overload rejection behavior.", - Gateway API compatibility bumped to v1.2.1., 'Operational/config additions: - configurable HTTP compression algorithm (gzip/brotli/zstd/disabled), new - `strip-trailing-host-dot` request handling option, support for Service `appProtocol` - http/https, expanded retryOn conditions, and more redirect status codes - (303/307/308) for requestRedirectPolicy.', "Dependency/platform updates:\ - \ Envoy updated to v1.34.0; Go updated to 1.24.2; tested Kubernetes versions\ - \ now 1.30\u20131.32; plus bugfixes for follower readiness and memory leak."] - breaking_changes: ["Removal: legacy `contour` xDS server implementation removed;\ - \ go-control-plane xDS server is now the only supported option. Corresponding\ - \ config fields that selected xDS server type have been removed\u2014configs\ - \ referencing them must be cleaned up before/while upgrading.", 'Removal: - `useEndpointSlices` feature flag and remaining Endpoints-path code removed. - Any setups that explicitly forced Endpoints API (or relied on disabling - EndpointSlice mirroring) must be updated; Contour now always uses EndpointSlices.'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "External authorization enhancements: you can now disable Global ExtAuth by\ + \ default and selectively re-enable it at vhost/route level; additionally,\ + \ ExtAuth is no longer enforced on HTTP\u2192HTTPS redirect responses (avoids\ + \ 401s on redirect)." + - "Envoy overload protections: new bootstrap flag `overload-downstream-max-conn`\ + \ enables Envoy\u2019s global downstream connection limit; admin listeners\ + \ ignore the global limit so stats/admin remain reachable, and there\u2019\ + s a new health-check config option to make readiness/liveness respect overload\ + \ rejection behavior." + - Gateway API compatibility bumped to v1.2.1. + - 'Operational/config additions: configurable HTTP compression algorithm (gzip/brotli/zstd/disabled), + new `strip-trailing-host-dot` request handling option, support for Service + `appProtocol` http/https, expanded retryOn conditions, and more redirect status + codes (303/307/308) for requestRedirectPolicy.' + - "Dependency/platform updates: Envoy updated to v1.34.0; Go updated to 1.24.2;\ + \ tested Kubernetes versions now 1.30\u20131.32; plus bugfixes for follower\ + \ readiness and memory leak." + breaking_changes: + - "Removal: legacy `contour` xDS server implementation removed; go-control-plane\ + \ xDS server is now the only supported option. Corresponding config fields\ + \ that selected xDS server type have been removed\u2014configs referencing\ + \ them must be cleaned up before/while upgrading." + - 'Removal: `useEndpointSlices` feature flag and remaining Endpoints-path code + removed. Any setups that explicitly forced Endpoints API (or relied on disabling + EndpointSlice mirroring) must be updated; Contour now always uses EndpointSlices.' chart_version: 20.0.1 - images: ['docker.io/bitnami/contour:1.31.0-debian-12-r2', 'docker.io/bitnami/envoy:1.34.1-debian-12-r0'] + images: + - docker.io/bitnami/contour:1.31.0-debian-12-r2 + - docker.io/bitnami/envoy:1.34.1-debian-12-r0 - version: 1.30.0 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Gateway API: Implement Listener/Route hostname isolation so requests - are routed to the most specific matching Listener and its attached routes.', - Monitoring examples updated to expose Envoy metrics on port 8002 and to use - Prometheus Operator `PodMonitor` resources (instead of `prometheus.io/*` - annotations)., Gateway API compatibility updated to v1.1.0 (includes GRPCRoute - now GA/v1)., 'Circuit breaker configuration added for Extension Services, - with PerHostMaxConnections also configurable globally.', Fallback certificate - handling now applies global external auth (Global ExtAuth) filters., 'Gateway - API: GRPCRoute match conflict handling now mirrors HTTPRoute behavior (oldest - wins, then alphabetical; sets Accepted/PartiallyInvalid conditions).'] - breaking_changes: ['Gateway API v1.1.0 includes breaking changes to `BackendTLSPolicy`, - moving it to `v1alpha3`; users must uninstall v1alpha2 CRD before installing - the new one.', 'Deprecated: sample manifests and Gateway provisioner no - longer add `prometheus.io/*` scrape annotations; monitoring should move - to `PodMonitor`/Prometheus Operator flow.', 'Deprecated: xDS server type - fields in the config file and ContourConfiguration CRD are now deprecated - and planned for removal in 1.31 (along with the legacy `contour` xDS implementation).'] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Gateway API: Implement Listener/Route hostname isolation so requests are + routed to the most specific matching Listener and its attached routes.' + - Monitoring examples updated to expose Envoy metrics on port 8002 and to use + Prometheus Operator `PodMonitor` resources (instead of `prometheus.io/*` annotations). + - Gateway API compatibility updated to v1.1.0 (includes GRPCRoute now GA/v1). + - Circuit breaker configuration added for Extension Services, with PerHostMaxConnections + also configurable globally. + - Fallback certificate handling now applies global external auth (Global ExtAuth) + filters. + - 'Gateway API: GRPCRoute match conflict handling now mirrors HTTPRoute behavior + (oldest wins, then alphabetical; sets Accepted/PartiallyInvalid conditions).' + breaking_changes: + - Gateway API v1.1.0 includes breaking changes to `BackendTLSPolicy`, moving + it to `v1alpha3`; users must uninstall v1alpha2 CRD before installing the + new one. + - 'Deprecated: sample manifests and Gateway provisioner no longer add `prometheus.io/*` + scrape annotations; monitoring should move to `PodMonitor`/Prometheus Operator + flow.' + - 'Deprecated: xDS server type fields in the config file and ContourConfiguration + CRD are now deprecated and planned for removal in 1.31 (along with the legacy + `contour` xDS implementation).' chart_version: 19.2.1 - images: ['docker.io/bitnami/contour:1.30.0-debian-12-r6', 'docker.io/bitnami/envoy:1.31.2-debian-12-r0'] + images: + - docker.io/bitnami/contour:1.30.0-debian-12-r6 + - docker.io/bitnami/envoy:1.31.2-debian-12-r0 eolAt: '2025-09-08' - version: 1.29.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 18.2.3 - images: ['docker.io/bitnami/contour:1.29.0-debian-12-r1', 'docker.io/bitnami/envoy:1.29.5-debian-12-r0'] + images: + - docker.io/bitnami/contour:1.29.0-debian-12-r1 + - docker.io/bitnami/envoy:1.29.5-debian-12-r0 eolAt: '2025-05-15' - version: 1.28.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null eolAt: '2025-05-06' - version: 1.27.0 - kube: ['1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Fixes path match sorting for Prefix/Regex routes so longer patterns - are ordered first (then lexicographic for ties), improving match specificity - consistency across HTTPProxy inclusion, Ingress, and Gateway API.', 'Routes - can disable an inherited virtualhost global rate limit policy via `rateLimitPolicy.global.disabled: - true` at the route level.', 'Contour waits for informer cache sync *and* - handler processing before starting DAG rebuild and serving XDS, improving - startup correctness.', HTTPProxy supports dynamic Host header rewrites using - request header variables (route-level only)., Optional EndpointSlice support - added behind `useEndpointSlices` feature flag (off by default)., 'Adds listener - config knobs for HTTP/2 DoS mitigation/tuning: `listener.max-requests-per-io-cycle` - and `listener.http2-max-concurrent-streams`.', Gateway provisioner can run - in/out of cluster via `--incluster`/`--kubeconfig` flags and supports `overloadMaxHeapSize` - for Envoy overload manager bootstrap config., Gateway API listener `ResolvedRefs` - condition now defaults to true; webhook removed from example manifests since - Gateway API validation uses CEL., 'Build/runtime dependency bumps: Go 1.21.3 - and Envoy 1.28.0.'] - breaking_changes: [Route ordering may change for some combinations of Prefix/Regex - path matches due to the new sorting algorithm; this can alter which route - matches first in large/complex routing tables. Validate route order and - behavior before/after upgrade.] + kube: + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Fixes path match sorting for Prefix/Regex routes so longer patterns are ordered + first (then lexicographic for ties), improving match specificity consistency + across HTTPProxy inclusion, Ingress, and Gateway API. + - 'Routes can disable an inherited virtualhost global rate limit policy via + `rateLimitPolicy.global.disabled: true` at the route level.' + - Contour waits for informer cache sync *and* handler processing before starting + DAG rebuild and serving XDS, improving startup correctness. + - HTTPProxy supports dynamic Host header rewrites using request header variables + (route-level only). + - Optional EndpointSlice support added behind `useEndpointSlices` feature flag + (off by default). + - 'Adds listener config knobs for HTTP/2 DoS mitigation/tuning: `listener.max-requests-per-io-cycle` + and `listener.http2-max-concurrent-streams`.' + - Gateway provisioner can run in/out of cluster via `--incluster`/`--kubeconfig` + flags and supports `overloadMaxHeapSize` for Envoy overload manager bootstrap + config. + - Gateway API listener `ResolvedRefs` condition now defaults to true; webhook + removed from example manifests since Gateway API validation uses CEL. + - 'Build/runtime dependency bumps: Go 1.21.3 and Envoy 1.28.0.' + breaking_changes: + - Route ordering may change for some combinations of Prefix/Regex path matches + due to the new sorting algorithm; this can alter which route matches first + in large/complex routing tables. Validate route order and behavior before/after + upgrade. chart_version: 15.4.0 - images: ['docker.io/bitnami/contour:1.27.0-debian-11-r9', 'docker.io/bitnami/envoy:1.27.2-debian-11-r8'] + images: + - docker.io/bitnami/contour:1.27.0-debian-11-r9 + - docker.io/bitnami/envoy:1.27.2-debian-11-r8 eolAt: '2024-07-31' - version: 1.26.0 - kube: ['1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Gateway API: Gateway listeners can now be configured on more than - two ports (multiple HTTP and multiple HTTPS/TLS listeners). If using the - Contour Gateway Provisioner, the Envoy Service will automatically expose - ports for all valid listeners.', 'Gateway API: TCPRoute is now supported - for simple TCP forwarding on a listener port, and TLS termination is supported - with TLSRoute (SNI-based routing) or TCPRoute (single backend).', 'Gateway - API: Updated support to Gateway API v0.8.0, including status/conformance - refinements and CRD validation changes.', 'HTTPProxy: New regex-based path - matching and regex header matching conditions are supported in routes/includes.', - 'Rate limiting: You can define a default global rate limit policy in Contour - config that applies to all HTTPProxies unless they opt out.', "Observability/ops:\ - \ New xDS metrics about status update count/duration and additional controller-runtime\ - \ metrics are exposed; access logs can now include route source (kind/namespace/name)\ - \ and have a new \u201Ccritical\u201D level (>=500 only)."] - breaking_changes: ['Routing behavior change: Contour no longer strips the port - from the downstream Host header before proxying to backends; backends will - now see the Host header including the port if one was present.', 'Gateway/HTTP - route precedence change: routes that match HTTP method now take precedence - over routes with header/query matches (aligns with Gateway API v0.7.1+), - which can change which backend receives requests in overlapping-rule scenarios.', - 'If you use static provisioning for Gateway (manually managed Envoy Service), - you must now keep the Service ports in sync with all Gateway listeners because - Contour supports many listener ports; previously some configurations may - have assumed only one HTTP and one HTTPS port.'] + kube: + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Gateway API: Gateway listeners can now be configured on more than two ports + (multiple HTTP and multiple HTTPS/TLS listeners). If using the Contour Gateway + Provisioner, the Envoy Service will automatically expose ports for all valid + listeners.' + - 'Gateway API: TCPRoute is now supported for simple TCP forwarding on a listener + port, and TLS termination is supported with TLSRoute (SNI-based routing) or + TCPRoute (single backend).' + - 'Gateway API: Updated support to Gateway API v0.8.0, including status/conformance + refinements and CRD validation changes.' + - 'HTTPProxy: New regex-based path matching and regex header matching conditions + are supported in routes/includes.' + - 'Rate limiting: You can define a default global rate limit policy in Contour + config that applies to all HTTPProxies unless they opt out.' + - "Observability/ops: New xDS metrics about status update count/duration and\ + \ additional controller-runtime metrics are exposed; access logs can now include\ + \ route source (kind/namespace/name) and have a new \u201Ccritical\u201D level\ + \ (>=500 only)." + breaking_changes: + - 'Routing behavior change: Contour no longer strips the port from the downstream + Host header before proxying to backends; backends will now see the Host header + including the port if one was present.' + - 'Gateway/HTTP route precedence change: routes that match HTTP method now take + precedence over routes with header/query matches (aligns with Gateway API + v0.7.1+), which can change which backend receives requests in overlapping-rule + scenarios.' + - If you use static provisioning for Gateway (manually managed Envoy Service), + you must now keep the Service ports in sync with all Gateway listeners because + Contour supports many listener ports; previously some configurations may have + assumed only one HTTP and one HTTPS port. chart_version: 13.1.4 - images: ['docker.io/bitnami/contour:1.26.0-debian-11-r17', 'docker.io/bitnami/envoy:1.26.5-debian-11-r0'] + images: + - docker.io/bitnami/contour:1.26.0-debian-11-r17 + - docker.io/bitnami/envoy:1.26.5-debian-11-r0 eolAt: '2024-05-07' - version: 1.25.0 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null chart_version: 12.2.2 - images: ['docker.io/bitnami/contour:1.25.0-debian-11-r73', 'docker.io/bitnami/envoy:1.26.3-debian-11-r10'] + images: + - docker.io/bitnami/contour:1.25.0-debian-11-r73 + - docker.io/bitnami/envoy:1.26.3-debian-11-r10 eolAt: '2024-02-12' - version: 1.24.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: null eolAt: '2023-10-30' - version: 1.23.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["Overload Manager can be enabled to protect Envoy from OOM-related\ - \ disruptions by shedding load when heap usage is too high; it\u2019s off\ - \ by default and must be explicitly configured.", "HTTPProxy now supports\ - \ JWT verification via Envoy\u2019s jwt_authn filter, with JWTProviders\ - \ defined on the root HTTPProxy and applied per-route (with optional defaults\ - \ and opt-outs).", 'Slow start mode is available to gradually ramp traffic - to newly added/upscaled endpoints, reducing cold-start overload (useful - for JVM apps).', 'HTTPProxy CORS policy can now use regex matching for Allowed - Origins, enabling more flexible Origin header handling.', "Gateway API updates:\ - \ conformance/behavior improvements (e.g., rule precedence is list order),\ - \ more efficient status handling (status-only changes don\u2019t trigger\ - \ xDS), and version bump to Gateway API v0.5.1.", 'Operational configurability - via ContourDeployment: configurable Contour and Kubernetes client log levels, - pod annotations/labels, resource requirements, and extra volumes/volumeMounts - for Envoy pods.'] - breaking_changes: ["Supported Kubernetes versions shift: v1.23.x is tested against\ - \ Kubernetes 1.23\u20131.25 (drops 1.22). Ensure your cluster version is\ - \ within this range before upgrading.", Envoy version moves forward (v1.22 - used Envoy 1.23; v1.23 uses Envoy 1.24). Validate any Envoy-specific config/custom - filters and observe for behavior/log-format changes tied to the new Envoy - release., 'Gateway API behavior is more strictly conformant (e.g., HTTPRoute - rule precedence by list order); if you relied on previous non-conformant - matching/attachment quirks, re-test routing outcomes after upgrade.'] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "Overload Manager can be enabled to protect Envoy from OOM-related disruptions\ + \ by shedding load when heap usage is too high; it\u2019s off by default and\ + \ must be explicitly configured." + - "HTTPProxy now supports JWT verification via Envoy\u2019s jwt_authn filter,\ + \ with JWTProviders defined on the root HTTPProxy and applied per-route (with\ + \ optional defaults and opt-outs)." + - Slow start mode is available to gradually ramp traffic to newly added/upscaled + endpoints, reducing cold-start overload (useful for JVM apps). + - HTTPProxy CORS policy can now use regex matching for Allowed Origins, enabling + more flexible Origin header handling. + - "Gateway API updates: conformance/behavior improvements (e.g., rule precedence\ + \ is list order), more efficient status handling (status-only changes don\u2019\ + t trigger xDS), and version bump to Gateway API v0.5.1." + - 'Operational configurability via ContourDeployment: configurable Contour and + Kubernetes client log levels, pod annotations/labels, resource requirements, + and extra volumes/volumeMounts for Envoy pods.' + breaking_changes: + - "Supported Kubernetes versions shift: v1.23.x is tested against Kubernetes\ + \ 1.23\u20131.25 (drops 1.22). Ensure your cluster version is within this\ + \ range before upgrading." + - Envoy version moves forward (v1.22 used Envoy 1.23; v1.23 uses Envoy 1.24). + Validate any Envoy-specific config/custom filters and observe for behavior/log-format + changes tied to the new Envoy release. + - Gateway API behavior is more strictly conformant (e.g., HTTPRoute rule precedence + by list order); if you relied on previous non-conformant matching/attachment + quirks, re-test routing outcomes after upgrade. chart_version: 10.1.1 - images: ['docker.io/bitnami/contour:1.23.0-debian-11-r10', 'docker.io/bitnami/envoy:1.24.0-debian-11-r11'] + images: + - docker.io/bitnami/contour:1.23.0-debian-11-r10 + - docker.io/bitnami/envoy:1.24.0-debian-11-r11 - version: 1.22.0 - kube: ['1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Upgrade Contour from v1.21.x to v1.22.0 (includes Envoy bump - to 1.23.0 and Gateway API bump to v0.5.0)., 'Gateway API resources/conformance - behavior changes: stricter TLS mode enforcement for HTTPS vs TLS listeners, - updated route/backend error handling and status conditions to match upstream - spec, and new support for ReferenceGrant alongside deprecated ReferencePolicy.', - "ContourConfiguration schema change: field rename `spec.envoy.logging.jsonFields`\ - \ \u2192 `spec.envoy.logging.accessLogJSONFields`; removes unused `DebugLogLevel`/`KubernetesDebugLogLevel`\ - \ fields (must be configured via CLI flags).", 'Behavioral defaults/operational - tweaks: `contour envoy shutdown --check-delay` default is now 0s (faster - termination when idle).', "Compatibility window changes: supported/tested\ - \ Kubernetes versions now 1.22\u20131.24 (1.21 dropped)."] - features: [Gateway API updated to v0.5.0 (v1alpha2 and v1beta1) with full v0.5.0 - conformance test pass., 'HTTPProxy routes can now return direct responses - via `directResponsePolicy` (requires `statusCode`, optional `body`) as an - alternative to service/redirect.', Client certificate validation can optionally - check revocation via CRL provided in an Opaque Secret referenced by `httpproxy.spec.virtualhost.tls.clientValidation.crlSecret`., - 'Gateway API now supports exact HTTP query parameter matching, plus rule-level - RequestMirror filter support (Gateway API mode).', 'Envoy upgraded to 1.23.0, - enabling newer access log operators and related logging template keywords.'] - breaking_changes: ['If you use the ContourConfiguration CRD field `spec.envoy.logging.jsonFields`, - it has been renamed to `spec.envoy.logging.accessLogJSONFields` and must - be updated before/with the upgrade.', "Gateway API: ReferencePolicy is deprecated\ - \ (ReferenceGrant preferred) and will be removed in the next Contour release\u2014\ - plan migration now to avoid a future breaking upgrade.", 'Gateway API: stricter - enforcement of TLS modes for listener protocols (HTTPS must be Terminate; - TLS must be Passthrough) may cause previously-accepted configs to become - invalid/unready.', "Kubernetes version support shifted to 1.22\u20131.24;\ - \ clusters on 1.21 are no longer in the tested/supported window for v1.22.0."] + kube: + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Upgrade Contour from v1.21.x to v1.22.0 (includes Envoy bump to 1.23.0 and + Gateway API bump to v0.5.0). + - 'Gateway API resources/conformance behavior changes: stricter TLS mode enforcement + for HTTPS vs TLS listeners, updated route/backend error handling and status + conditions to match upstream spec, and new support for ReferenceGrant alongside + deprecated ReferencePolicy.' + - "ContourConfiguration schema change: field rename `spec.envoy.logging.jsonFields`\ + \ \u2192 `spec.envoy.logging.accessLogJSONFields`; removes unused `DebugLogLevel`/`KubernetesDebugLogLevel`\ + \ fields (must be configured via CLI flags)." + - 'Behavioral defaults/operational tweaks: `contour envoy shutdown --check-delay` + default is now 0s (faster termination when idle).' + - "Compatibility window changes: supported/tested Kubernetes versions now 1.22\u2013\ + 1.24 (1.21 dropped)." + features: + - Gateway API updated to v0.5.0 (v1alpha2 and v1beta1) with full v0.5.0 conformance + test pass. + - HTTPProxy routes can now return direct responses via `directResponsePolicy` + (requires `statusCode`, optional `body`) as an alternative to service/redirect. + - Client certificate validation can optionally check revocation via CRL provided + in an Opaque Secret referenced by `httpproxy.spec.virtualhost.tls.clientValidation.crlSecret`. + - Gateway API now supports exact HTTP query parameter matching, plus rule-level + RequestMirror filter support (Gateway API mode). + - Envoy upgraded to 1.23.0, enabling newer access log operators and related + logging template keywords. + breaking_changes: + - If you use the ContourConfiguration CRD field `spec.envoy.logging.jsonFields`, + it has been renamed to `spec.envoy.logging.accessLogJSONFields` and must be + updated before/with the upgrade. + - "Gateway API: ReferencePolicy is deprecated (ReferenceGrant preferred) and\ + \ will be removed in the next Contour release\u2014plan migration now to avoid\ + \ a future breaking upgrade." + - 'Gateway API: stricter enforcement of TLS modes for listener protocols (HTTPS + must be Terminate; TLS must be Passthrough) may cause previously-accepted + configs to become invalid/unready.' + - "Kubernetes version support shifted to 1.22\u20131.24; clusters on 1.21 are\ + \ no longer in the tested/supported window for v1.22.0." chart_version: 9.1.1 - images: ['docker.io/bitnami/contour:1.22.0-debian-11-r4', 'docker.io/bitnami/envoy:1.23.0-debian-11-r8'] + images: + - docker.io/bitnami/contour:1.22.0-debian-11-r4 + - docker.io/bitnami/envoy:1.23.0-debian-11-r8 - version: 1.21.0 - kube: ['1.23', '1.22', '1.21'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Leader election RBAC in the example manifests was refactored: - rules for leader-election resources moved from a ClusterRole to a namespace-scoped - Role plus RoleBinding (and now also needs access to Events and Leases). - If your Helm chart templates or values override RBAC, review and align them - with v1.21.0 expectations (especially if Contour runs outside the default - namespace or you set a custom leader-election namespace).', Contour leader - election now uses only Lease objects; any chart flags/args or RBAC must - include coordination.k8s.io Lease permissions and related Events access - as per updated manifests., Container images are now published exclusively - on GHCR; Helm values that reference image repositories must switch from - Docker Hub to ghcr.io/projectcontour/contour (and ghcr.io/projectcontour/envoy - for Envoy where applicable)., Leader-election configuration via configuration - file was removed; charts that mount a config file and previously set leader - election there must move those settings to command-line flags/args., 'Gateway - API ecosystem updates: Gateway API bumped to v0.4.3 and example YAML includes - the validating webhook; if your chart installs Gateway API resources/webhook, - reconcile versions and webhook deployment expectations.', 'If you use/ship - certgen jobs/manifests, note the new optional --name-prefix flag for contour - certgen and that gateway-provisioner no longer relies on a certgen job (generates - xDS certs directly).'] - features: [Configurable HTTP/HTTPS access log verbosity via accesslog-level - / spec.envoy.logging.accessLogLevel (info/error/disabled)., New optional - Contour Gateway provisioner (contour gateway-provisioner) to dynamically - provision Contour+Envoy per Gateway for Gateway API conformance., 'Gateway - API enhancements: can target a specific Gateway via gatewayRef; better listener/route - condition handling; support requested addresses via spec.addresses.', 'New - load-balancing option: hash based on a query parameter for HTTPProxy backends.', - 'Operational/config additions: upstream TCP connection timeout configurable; - option to disable Envoy merge_slashes; JSON log format via --log-format=json; - new HTTPProxy idleConnection timeout field.'] - breaking_changes: [Leader election config in the configuration file has been - removed; must be configured via CLI flags now., Leader election coordination - now uses only Lease objects and upgrading to v1.21.0 explicitly requires - having upgraded to v1.20.0 first for migration., Default deployment RBAC - for leader election resources changed from ClusterRole to namespace-scoped - Role/RoleBinding; installs that relied on cluster-wide ConfigMap permissions - must be updated accordingly., Contour images are no longer pushed to Docker - Hub; image pulls must be updated to GHCR.] + kube: + - '1.23' + - '1.22' + - '1.21' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Leader election RBAC in the example manifests was refactored: rules for leader-election + resources moved from a ClusterRole to a namespace-scoped Role plus RoleBinding + (and now also needs access to Events and Leases). If your Helm chart templates + or values override RBAC, review and align them with v1.21.0 expectations (especially + if Contour runs outside the default namespace or you set a custom leader-election + namespace).' + - Contour leader election now uses only Lease objects; any chart flags/args + or RBAC must include coordination.k8s.io Lease permissions and related Events + access as per updated manifests. + - Container images are now published exclusively on GHCR; Helm values that reference + image repositories must switch from Docker Hub to ghcr.io/projectcontour/contour + (and ghcr.io/projectcontour/envoy for Envoy where applicable). + - Leader-election configuration via configuration file was removed; charts that + mount a config file and previously set leader election there must move those + settings to command-line flags/args. + - 'Gateway API ecosystem updates: Gateway API bumped to v0.4.3 and example YAML + includes the validating webhook; if your chart installs Gateway API resources/webhook, + reconcile versions and webhook deployment expectations.' + - If you use/ship certgen jobs/manifests, note the new optional --name-prefix + flag for contour certgen and that gateway-provisioner no longer relies on + a certgen job (generates xDS certs directly). + features: + - Configurable HTTP/HTTPS access log verbosity via accesslog-level / spec.envoy.logging.accessLogLevel + (info/error/disabled). + - New optional Contour Gateway provisioner (contour gateway-provisioner) to + dynamically provision Contour+Envoy per Gateway for Gateway API conformance. + - 'Gateway API enhancements: can target a specific Gateway via gatewayRef; better + listener/route condition handling; support requested addresses via spec.addresses.' + - 'New load-balancing option: hash based on a query parameter for HTTPProxy + backends.' + - 'Operational/config additions: upstream TCP connection timeout configurable; + option to disable Envoy merge_slashes; JSON log format via --log-format=json; + new HTTPProxy idleConnection timeout field.' + breaking_changes: + - Leader election config in the configuration file has been removed; must be + configured via CLI flags now. + - Leader election coordination now uses only Lease objects and upgrading to + v1.21.0 explicitly requires having upgraded to v1.20.0 first for migration. + - Default deployment RBAC for leader election resources changed from ClusterRole + to namespace-scoped Role/RoleBinding; installs that relied on cluster-wide + ConfigMap permissions must be updated accordingly. + - Contour images are no longer pushed to Docker Hub; image pulls must be updated + to GHCR. chart_version: 8.0.0 - images: ['docker.io/bitnami/contour:1.21.0-debian-11-r0', 'docker.io/bitnami/envoy:1.22.1-debian-11-r0'] + images: + - docker.io/bitnami/contour:1.21.0-debian-11-r0 + - docker.io/bitnami/envoy:1.22.1-debian-11-r0 - version: 1.20.1 - kube: ['1.23', '1.22', '1.21'] + kube: + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null chart_version: 7.10.2 - images: ['docker.io/bitnami/contour:1.20.1-debian-11-r0', 'docker.io/bitnami/envoy:1.21.2-debian-11-r0'] + images: + - docker.io/bitnami/contour:1.20.1-debian-11-r0 + - docker.io/bitnami/envoy:1.21.2-debian-11-r0 name: contour - icon: https://avatars.githubusercontent.com/u/21110084?s=200&v=4 release_url: https://github.com/coredns/coredns/releases/tag/{vsn} helm_repository_url: https://coredns.github.io/helm versions: - version: 1.12.0 - kube: ['1.36', '1.35', '1.34', '1.33'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 1.42.2 - images: ['coredns/coredns:1.12.0'] + images: + - coredns/coredns:1.12.0 - version: 1.11.3 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 1.36.1 - images: ['coredns/coredns:1.11.3'] + images: + - coredns/coredns:1.11.3 - version: 1.11.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null chart_version: 1.31.0 images: [] - version: 1.10.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 1.24.5 - images: ['coredns/coredns:1.10.1'] + images: + - coredns/coredns:1.10.1 - version: 1.9.3 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null chart_version: 1.19.6 - images: ['coredns/coredns:1.9.3'] + images: + - coredns/coredns:1.9.3 - version: 1.8.6 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 1.16.6 - images: ['coredns/coredns:1.8.6'] + images: + - coredns/coredns:1.8.6 - version: 1.8.4 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null chart_version: 1.16.4 - images: ['coredns/coredns:1.8.4'] + images: + - coredns/coredns:1.8.4 - version: 1.8.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null chart_version: 1.15.1 - images: ['coredns/coredns:1.8.0'] + images: + - coredns/coredns:1.8.0 name: coredns - icon: https://avatars.githubusercontent.com/u/112438027?s=200&v=4 git_url: https://github.com/cloudnative-pg/cloudnative-pg @@ -15103,351 +18110,469 @@ addons: chart_name: cloudnative-pg versions: - version: 1.28.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Quorum-based failover is now a stable API (`spec.postgresql.synchronous.failoverQuorum`), - replacing the previous alpha annotation approach.', New declarative Foreign - Data Wrapper management via the `Database` CRD (`.spec.fdws` and `.spec.servers`) - to manage FDW extensions and foreign servers., 'Security and ops improvements: - pod-level `securityContext`/`containerSecurityContext`, optional TLS for - operator metrics, fine-grained custom TLS for PgBouncer, and a caching layer - for user-defined monitoring queries.', 'Operational resilience improvements: - better probe behavior during transient API-server issues and faster replica - network drop detection via a reduced default `tcp_user_timeout`.'] - breaking_changes: [Default PostgreSQL image version changes (to PostgreSQL 18.1 - system-trixie by default); upgrading may change the default major version - if you were relying on defaults rather than pinning images., "Kubernetes/PostgreSQL\ - \ support matrix changes: Kubernetes 1.31 and PostgreSQL 13 are no longer\ - \ listed as supported in 1.28 (ensure you\u2019re on K8s 1.32+ and PG 14+).", - Quorum-based failover configuration moved from `alpha.cnpg.io/failoverQuorum` - annotation to the stable `spec.postgresql.synchronous.failoverQuorum` field - (update manifests accordingly if you used the alpha feature).] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Quorum-based failover is now a stable API (`spec.postgresql.synchronous.failoverQuorum`), + replacing the previous alpha annotation approach. + - New declarative Foreign Data Wrapper management via the `Database` CRD (`.spec.fdws` + and `.spec.servers`) to manage FDW extensions and foreign servers. + - 'Security and ops improvements: pod-level `securityContext`/`containerSecurityContext`, + optional TLS for operator metrics, fine-grained custom TLS for PgBouncer, + and a caching layer for user-defined monitoring queries.' + - 'Operational resilience improvements: better probe behavior during transient + API-server issues and faster replica network drop detection via a reduced + default `tcp_user_timeout`.' + breaking_changes: + - Default PostgreSQL image version changes (to PostgreSQL 18.1 system-trixie + by default); upgrading may change the default major version if you were relying + on defaults rather than pinning images. + - "Kubernetes/PostgreSQL support matrix changes: Kubernetes 1.31 and PostgreSQL\ + \ 13 are no longer listed as supported in 1.28 (ensure you\u2019re on K8s\ + \ 1.32+ and PG 14+)." + - Quorum-based failover configuration moved from `alpha.cnpg.io/failoverQuorum` + annotation to the stable `spec.postgresql.synchronous.failoverQuorum` field + (update manifests accordingly if you used the alpha feature). chart_version: 0.27.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.28.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.28.0 - version: 1.27.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Dynamic loading of PostgreSQL extensions via `.spec.postgresql.extensions`, - mounting extension images as read-only volumes in instance pods.', HA logical - decoding slot sync via `spec.replicationSlots.highAvailability.synchronizeLogicalDecoding` - so logical subscribers keep working after failover., Primary Isolation Check - promoted to stable; adds `.spec.probes.liveness.isolationCheck` and updates - liveness behavior to shut down an isolated primary within `livenessProbeTimeout`., - Experimental failover quorum (quorum-based failover) available via `alpha.cnpg.io/failoverQuorum` - annotation., New `fqdn-uri` and `fqdn-jdbc-uri` entries in user secrets - for FQDN-based connection strings., 'CNPG-I: adds Postgres interface support - and instance webserver metrics capabilities.'] - breaking_changes: ['Liveness probe default behavior changed: an isolated primary - is now forcibly shut down within `livenessProbeTimeout` (default 30s). This - can change failure modes and may cause quicker primary pod termination in - certain network-partition scenarios.', "`Backup.spec` is now immutable after\ - \ creation; any workflows that \u201Cedit\u201D existing Backup objects\ - \ must switch to creating new Backup resources instead."] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Dynamic loading of PostgreSQL extensions via `.spec.postgresql.extensions`, + mounting extension images as read-only volumes in instance pods. + - HA logical decoding slot sync via `spec.replicationSlots.highAvailability.synchronizeLogicalDecoding` + so logical subscribers keep working after failover. + - Primary Isolation Check promoted to stable; adds `.spec.probes.liveness.isolationCheck` + and updates liveness behavior to shut down an isolated primary within `livenessProbeTimeout`. + - Experimental failover quorum (quorum-based failover) available via `alpha.cnpg.io/failoverQuorum` + annotation. + - New `fqdn-uri` and `fqdn-jdbc-uri` entries in user secrets for FQDN-based + connection strings. + - 'CNPG-I: adds Postgres interface support and instance webserver metrics capabilities.' + breaking_changes: + - 'Liveness probe default behavior changed: an isolated primary is now forcibly + shut down within `livenessProbeTimeout` (default 30s). This can change failure + modes and may cause quicker primary pod termination in certain network-partition + scenarios.' + - "`Backup.spec` is now immutable after creation; any workflows that \u201C\ + edit\u201D existing Backup objects must switch to creating new Backup resources\ + \ instead." chart_version: 0.26.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.27.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.27.0 - version: 1.26.0 - kube: ['1.33', '1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Offline, declarative in-place major PostgreSQL upgrades using pg_upgrade - (cluster pods shut down; precheck job; declarative rollback).', Improved - replica startup/readiness probe behavior with better control tied to streaming - lag., Database CRD expanded with declarative management of extensions and - schemas.] - breaking_changes: ['Native Barman Cloud support is deprecated (still works in - 1.26, removed in 1.28); start migrating clusters to the Barman Cloud Plugin, - and expect webhook warnings when using in-tree barmanObjectStore/retentionPolicy - fields.', 'Operator drops support for Barman <=3.4 capability detection; - if your operand image is very old (pre-Apr 2023), upgrade the operand before - upgrading the operator.', "kubectl cnpg hibernate commands switched from\ - \ imperative to declarative shortcuts; hibernate status removed\u2014do\ - \ not upgrade plugin/operator unless you\u2019re ready to adopt declarative\ - \ hibernation."] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Offline, declarative in-place major PostgreSQL upgrades using pg_upgrade (cluster + pods shut down; precheck job; declarative rollback). + - Improved replica startup/readiness probe behavior with better control tied + to streaming lag. + - Database CRD expanded with declarative management of extensions and schemas. + breaking_changes: + - Native Barman Cloud support is deprecated (still works in 1.26, removed in + 1.28); start migrating clusters to the Barman Cloud Plugin, and expect webhook + warnings when using in-tree barmanObjectStore/retentionPolicy fields. + - Operator drops support for Barman <=3.4 capability detection; if your operand + image is very old (pre-Apr 2023), upgrade the operand before upgrading the + operator. + - "kubectl cnpg hibernate commands switched from imperative to declarative shortcuts;\ + \ hibernate status removed\u2014do not upgrade plugin/operator unless you\u2019\ + re ready to adopt declarative hibernation." chart_version: 0.24.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.26.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.26.0 - version: 1.25.0 - kube: ['1.32', '1.31', '1.30', '1.29'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Declarative database management via new `Database` CRD to create/manage - PostgreSQL databases within a Cluster., 'Declarative logical replication - via new `Publication` and `Subscription` CRDs, easing replication setup - and online migrations.', 'Experimental CNPG-I plugin interface to extend - CloudNativePG via third-party plugins (e.g., Barman Cloud plugin) without - modifying the operator.'] - breaking_changes: ['Support matrix changes: PostgreSQL 12 is dropped; PostgreSQL - 17 is now supported and the default image is PostgreSQL 17.2. Plan upgrades - accordingly (major PG upgrade procedures apply).', "Kubernetes support window\ - \ shifts (now 1.32\u20131.29); Kubernetes 1.28 is no longer listed as supported."] + features: + - Declarative database management via new `Database` CRD to create/manage PostgreSQL + databases within a Cluster. + - Declarative logical replication via new `Publication` and `Subscription` CRDs, + easing replication setup and online migrations. + - Experimental CNPG-I plugin interface to extend CloudNativePG via third-party + plugins (e.g., Barman Cloud plugin) without modifying the operator. + breaking_changes: + - 'Support matrix changes: PostgreSQL 12 is dropped; PostgreSQL 17 is now supported + and the default image is PostgreSQL 17.2. Plan upgrades accordingly (major + PG upgrade procedures apply).' + - "Kubernetes support window shifts (now 1.32\u20131.29); Kubernetes 1.28 is\ + \ no longer listed as supported." chart_version: 0.23.1 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0 - version: 1.24.0 - kube: ['1.31', '1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator release 1.24.0 includes important resource/labeling - behavior changes (Service/PDB selector label deprecation) and scheduling/anti-affinity - default fix that can trigger a full instance rollout on operator upgrade., - 'Security hardening and connectivity changes: TLS added between operator and - instance manager; optional TLS for metrics exporter; operator service account - permissions reduced.', 'Behavioral changes around readiness checks, pod - spec reconciliation control, and pooler rollout behavior on operator image - upgrades.'] - features: [Distributed PostgreSQL topologies (enhanced replica clusters) enabling - multi-cluster/hybrid deployments with declarative primary control and seamless - switchover without rebuilding the former primary., Managed services configuration - (`managed.services`) to disable default read/read-only services and to template - custom Services (including LoadBalancers) for external access/DBaaS use - cases., New synchronous replication API supporting quorum-based and priority-list - strategies with full customization of `synchronous_standby_names`., Safety - mechanism to stop the cluster on WAL disk space exhaustion to simplify recovery - by resizing storage., Delayed replicas via `.spec.replica.minApplyDelay` - using PostgreSQL `recovery_min_apply_delay`., Post-init SQL can now be provided - via multiple ConfigMaps/Secrets using `postInitSQLRefs` and `postInitTemplateSQLRefs`., - PostgreSQL 17 support for `allow_alter_system` via `.spec.postgresql.enableAlterSystem`., - 'Metrics/query improvements: customizable metric/column names and predicate - queries; PgBouncer 1.23 metrics support in Pooler collector.', New annotation - `reconcilePodSpec` on Cluster/Pooler to control pod restarts after pod spec - changes., '`cnpg` plugin improvements including control-plane node install - option and enhanced status output for distributed topology tokens.'] - breaking_changes: ['`role` label in Service and PodDisruptionBudget selectors - is deprecated in favor of `cnpg.io/instanceRole`; any tooling or custom - resources depending on the old selector/label should be updated.', Default - PodAntiAffinity fix for PostgreSQL pods will trigger a rollout of all instances - when upgrading the operator (even with online upgrades enabled); plan for - controlled disruption/capacity during the upgrade., 'Readiness behavior - tightened: streaming replicas that never connected to primary now fail readiness, - which may change rollout/alerting behavior in misconfigured or partitioned - environments.'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator release 1.24.0 includes important resource/labeling behavior changes + (Service/PDB selector label deprecation) and scheduling/anti-affinity default + fix that can trigger a full instance rollout on operator upgrade. + - 'Security hardening and connectivity changes: TLS added between operator and + instance manager; optional TLS for metrics exporter; operator service account + permissions reduced.' + - Behavioral changes around readiness checks, pod spec reconciliation control, + and pooler rollout behavior on operator image upgrades. + features: + - Distributed PostgreSQL topologies (enhanced replica clusters) enabling multi-cluster/hybrid + deployments with declarative primary control and seamless switchover without + rebuilding the former primary. + - Managed services configuration (`managed.services`) to disable default read/read-only + services and to template custom Services (including LoadBalancers) for external + access/DBaaS use cases. + - New synchronous replication API supporting quorum-based and priority-list + strategies with full customization of `synchronous_standby_names`. + - Safety mechanism to stop the cluster on WAL disk space exhaustion to simplify + recovery by resizing storage. + - Delayed replicas via `.spec.replica.minApplyDelay` using PostgreSQL `recovery_min_apply_delay`. + - Post-init SQL can now be provided via multiple ConfigMaps/Secrets using `postInitSQLRefs` + and `postInitTemplateSQLRefs`. + - PostgreSQL 17 support for `allow_alter_system` via `.spec.postgresql.enableAlterSystem`. + - 'Metrics/query improvements: customizable metric/column names and predicate + queries; PgBouncer 1.23 metrics support in Pooler collector.' + - New annotation `reconcilePodSpec` on Cluster/Pooler to control pod restarts + after pod spec changes. + - '`cnpg` plugin improvements including control-plane node install option and + enhanced status output for distributed topology tokens.' + breaking_changes: + - '`role` label in Service and PodDisruptionBudget selectors is deprecated in + favor of `cnpg.io/instanceRole`; any tooling or custom resources depending + on the old selector/label should be updated.' + - Default PodAntiAffinity fix for PostgreSQL pods will trigger a rollout of + all instances when upgrading the operator (even with online upgrades enabled); + plan for controlled disruption/capacity during the upgrade. + - 'Readiness behavior tightened: streaming replicas that never connected to + primary now fail readiness, which may change rollout/alerting behavior in + misconfigured or partitioned environments.' chart_version: 0.22.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.24.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.24.0 - version: 1.23.0 - kube: ['1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Introduced PostgreSQL Image Catalogs via new `ClusterImageCatalog` - and `ImageCatalog` CRDs; clusters can reference them with `.spec.imageCatalogRef` - as an alternative to `imageName` and a future default., Added synchronization - of user-defined physical replication slots from primary to replicas using - `replicationSlots.synchronizeReplicas`., Added `.spec.enablePDB` to control/disable - PodDisruptionBudgets (notably helpful for single-instance clusters and maintenance - evictions)., Allows transitioning an existing cluster into replica mode - to simplify cross-datacenter switchover operations., Connection pooler Service - is now customizable (type/labels/annotations)., Supports configuring PostgreSQL - `wal_log_hints` parameter., Automatically generated connection URI secrets - can use FQDNs., Improved restore behavior by cleaning up instance Pods not - owned by the Cluster and adding better error detection for `barman-cloud-wal-restore`., - '`kubectl cnpg` plugin improvements: better argument handling, status output - includes PDBs, backup progress handling, and `sync-sequences` robustness.'] - breaking_changes: ['Support policy change: CloudNativePG now focuses on one - supported minor release at a time (instead of two), with 3 months supplementary - support for the previous minor. Plan upgrades accordingly.'] + kube: + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Introduced PostgreSQL Image Catalogs via new `ClusterImageCatalog` and `ImageCatalog` + CRDs; clusters can reference them with `.spec.imageCatalogRef` as an alternative + to `imageName` and a future default. + - Added synchronization of user-defined physical replication slots from primary + to replicas using `replicationSlots.synchronizeReplicas`. + - Added `.spec.enablePDB` to control/disable PodDisruptionBudgets (notably helpful + for single-instance clusters and maintenance evictions). + - Allows transitioning an existing cluster into replica mode to simplify cross-datacenter + switchover operations. + - Connection pooler Service is now customizable (type/labels/annotations). + - Supports configuring PostgreSQL `wal_log_hints` parameter. + - Automatically generated connection URI secrets can use FQDNs. + - Improved restore behavior by cleaning up instance Pods not owned by the Cluster + and adding better error detection for `barman-cloud-wal-restore`. + - '`kubectl cnpg` plugin improvements: better argument handling, status output + includes PDBs, backup progress handling, and `sync-sequences` robustness.' + breaking_changes: + - 'Support policy change: CloudNativePG now focuses on one supported minor release + at a time (instead of two), with 3 months supplementary support for the previous + minor. Plan upgrades accordingly.' chart_version: 0.21.1 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.23.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.23.0 - version: 1.22.0 - kube: ['1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['**Declarative tablespaces**: new `.spec.tablespaces` stanza in the - `Cluster` CRD to create/manage tablespaces through the operator lifecycle.', - '**Temporary tablespaces**: `.spec.tablespaces[*].temporary` lets you designate - a tablespace for temp operations by wiring it into Postgres `temp_tablespaces`.', - '**Prometheus relabeling support**: you can now set `podMonitorRelabelings` - and `podMonitorMetricRelabelings` under `.spec.monitoring` for both `Cluster` - and `Pooler`.', '**Connection pooler scaling to zero**: `Pooler` resources - can now be scaled down to 0 instances, useful for pausing traffic without - deleting the resource.', '**Red Hat UBI 8 operator images**: new UBI-based - images are available, mainly for OLM-style deployments.'] - breaking_changes: ['**`ALTER SYSTEM` is now disabled by default**: if you relied - on the operator using `ALTER SYSTEM` to apply configuration, you must explicitly - re-enable it following the upgrade documentation.', '**PostgreSQL default - image bumped to 16.1**: new clusters (and any clusters that track the default - operand image) will move from 16.0 to 16.1; validate extension/compatibility - expectations before rollout.', '**TLS defaults tightened for Postgres 12+**: - TLSv1.3 is enforced by default, which can break older clients or environments - that require lower protocol versions unless you override the relevant `ssl_*` - GUCs.'] + kube: + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - '**Declarative tablespaces**: new `.spec.tablespaces` stanza in the `Cluster` + CRD to create/manage tablespaces through the operator lifecycle.' + - '**Temporary tablespaces**: `.spec.tablespaces[*].temporary` lets you designate + a tablespace for temp operations by wiring it into Postgres `temp_tablespaces`.' + - '**Prometheus relabeling support**: you can now set `podMonitorRelabelings` + and `podMonitorMetricRelabelings` under `.spec.monitoring` for both `Cluster` + and `Pooler`.' + - '**Connection pooler scaling to zero**: `Pooler` resources can now be scaled + down to 0 instances, useful for pausing traffic without deleting the resource.' + - '**Red Hat UBI 8 operator images**: new UBI-based images are available, mainly + for OLM-style deployments.' + breaking_changes: + - '**`ALTER SYSTEM` is now disabled by default**: if you relied on the operator + using `ALTER SYSTEM` to apply configuration, you must explicitly re-enable + it following the upgrade documentation.' + - '**PostgreSQL default image bumped to 16.1**: new clusters (and any clusters + that track the default operand image) will move from 16.0 to 16.1; validate + extension/compatibility expectations before rollout.' + - '**TLS defaults tightened for Postgres 12+**: TLSv1.3 is enforced by default, + which can break older clients or environments that require lower protocol + versions unless you override the relevant `ssl_*` GUCs.' chart_version: 0.20.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.22.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.22.0 - version: 1.21.0 - kube: ['1.28', '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Kubernetes VolumeSnapshot support for backup and recovery (initially - cold backups from a standby), enabling incremental/differential snapshot-based - workflows.', OLM/OperatorHub installation support via a stable channel for - the latest patch of the latest minor release., Managed role lifecycle improvements - (from 1.20) and new cnpg kubectl plugin enhancements (status includes primary - timestamp/uptime; logs include previous logs)., 'Recovery/replica bootstrap - enhancements using consistent sets of volume snapshots, including full and - PITR recovery.'] - breaking_changes: ['Default operational timeouts changed significantly: stopDelay - now 1800s (was 30s), startDelay now 3600s (was 30s), switchoverDelay now - 3600s; plus new smartShutdownTimeout affecting shutdown behavior.', 'Liveness - probe behavior changed: initial delay replaced with a Kubernetes startupProbe, - which can affect readiness/liveness timing assumptions.', 'Superuser access - is disabled by default (security hardening), which may break workflows expecting - direct superuser access.', 'Replication slots for HA are enabled by default, - which can change WAL retention behavior and storage requirements.', The - legacy `postgresql` label is no longer supported; use `cnpg.io/cluster` - instead., 'kubectl plugin command change: `cnpg snapshot` replaced by `cnpg - backup -m volumeSnapshot`; label `role` is being deprecated in favor of - `cnpg.io/instanceRole` (and new `cnpg.io/instanceRole` added).'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Kubernetes VolumeSnapshot support for backup and recovery (initially cold + backups from a standby), enabling incremental/differential snapshot-based + workflows. + - OLM/OperatorHub installation support via a stable channel for the latest patch + of the latest minor release. + - Managed role lifecycle improvements (from 1.20) and new cnpg kubectl plugin + enhancements (status includes primary timestamp/uptime; logs include previous + logs). + - Recovery/replica bootstrap enhancements using consistent sets of volume snapshots, + including full and PITR recovery. + breaking_changes: + - 'Default operational timeouts changed significantly: stopDelay now 1800s (was + 30s), startDelay now 3600s (was 30s), switchoverDelay now 3600s; plus new + smartShutdownTimeout affecting shutdown behavior.' + - 'Liveness probe behavior changed: initial delay replaced with a Kubernetes + startupProbe, which can affect readiness/liveness timing assumptions.' + - Superuser access is disabled by default (security hardening), which may break + workflows expecting direct superuser access. + - Replication slots for HA are enabled by default, which can change WAL retention + behavior and storage requirements. + - The legacy `postgresql` label is no longer supported; use `cnpg.io/cluster` + instead. + - 'kubectl plugin command change: `cnpg snapshot` replaced by `cnpg backup -m + volumeSnapshot`; label `role` is being deprecated in favor of `cnpg.io/instanceRole` + (and new `cnpg.io/instanceRole` added).' chart_version: 0.19.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.21.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.21.0 - version: 1.20.0 - kube: ['1.27', '1.26', '1.25', '1.24'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Declarative role management via `managed.roles` in the Cluster spec - to manage PostgreSQL roles lifecycle (create/alter) from Kubernetes., 'Declarative - cluster hibernation via the `cnpg.io/hibernation` annotation to scale a - cluster down to zero pods while retaining PVCs, with an inverse restore - procedure.'] - breaking_changes: ['Default behavior changes for newly created Clusters with - replicas: backup-from-standby is enabled by default unless `.spec.backup.target` - is explicitly set to `primary`.', 'Default behavior changes for newly created - Clusters: `primaryUpdateMethod` now defaults to `restart` (unsupervised - rolling update completes by restarting the primary) unless explicitly set - to `switchover`.', 'The `-any` Service is now disabled by default, which - may affect clients relying on that Service name/type.'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Declarative role management via `managed.roles` in the Cluster spec to manage + PostgreSQL roles lifecycle (create/alter) from Kubernetes. + - Declarative cluster hibernation via the `cnpg.io/hibernation` annotation to + scale a cluster down to zero pods while retaining PVCs, with an inverse restore + procedure. + breaking_changes: + - 'Default behavior changes for newly created Clusters with replicas: backup-from-standby + is enabled by default unless `.spec.backup.target` is explicitly set to `primary`.' + - 'Default behavior changes for newly created Clusters: `primaryUpdateMethod` + now defaults to `restart` (unsupervised rolling update completes by restarting + the primary) unless explicitly set to `switchover`.' + - The `-any` Service is now disabled by default, which may affect clients relying + on that Service name/type. chart_version: 0.18.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.20.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.20.0 - version: 1.19.0 - kube: ['1.26', '1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Cluster-managed physical replication slots for HA, automatically - creating and managing slots for each hot-standby replica.', 'Cluster hibernation - via `kubectl cnpg hibernate on/off/status`, which removes cluster-generated - resources except the primary PVCs.', Backup from a standby using `.spec.backup.target=prefer-standby` - to take a base backup from the most aligned replica., Delayed failover via - `failoverDelay` to postpone failover after the primary is detected unhealthy., - Support for Kubernetes projected volumes in pod specs., Support for custom - environment variables to control the PostgreSQL server process., New `kubectl - cnpg backup` plugin command to trigger a base backup., 'Improved separate - WAL volume support, including moving WAL to a dedicated volume on existing - clusters and added WAL-related Prometheus metrics.'] - breaking_changes: ['PostgreSQL 10 is no longer supported; CloudNativePG now - supports PostgreSQL 11+ (plan migrations accordingly, ideally toward PostgreSQL - 15).'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Cluster-managed physical replication slots for HA, automatically creating + and managing slots for each hot-standby replica. + - Cluster hibernation via `kubectl cnpg hibernate on/off/status`, which removes + cluster-generated resources except the primary PVCs. + - Backup from a standby using `.spec.backup.target=prefer-standby` to take a + base backup from the most aligned replica. + - Delayed failover via `failoverDelay` to postpone failover after the primary + is detected unhealthy. + - Support for Kubernetes projected volumes in pod specs. + - Support for custom environment variables to control the PostgreSQL server + process. + - New `kubectl cnpg backup` plugin command to trigger a base backup. + - Improved separate WAL volume support, including moving WAL to a dedicated + volume on existing clusters and added WAL-related Prometheus metrics. + breaking_changes: + - PostgreSQL 10 is no longer supported; CloudNativePG now supports PostgreSQL + 11+ (plan migrations accordingly, ideally toward PostgreSQL 15). chart_version: 0.17.0 - images: ['busybox:latest', 'ghcr.io/cloudnative-pg/cloudnative-pg:1.19.0'] + images: + - busybox:latest + - ghcr.io/cloudnative-pg/cloudnative-pg:1.19.0 - version: 1.18.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Cluster-managed physical replication slots for HA: the operator - can automatically create/manage physical replication slots for each hot-standby - replica on both primary and standby clusters.', 'Postgres cluster hibernation - (via cnpg kubectl plugin): you can hibernate a cluster (destroy operator-managed - resources but keep the primary PVCs) and resume it later.', 'New cnpg plugin - subcommands: `hibernate`, `pgbench` (generate a benchmarking Job), and `install` - (generate operator install manifests).', PostgreSQL 15.0 becomes the default - PostgreSQL major/minor version for new clusters., 'Security hardening: add - `SeccompProfile` to pods and containers.'] - breaking_changes: ['Default PostgreSQL version changes to 15.0 for newly created - clusters; if you rely on implicit defaults, you may get a different major - version than before (explicitly set `.spec.imageName`/`.spec.postgresql` - version to avoid surprises).', Cluster-managed replication slots may change - replication/slot behavior and resource usage compared to manual slot management; - review settings/monitoring if you previously managed physical slots yourself.] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Cluster-managed physical replication slots for HA: the operator can automatically + create/manage physical replication slots for each hot-standby replica on both + primary and standby clusters.' + - 'Postgres cluster hibernation (via cnpg kubectl plugin): you can hibernate + a cluster (destroy operator-managed resources but keep the primary PVCs) and + resume it later.' + - 'New cnpg plugin subcommands: `hibernate`, `pgbench` (generate a benchmarking + Job), and `install` (generate operator install manifests).' + - PostgreSQL 15.0 becomes the default PostgreSQL major/minor version for new + clusters. + - 'Security hardening: add `SeccompProfile` to pods and containers.' + breaking_changes: + - Default PostgreSQL version changes to 15.0 for newly created clusters; if + you rely on implicit defaults, you may get a different major version than + before (explicitly set `.spec.imageName`/`.spec.postgresql` version to avoid + surprises). + - Cluster-managed replication slots may change replication/slot behavior and + resource usage compared to manual slot management; review settings/monitoring + if you previously managed physical slots yourself. chart_version: 0.16.0 - images: ['busybox:latest', 'ghcr.io/cloudnative-pg/cloudnative-pg:1.18.0'] + images: + - busybox:latest + - ghcr.io/cloudnative-pg/cloudnative-pg:1.18.0 - version: 1.17.0 - kube: ['1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['**v1.16.0:** Adds `bootstrap.initdb.import` to import schemas/data - over the network from an existing PostgreSQL (including outside Kubernetes) - using logical backup/restore; can also be used for major PostgreSQL upgrades - on a new cluster (supports `microservice` and `monolith` import modes).', - '**v1.16.0:** Adds label-based anti-affinity rules for synchronous replicas - so they can be scheduled on nodes with different characteristics (e.g., - different AZ than the primary).', '**v1.17.0:** Adds optional `walStorage` - to place `pg_wal` on a dedicated volume separate from the main `storage`/`PGDATA` - volume to improve write-heavy performance (must be decided at cluster creation).', - '**v1.17.0:** Improves PgBouncer by allowing configuration of low-level TCP - network settings.', '**v1.17.0:** Improves UX/ops with `kubectl cnpg destroy` - to delete an instance and its associated PVCs.'] - breaking_changes: ['**v1.17.0:** `walStorage` cannot be added/removed on an - existing running cluster; enabling it requires creating a new cluster (or - recreating) with the setting present from day 1.', '**v1.16.0:** Backup - tooling requirement bump: Barman >= 3.0.0 is required for future PostgreSQL - 15 support; verify your backup image/tooling versions are compatible before - upgrading.'] + kube: + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - '**v1.16.0:** Adds `bootstrap.initdb.import` to import schemas/data over the + network from an existing PostgreSQL (including outside Kubernetes) using logical + backup/restore; can also be used for major PostgreSQL upgrades on a new cluster + (supports `microservice` and `monolith` import modes).' + - '**v1.16.0:** Adds label-based anti-affinity rules for synchronous replicas + so they can be scheduled on nodes with different characteristics (e.g., different + AZ than the primary).' + - '**v1.17.0:** Adds optional `walStorage` to place `pg_wal` on a dedicated + volume separate from the main `storage`/`PGDATA` volume to improve write-heavy + performance (must be decided at cluster creation).' + - '**v1.17.0:** Improves PgBouncer by allowing configuration of low-level TCP + network settings.' + - '**v1.17.0:** Improves UX/ops with `kubectl cnpg destroy` to delete an instance + and its associated PVCs.' + breaking_changes: + - '**v1.17.0:** `walStorage` cannot be added/removed on an existing running + cluster; enabling it requires creating a new cluster (or recreating) with + the setting present from day 1.' + - '**v1.16.0:** Backup tooling requirement bump: Barman >= 3.0.0 is required + for future PostgreSQL 15 support; verify your backup image/tooling versions + are compatible before upgrading.' chart_version: 0.15.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.17.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.17.0 - version: 1.16.0 - kube: ['1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Operator now defaults operand/PostgreSQL image to 14.4 (was\ - \ earlier in 1.15.x); verify your clusters\u2019 `.spec.imageName`/operand\ - \ image pinning if you rely on a specific minor version.", 'Backup/WAL archiving - conditions now use Kubernetes built-in Condition types; if you have tooling - that parses old custom condition fields, validate it against the new status - output.', Kubernetes 1.24 is supported (and Barman >= 3.0.0 is required - for future PostgreSQL 15 support).] - features: ["Offline logical import/major upgrade workflow via `bootstrap.initdb.import`,\ - \ supporting \u201Cmicroservice\u201D (single DB) and \u201Cmonolith\u201D\ - \ (multiple DBs + roles) import from an external or in-cluster PostgreSQL\ - \ using pg_dump/pg_restore.", 'Label-based anti-affinity for synchronous - replicas to ensure sync standbys land on nodes with different characteristics - (e.g., different AZ) than the primary.', Azure AD Workload Identity support - for Barman Cloud backups via `inheritFromAzureAD`., New `barmanObjectStore.s3Credentials.region` - value to set AWS region for backup and recovery object stores., Recovery/cloning - can now redefine app DB name/owner/secret when restoring from object store - or cloning via pg_basebackup (previously only initdb bootstrap).] + kube: + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Operator now defaults operand/PostgreSQL image to 14.4 (was earlier in 1.15.x);\ + \ verify your clusters\u2019 `.spec.imageName`/operand image pinning if you\ + \ rely on a specific minor version." + - Backup/WAL archiving conditions now use Kubernetes built-in Condition types; + if you have tooling that parses old custom condition fields, validate it against + the new status output. + - Kubernetes 1.24 is supported (and Barman >= 3.0.0 is required for future PostgreSQL + 15 support). + features: + - "Offline logical import/major upgrade workflow via `bootstrap.initdb.import`,\ + \ supporting \u201Cmicroservice\u201D (single DB) and \u201Cmonolith\u201D\ + \ (multiple DBs + roles) import from an external or in-cluster PostgreSQL\ + \ using pg_dump/pg_restore." + - Label-based anti-affinity for synchronous replicas to ensure sync standbys + land on nodes with different characteristics (e.g., different AZ) than the + primary. + - Azure AD Workload Identity support for Barman Cloud backups via `inheritFromAzureAD`. + - New `barmanObjectStore.s3Credentials.region` value to set AWS region for backup + and recovery object stores. + - Recovery/cloning can now redefine app DB name/owner/secret when restoring + from object store or cloning via pg_basebackup (previously only initdb bootstrap). breaking_changes: [] chart_version: 0.14.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.16.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.16.0 - version: 1.15.0 - kube: ['1.23', '1.22', '1.21'] + kube: + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null chart_version: 0.13.0 - images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.15.0'] + images: + - ghcr.io/cloudnative-pg/cloudnative-pg:1.15.0 name: cloudnative-pg - icon: https://github.com/kubernetes/kubernetes/raw/master/logo/logo.png git_url: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler @@ -15456,7 +18581,8 @@ addons: chart_name: cluster-autoscaler versions: - version: 1.35.0 - kube: ['1.35'] + kube: + - '1.35' requirements: [] incompatibilities: [] summary: @@ -15467,377 +18593,461 @@ addons: \ verify the chart values render `imagePullSecrets` where you expect for both\ \ main and updater components.\n- **Image tag bump**: update to `registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0`\ \ (and arch-specific images)." - chart_updates: [Chart now supports setting a VPA recommender via `vpa.recommender` - (#8567)., Updater deployment now receives `imagePullSecrets` (#8711).] - features: [CapacityBuffers v1beta1 API is released and integrated with ResourceQuotas; - buffer replicas will shrink to respect quotas., Autoscaler can now account - for CSI volume limits when scaling nodes., 'Expanded accelerator resource - support (amd.com/gpu, gpu.intel.com/xe, habana.ai/gaudi).', 'New tuning/observability - options: `--max-node-startup-time`, `--predicate-parallelism`, and new/updated - metrics including node deletion duration histogram and scale-down simulation - timing.', 'Optimized scaling loop interval is enabled by default, changing - default behavior toward faster loops.'] - breaking_changes: [CapacityBuffers CRD scope changes from **Cluster** to **Namespaced**; - existing CRs/automation must be migrated accordingly., External gRPC cloudprovider - APIs deprecate several fields (nodeInfo/time fields) in favor of byte/duration - equivalents; external integrations should update before removals land., - '`--scale-down-enabled` is deprecated; plan to remove/replace usage in automation/scripts.', - AWS provider switches to AWS SDK v2 and deprecates v1; custom builds/plugins - depending on v1 need adjustment.] + chart_updates: + - Chart now supports setting a VPA recommender via `vpa.recommender` (#8567). + - Updater deployment now receives `imagePullSecrets` (#8711). + features: + - CapacityBuffers v1beta1 API is released and integrated with ResourceQuotas; + buffer replicas will shrink to respect quotas. + - Autoscaler can now account for CSI volume limits when scaling nodes. + - Expanded accelerator resource support (amd.com/gpu, gpu.intel.com/xe, habana.ai/gaudi). + - 'New tuning/observability options: `--max-node-startup-time`, `--predicate-parallelism`, + and new/updated metrics including node deletion duration histogram and scale-down + simulation timing.' + - Optimized scaling loop interval is enabled by default, changing default behavior + toward faster loops. + breaking_changes: + - CapacityBuffers CRD scope changes from **Cluster** to **Namespaced**; existing + CRs/automation must be migrated accordingly. + - External gRPC cloudprovider APIs deprecate several fields (nodeInfo/time fields) + in favor of byte/duration equivalents; external integrations should update + before removals land. + - '`--scale-down-enabled` is deprecated; plan to remove/replace usage in automation/scripts.' + - AWS provider switches to AWS SDK v2 and deprecates v1; custom builds/plugins + depending on v1 need adjustment. chart_version: 9.59.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0 - version: 1.34.2 - kube: ['1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['In 1.33.x, DRA (Dynamic Resource Allocation) support matured: faster/safer - snapshotting (DeltaSnapshotStore, patch-based snapshots) and better handling - of node readiness after scale-up; Cluster API provider gained better DRA - handling for scale-from-zero.', 'Performance/behavior improvements in 1.33.x: - parallelized pod addition when building snapshots (tunable via `--cluster-snapshot-parallelization`), - improved ProvisioningRequest processing (less delay, instance filtering - via `--checkCapacityProvisioningRequestProcessorInstance`), and default - expander changed to `least-waste` (instead of `random`).', 'In 1.34.2, multiple - correctness/stability fixes landed: proactive scale-up no longer injects - fake pods for scheduling-gated pods, and a panic in SimulateNodeRemoval - is prevented when node info is missing.', '1.34.2 includes Cluster API improvements - (process managed labels) and dependency bumps to Kubernetes 1.34.2, plus - Azure SKU list/testing updates and a Capacity Buffers CRD scope fix backport.'] - breaking_changes: ['Removed deprecated flags in the 1.33 line; upgrades will - fail or behave unexpectedly if your deployment still sets any of: `--max-autoprovisioned-node-group-count`, - `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, - or `--max-empty-bulk-delete`.', 'Default expander changed from `random` - to `least-waste` in 1.33; if you relied on prior expander behavior, explicitly - set `--expander=` to keep the old selection strategy.'] + kube: + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'In 1.33.x, DRA (Dynamic Resource Allocation) support matured: faster/safer + snapshotting (DeltaSnapshotStore, patch-based snapshots) and better handling + of node readiness after scale-up; Cluster API provider gained better DRA handling + for scale-from-zero.' + - 'Performance/behavior improvements in 1.33.x: parallelized pod addition when + building snapshots (tunable via `--cluster-snapshot-parallelization`), improved + ProvisioningRequest processing (less delay, instance filtering via `--checkCapacityProvisioningRequestProcessorInstance`), + and default expander changed to `least-waste` (instead of `random`).' + - 'In 1.34.2, multiple correctness/stability fixes landed: proactive scale-up + no longer injects fake pods for scheduling-gated pods, and a panic in SimulateNodeRemoval + is prevented when node info is missing.' + - 1.34.2 includes Cluster API improvements (process managed labels) and dependency + bumps to Kubernetes 1.34.2, plus Azure SKU list/testing updates and a Capacity + Buffers CRD scope fix backport. + breaking_changes: + - 'Removed deprecated flags in the 1.33 line; upgrades will fail or behave unexpectedly + if your deployment still sets any of: `--max-autoprovisioned-node-group-count`, + `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, + or `--max-empty-bulk-delete`.' + - Default expander changed from `random` to `least-waste` in 1.33; if you relied + on prior expander behavior, explicitly set `--expander=` to keep the old selection + strategy. chart_version: 9.53.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.2'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.2 - version: 1.33.0 - kube: ['1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['DRA (Dynamic Resource Allocation) work matured in 1.33.0 with more - efficient snapshot processing (DeltaSnapshotStore, patch-based snapshots) - and better handling of node readiness after scale-up.', 'Performance improvements: - parallelized adding pods to the cluster snapshot for scale-up; tunable via - `--cluster-snapshot-parallelization`.', 'ProvisioningRequest improvements: - ability to filter CheckCapacity ProvisioningRequests by autoscaler instance; - faster/frequent processing of newly created ProvisioningRequests; additional - throughput improvements (parallel condition marking).', 'Behavioral improvements: - default expander changed from `random` to `least-waste` to avoid selecting - unnecessarily expensive nodes.', 'Provider enhancements: Cluster API provider - can handle DRA devices for scale-from-0; AWS ignores unrecognized provider - IDs; Azure VM node pools enabled; GCE pricing and diskTypes request resilience - updates; various provider bug fixes (Azure crash, Kamatera alignment, GCE - memory leak).'] - breaking_changes: ['Removed deprecated flags in 1.33.0: `--max-autoprovisioned-node-group-count`, - `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, - and `--max-empty-bulk-delete` (previously deprecated; in 1.32.0 it still - worked but warned).', 'If you relied on the default expander behavior, note - the default changed to `least-waste`; set `--expander=random` explicitly - to preserve prior behavior.'] + kube: + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - DRA (Dynamic Resource Allocation) work matured in 1.33.0 with more efficient + snapshot processing (DeltaSnapshotStore, patch-based snapshots) and better + handling of node readiness after scale-up. + - 'Performance improvements: parallelized adding pods to the cluster snapshot + for scale-up; tunable via `--cluster-snapshot-parallelization`.' + - 'ProvisioningRequest improvements: ability to filter CheckCapacity ProvisioningRequests + by autoscaler instance; faster/frequent processing of newly created ProvisioningRequests; + additional throughput improvements (parallel condition marking).' + - 'Behavioral improvements: default expander changed from `random` to `least-waste` + to avoid selecting unnecessarily expensive nodes.' + - 'Provider enhancements: Cluster API provider can handle DRA devices for scale-from-0; + AWS ignores unrecognized provider IDs; Azure VM node pools enabled; GCE pricing + and diskTypes request resilience updates; various provider bug fixes (Azure + crash, Kamatera alignment, GCE memory leak).' + breaking_changes: + - 'Removed deprecated flags in 1.33.0: `--max-autoprovisioned-node-group-count`, + `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, + and `--max-empty-bulk-delete` (previously deprecated; in 1.32.0 it still worked + but warned).' + - If you relied on the default expander behavior, note the default changed to + `least-waste`; set `--expander=random` explicitly to preserve prior behavior. chart_version: 9.51.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.0 - version: 1.32.0 - kube: ['1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Experimental Dynamic Resource Allocation (DRA) autoscaling support - (disabled by default); enable with `--enable-dynamic-resource-allocation` - plus the cluster `DynamicResourceAllocation` feature gate and additional - RBAC for `resource.k8s.io` objects., 'ProvisioningRequest improvements: - v1 CRD added; faster/frequent loops when ProvisioningRequest seen; batch - processing for CheckCapacity requests with new batch-size/timebox flags; - new parameter limiting retries; parallel marking of CheckCapacity conditions - to increase throughput.', 'Operational behavior tweaks: best-effort eviction - of DaemonSet pods when draining empty nodes; custom lease resource name - via `--lease-resource-name`; new flag `--force-delete-long-unregistered-nodes` - to remove long-unregistered nodes even if it violates nodegroup min size - constraints.', 'Cloud-provider enhancements: AWS adds Nvidia L40s and g6e - instance support and optimizes instance requirement caching; Azure improves - scale-from-zero accuracy, adds cache/fast-delete flags, spot pool scaling - fixes, and updated SKU list; Hetzner adds custom endpoint and placement - group support; OCI adds node-group auto-discovery support; Exoscale adds - `--nodes` flag support.', 'gRPC expander behavior change: if server returns - nil best options, client returns nil (avoid unexpected behavior).'] - breaking_changes: [Removed legacy scale-down code (may affect behavior/metrics; - validate scale-down outcomes in staging)., '`--parallel-drain` flag removed; - use `--max-drain-parallelism` (set to 1 to preserve single-node drain behavior).', - 'Azure GPU node identification changed: VMSS GPU nodes are now identified - by `kubernetes.azure.com/accelerator` label instead of `accelerator` (update - labels/queries/taints/affinity accordingly).', '`--max-empty-bulk-delete` - deprecated; still works but will be replaced by `--max-scale-down-parallelism` - in a future release (start migrating now).'] + kube: + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Experimental Dynamic Resource Allocation (DRA) autoscaling support (disabled + by default); enable with `--enable-dynamic-resource-allocation` plus the cluster + `DynamicResourceAllocation` feature gate and additional RBAC for `resource.k8s.io` + objects. + - 'ProvisioningRequest improvements: v1 CRD added; faster/frequent loops when + ProvisioningRequest seen; batch processing for CheckCapacity requests with + new batch-size/timebox flags; new parameter limiting retries; parallel marking + of CheckCapacity conditions to increase throughput.' + - 'Operational behavior tweaks: best-effort eviction of DaemonSet pods when + draining empty nodes; custom lease resource name via `--lease-resource-name`; + new flag `--force-delete-long-unregistered-nodes` to remove long-unregistered + nodes even if it violates nodegroup min size constraints.' + - 'Cloud-provider enhancements: AWS adds Nvidia L40s and g6e instance support + and optimizes instance requirement caching; Azure improves scale-from-zero + accuracy, adds cache/fast-delete flags, spot pool scaling fixes, and updated + SKU list; Hetzner adds custom endpoint and placement group support; OCI adds + node-group auto-discovery support; Exoscale adds `--nodes` flag support.' + - 'gRPC expander behavior change: if server returns nil best options, client + returns nil (avoid unexpected behavior).' + breaking_changes: + - Removed legacy scale-down code (may affect behavior/metrics; validate scale-down + outcomes in staging). + - '`--parallel-drain` flag removed; use `--max-drain-parallelism` (set to 1 + to preserve single-node drain behavior).' + - 'Azure GPU node identification changed: VMSS GPU nodes are now identified + by `kubernetes.azure.com/accelerator` label instead of `accelerator` (update + labels/queries/taints/affinity accordingly).' + - '`--max-empty-bulk-delete` deprecated; still works but will be replaced by + `--max-scale-down-parallelism` in a future release (start migrating now).' chart_version: 9.46.6 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.0 - version: 1.31.0 - kube: ['1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Proactive scale-up (disabled by default) can provision nodes before - pods are fully created/marked unschedulable; tunable with the new `--pod-injection-limit` - flag to avoid instability on large clusters., ProvisioningRequest v1 API - support was added., New `least-nodes` expander option was introduced to - bias scale-ups toward using fewer nodes., New `--max-binpacking-time` flag - caps binpacking duration to prevent rare unresponsive behavior with very - large pending pod sets., Improved handling of failed scale-ups (faster recovery - when multiple quota/stockout errors occur)., Cluster Autoscaler can use - in-cluster Kubernetes config when self-hosted as a pod (simplifies auth/config - in many deployments)., 'Provider improvements: AWS fixes around placeholder - vs real instance scale-down and taints on MNGs at size 0; Azure config/interface - improvements and new features; GCE performance improvements for listing - instances; Cluster API provider gains per-nodegroup autoscaling options; - Hetzner backoff fix.'] - breaking_changes: ['Azure ACTION REQUIRED: VMSS GPU node groups must now include - the `kubernetes.azure.com/accelerator` label in addition to `accelerator`, - otherwise GPU nodes may not be recognized/handled correctly.', 'Azure configuration - field and environment variable names were renamed (old names still work - and take precedence), but teams should update configs to the new names and - reference the cloud-provider-azure configuration docs going forward.'] + kube: + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Proactive scale-up (disabled by default) can provision nodes before pods are + fully created/marked unschedulable; tunable with the new `--pod-injection-limit` + flag to avoid instability on large clusters. + - ProvisioningRequest v1 API support was added. + - New `least-nodes` expander option was introduced to bias scale-ups toward + using fewer nodes. + - New `--max-binpacking-time` flag caps binpacking duration to prevent rare + unresponsive behavior with very large pending pod sets. + - Improved handling of failed scale-ups (faster recovery when multiple quota/stockout + errors occur). + - Cluster Autoscaler can use in-cluster Kubernetes config when self-hosted as + a pod (simplifies auth/config in many deployments). + - 'Provider improvements: AWS fixes around placeholder vs real instance scale-down + and taints on MNGs at size 0; Azure config/interface improvements and new + features; GCE performance improvements for listing instances; Cluster API + provider gains per-nodegroup autoscaling options; Hetzner backoff fix.' + breaking_changes: + - 'Azure ACTION REQUIRED: VMSS GPU node groups must now include the `kubernetes.azure.com/accelerator` + label in addition to `accelerator`, otherwise GPU nodes may not be recognized/handled + correctly.' + - Azure configuration field and environment variable names were renamed (old + names still work and take precedence), but teams should update configs to + the new names and reference the cloud-provider-azure configuration docs going + forward. chart_version: 9.44.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.31.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.31.0 - version: 1.30.0 - kube: ['1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Provider rename: the former Packet cloud provider is now fully renamed - to Equinix Metal; in 1.30.0 you should use `--cloud-provider=equinixmetal` - and update any related env vars/configs if still referencing packet.', 'New - scale-down behavior control: `--scale-down-delay-type-local` lets you choose - whether the `--scale-down-delay-after-*` timers apply per nodegroup (local) - or across all nodegroups (global).', 'New scale-up backoff control: `--node-group-keep-backoff-out-of-resources` - makes CA honor the full backoff window after out-of-resources errors during - scale-up.', 'Operational observability improvements: node group health/backoff - metrics added; `function_duration_seconds` metric uses finer exponential - buckets; status ConfigMap now stores status data as YAML and includes scale-up - backoff error info.', 'Additional optional tuning: restored QPS limit flags; - added `frequent-loops-enabled` (disabled by default) to run iterations more - frequently.'] - breaking_changes: ['Cloud provider rename impact: if you still use `--cloud-provider=packet` - or Packet-specific env vars, migrate to Equinix Metal naming; Packet is - effectively removed/renamed in 1.30.0.', 'Status ConfigMap format change: - the `cluster-autoscaler-status` ConfigMap status field switches to YAML, - so any scripts/parsers expecting the previous format must be updated.', - 'ProvisioningRequest is not actually available by default: code landed with - beta API but the feature flag is hard-disabled in 1.30.0; enabling requires - reverting #6755 and building custom binaries/images.'] + kube: + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Provider rename: the former Packet cloud provider is now fully renamed to + Equinix Metal; in 1.30.0 you should use `--cloud-provider=equinixmetal` and + update any related env vars/configs if still referencing packet.' + - 'New scale-down behavior control: `--scale-down-delay-type-local` lets you + choose whether the `--scale-down-delay-after-*` timers apply per nodegroup + (local) or across all nodegroups (global).' + - 'New scale-up backoff control: `--node-group-keep-backoff-out-of-resources` + makes CA honor the full backoff window after out-of-resources errors during + scale-up.' + - 'Operational observability improvements: node group health/backoff metrics + added; `function_duration_seconds` metric uses finer exponential buckets; + status ConfigMap now stores status data as YAML and includes scale-up backoff + error info.' + - 'Additional optional tuning: restored QPS limit flags; added `frequent-loops-enabled` + (disabled by default) to run iterations more frequently.' + breaking_changes: + - 'Cloud provider rename impact: if you still use `--cloud-provider=packet` + or Packet-specific env vars, migrate to Equinix Metal naming; Packet is effectively + removed/renamed in 1.30.0.' + - 'Status ConfigMap format change: the `cluster-autoscaler-status` ConfigMap + status field switches to YAML, so any scripts/parsers expecting the previous + format must be updated.' + - 'ProvisioningRequest is not actually available by default: code landed with + beta API but the feature flag is hard-disabled in 1.30.0; enabling requires + reverting #6755 and building custom binaries/images.' chart_version: 9.37.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.30.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.30.0 - version: 1.29.0 - kube: ['1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [New `--bypassed-scheduler-names` flag to let Cluster Autoscaler react - to pending pods without waiting for specific schedulers to mark them unschedulable; - can reduce scale-up latency but may increase CA load on very large bursts., - "New `--drain-priority-config` flag to tune scale-down/drain behavior by pod\ - \ priority; mutually exclusive with `--max-graceful-termination-sec` (defaults\ - \ preserve existing behavior if you don\u2019t use it).", "Optional dynamic\ - \ node delete delay with `--dynamic-node-delete-delay-after-taint-enabled`,\ - \ making taint\u2192drain delay adapt to API server latency for better scale-down\ - \ throughput and fewer race conditions.", Structured logging support via - `--logging-format json`., 'New metrics: `node_group_target_count` (requires - `--emit-per-nodegroup-metrics`) and `node_taints_count`.', New `--kube-api-content-type` - flag; default switches to protobuf (`application/vnd.kubernetes.protobuf`) - instead of JSON., 'Provider enhancements: AWS instance type list updates, - caching to reduce AWS API calls, better scale-from-zero with existing EBS - CSI PVs; Civo scale-from-zero; Cluster API arch override for scale-from-zero; - new Kwok cloud provider; gRPC timeout config and better optional-method - signaling.'] - breaking_changes: ['Deprecation: `--ignore-taint` / `ignore-taint.cluster-autoscaler.kubernetes.io/` - is deprecated in favor of `--status-taint`/`status-taint...` and `--startup-taint`/`startup-taint...`; - old flag still works but now behaves like startup taint.', 'Deprecation: - unused flags `--node-autoprovisioning-enabled` and `--max-autoprovisioned-node-group-count` - are deprecated and will be removed in a future release.', 'Azure: AKS `vmType` - removed (may require config cleanup for AKS users).', 'Equinix Metal: `packet` - cloud provider is deprecated in favor of `equinixmetal`; env var names changed - (with backward compatibility) and facilities support removed in favor of - metros.', 'GCE: `--gce-expander-ephemeral-storage-support` deprecated/ignored - because ephemeral storage support is always on.', Default API server content - type changes to protobuf unless overridden; can affect environments that - rely on JSON for debugging/proxies or have compatibility constraints.] + kube: + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - New `--bypassed-scheduler-names` flag to let Cluster Autoscaler react to pending + pods without waiting for specific schedulers to mark them unschedulable; can + reduce scale-up latency but may increase CA load on very large bursts. + - "New `--drain-priority-config` flag to tune scale-down/drain behavior by pod\ + \ priority; mutually exclusive with `--max-graceful-termination-sec` (defaults\ + \ preserve existing behavior if you don\u2019t use it)." + - "Optional dynamic node delete delay with `--dynamic-node-delete-delay-after-taint-enabled`,\ + \ making taint\u2192drain delay adapt to API server latency for better scale-down\ + \ throughput and fewer race conditions." + - Structured logging support via `--logging-format json`. + - 'New metrics: `node_group_target_count` (requires `--emit-per-nodegroup-metrics`) + and `node_taints_count`.' + - New `--kube-api-content-type` flag; default switches to protobuf (`application/vnd.kubernetes.protobuf`) + instead of JSON. + - 'Provider enhancements: AWS instance type list updates, caching to reduce + AWS API calls, better scale-from-zero with existing EBS CSI PVs; Civo scale-from-zero; + Cluster API arch override for scale-from-zero; new Kwok cloud provider; gRPC + timeout config and better optional-method signaling.' + breaking_changes: + - 'Deprecation: `--ignore-taint` / `ignore-taint.cluster-autoscaler.kubernetes.io/` + is deprecated in favor of `--status-taint`/`status-taint...` and `--startup-taint`/`startup-taint...`; + old flag still works but now behaves like startup taint.' + - 'Deprecation: unused flags `--node-autoprovisioning-enabled` and `--max-autoprovisioned-node-group-count` + are deprecated and will be removed in a future release.' + - 'Azure: AKS `vmType` removed (may require config cleanup for AKS users).' + - 'Equinix Metal: `packet` cloud provider is deprecated in favor of `equinixmetal`; + env var names changed (with backward compatibility) and facilities support + removed in favor of metros.' + - 'GCE: `--gce-expander-ephemeral-storage-support` deprecated/ignored because + ephemeral storage support is always on.' + - Default API server content type changes to protobuf unless overridden; can + affect environments that rely on JSON for debugging/proxies or have compatibility + constraints. chart_version: 9.36.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.29.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.29.0 - version: 1.28.2 - kube: ['1.28'] + kube: + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Updates Cluster Autoscaler to v1.28.2, which includes a fix for - a startup crash when using the `--leader-elect` flag.', Adds an official - s390x image variant for v1.28.2 (in addition to amd64/arm64).] + features: + - Updates Cluster Autoscaler to v1.28.2, which includes a fix for a startup + crash when using the `--leader-elect` flag. + - Adds an official s390x image variant for v1.28.2 (in addition to amd64/arm64). breaking_changes: [] chart_version: 9.34.1 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.28.2'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.28.2 - version: 1.27.2 - kube: ['1.27'] + kube: + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Updated Kubernetes vendor dependencies to 1.27.2 (aligns Cluster - Autoscaler with Kubernetes 1.27 APIs/behavior)., 'AliCloud: added support - for RRSA authentication.', 'AWS: added preview support for EC2 instance - type p4de.24xlarge.'] + features: + - Updated Kubernetes vendor dependencies to 1.27.2 (aligns Cluster Autoscaler + with Kubernetes 1.27 APIs/behavior). + - 'AliCloud: added support for RRSA authentication.' + - 'AWS: added preview support for EC2 instance type p4de.24xlarge.' breaking_changes: [] chart_version: 9.33.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.27.2'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.27.2 - version: 1.26.2 - kube: ['1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Improved scale-down behavior: Cluster Autoscaler no longer blocks - scale-down across the whole cluster just because some pods are waiting for - nodes to boot; it can scale down other node groups while scale-up is in - progress.', Added a gRPC expander and an external gRPC cloud provider option - for extensible scaling strategies/providers., Added a debugging snapshot - feature to capture autoscaler state for troubleshooting., Added `--node-info-cache-expire-time` - to control how long node templates are cached., 'Improved resilience: autoscaler - can continue operating even if it cannot remove some VMs that failed to - register to the cluster.', 'Performance fixes: faster reaction when many - similar pods exist (e.g., indexed Jobs), improved handling of large scale-ups, - and optimizations for large environments (e.g., GCE).', 'Improved correctness: - fixed multiple issues with daemonset accounting during scale-up calculations.', - Status ConfigMap now includes additional details about nodes with unready - resources., 'Cloud/provider enhancements: AWS early-abort when ASG has no - capacity and tag key `:` support; updated instance type lists for AWS/Azure; - Azure NP-series support; Cluster API multi-node delete fix; provider additions/renames - (OracleCloud, TencentCloud, Vultr; Packet->Equinix Metal).', 'Azure-specific - stability fix in 1.26.2: avoids crash in non-public clouds.'] - breaking_changes: ['Container image registry moved from `k8s.gcr.io` to `registry.k8s.io` - between 1.24.0 and 1.26.2; update your image repository references, mirrors, - and any allowlists accordingly.'] + kube: + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Improved scale-down behavior: Cluster Autoscaler no longer blocks scale-down + across the whole cluster just because some pods are waiting for nodes to boot; + it can scale down other node groups while scale-up is in progress.' + - Added a gRPC expander and an external gRPC cloud provider option for extensible + scaling strategies/providers. + - Added a debugging snapshot feature to capture autoscaler state for troubleshooting. + - Added `--node-info-cache-expire-time` to control how long node templates are + cached. + - 'Improved resilience: autoscaler can continue operating even if it cannot + remove some VMs that failed to register to the cluster.' + - 'Performance fixes: faster reaction when many similar pods exist (e.g., indexed + Jobs), improved handling of large scale-ups, and optimizations for large environments + (e.g., GCE).' + - 'Improved correctness: fixed multiple issues with daemonset accounting during + scale-up calculations.' + - Status ConfigMap now includes additional details about nodes with unready + resources. + - 'Cloud/provider enhancements: AWS early-abort when ASG has no capacity and + tag key `:` support; updated instance type lists for AWS/Azure; Azure NP-series + support; Cluster API multi-node delete fix; provider additions/renames (OracleCloud, + TencentCloud, Vultr; Packet->Equinix Metal).' + - 'Azure-specific stability fix in 1.26.2: avoids crash in non-public clouds.' + breaking_changes: + - Container image registry moved from `k8s.gcr.io` to `registry.k8s.io` between + 1.24.0 and 1.26.2; update your image repository references, mirrors, and any + allowlists accordingly. chart_version: 9.28.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.2'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.2 - version: 1.24.0 - kube: ['1.24'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Scale-down no longer blocks cluster-wide when some pods are waiting - for nodes to boot; scale-down can proceed in other node groups while scale-up - is happening elsewhere., 'New gRPC expander option and a new External gRPC - cloud provider, enabling custom expansion logic and providers over gRPC.', - New debugging snapshot capability to capture autoscaler state for troubleshooting., - "Improved resiliency: autoscaler can continue operating even if it can\u2019\ - t delete some VMs that never registered with the cluster.", New --node-info-cache-expire-time - flag to control caching duration for node templates., 'Provider additions/updates: - new OracleCloud, TencentCloud, and Vultr providers; Equinix Metal provider - rename from Packet; instance-type list updates across AWS/Azure and performance - improvements on GCE.'] - breaking_changes: ['If you build a custom Cluster Autoscaler image or import - its code, note that the previously deprecated NodeInfoProcessor interface - is removed in 1.24 and you must migrate to TemplateNodeInfoProvider; official - images are unaffected.', Go module import of Cluster Autoscaler 1.24.0 may - fail to compile for downstream projects importing CA code (known issue); - this does not affect running the official container image.] + kube: + - '1.24' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Scale-down no longer blocks cluster-wide when some pods are waiting for nodes + to boot; scale-down can proceed in other node groups while scale-up is happening + elsewhere. + - New gRPC expander option and a new External gRPC cloud provider, enabling + custom expansion logic and providers over gRPC. + - New debugging snapshot capability to capture autoscaler state for troubleshooting. + - "Improved resiliency: autoscaler can continue operating even if it can\u2019\ + t delete some VMs that never registered with the cluster." + - New --node-info-cache-expire-time flag to control caching duration for node + templates. + - 'Provider additions/updates: new OracleCloud, TencentCloud, and Vultr providers; + Equinix Metal provider rename from Packet; instance-type list updates across + AWS/Azure and performance improvements on GCE.' + breaking_changes: + - If you build a custom Cluster Autoscaler image or import its code, note that + the previously deprecated NodeInfoProcessor interface is removed in 1.24 and + you must migrate to TemplateNodeInfoProvider; official images are unaffected. + - Go module import of Cluster Autoscaler 1.24.0 may fail to compile for downstream + projects importing CA code (known issue); this does not affect running the + official container image. chart_version: 9.27.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.24.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.24.0 - version: 1.23.0 - kube: ['1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['`--expander` now supports a comma-separated list of expanders with - fallback behavior when the first returns multiple node groups.', New `--feature-gates` - flag to control Kubernetes feature gates for the embedded kube-scheduler - code used by Cluster Autoscaler., More reliable Kubernetes Events attached - to the `cluster-autoscaler-status` ConfigMap for every scale-up/scale-down - attempt (including failures)., Performance improvements for clusters with - many pods using projected volumes., 'AWS: Instance type discovery now uses - the EC2 `DescribeInstanceTypes` API (adds NVIDIA A100 support), reduces - API calls, and allows per-ASG scale-down options.', 'Azure: Per-VMSS scale-down - options, optional use of CLI credentials instead of service principal, and - NVIDIA A100 support.', 'GCE: Per-MIG scale-down options, ability to specify - SSD ephemeral-storage via instance templates enabling scale-from-0 for pods - requesting it, and reduced API calls.', New Brightbox cloud provider support.] - breaking_changes: ['AWS default configuration now requires additional IAM permission - `ec2:DescribeInstanceTypes` due to switching instance type list generation - to the DescribeInstanceTypes API.', NodeInfoProcessor interface is deprecated - (removed in 1.24); impacts only users building customized Cluster Autoscaler - images/plugins and should be migrated to TemplateNodeInfoProvider.] + kube: + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - '`--expander` now supports a comma-separated list of expanders with fallback + behavior when the first returns multiple node groups.' + - New `--feature-gates` flag to control Kubernetes feature gates for the embedded + kube-scheduler code used by Cluster Autoscaler. + - More reliable Kubernetes Events attached to the `cluster-autoscaler-status` + ConfigMap for every scale-up/scale-down attempt (including failures). + - Performance improvements for clusters with many pods using projected volumes. + - 'AWS: Instance type discovery now uses the EC2 `DescribeInstanceTypes` API + (adds NVIDIA A100 support), reduces API calls, and allows per-ASG scale-down + options.' + - 'Azure: Per-VMSS scale-down options, optional use of CLI credentials instead + of service principal, and NVIDIA A100 support.' + - 'GCE: Per-MIG scale-down options, ability to specify SSD ephemeral-storage + via instance templates enabling scale-from-0 for pods requesting it, and reduced + API calls.' + - New Brightbox cloud provider support. + breaking_changes: + - AWS default configuration now requires additional IAM permission `ec2:DescribeInstanceTypes` + due to switching instance type list generation to the DescribeInstanceTypes + API. + - NodeInfoProcessor interface is deprecated (removed in 1.24); impacts only + users building customized Cluster Autoscaler images/plugins and should be + migrated to TemplateNodeInfoProvider. chart_version: 9.24.0 - images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.23.0'] + images: + - registry.k8s.io/autoscaling/cluster-autoscaler:v1.23.0 - version: 1.21.1 - kube: ['1.21'] + kube: + - '1.21' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Core performance and correctness improvements in binpacking and - scale-down simulations, plus new metric for `--max-nodes-total` and better - utilization calculation (DaemonSet request handling).', 'Broader cloud provider - support and enhancements: new providers (CloudStack, Exoscale, IONOS) and - major additions for Cluster API and HuaweiCloud; ARM64 build support added.', - AWS/Azure/GCE received numerous reliability/performance improvements; in 1.21.1 - AWS gains proper IMDSv2 support and reduced memory usage; Packet adds providerID - prefix support and configurable controller node label.] - breaking_changes: [Error type returned by `IncreaseSize` changed from `apiError` - to `cloudProviderError` (could affect error handling or log parsing in integrations/tests).] + features: + - Core performance and correctness improvements in binpacking and scale-down + simulations, plus new metric for `--max-nodes-total` and better utilization + calculation (DaemonSet request handling). + - 'Broader cloud provider support and enhancements: new providers (CloudStack, + Exoscale, IONOS) and major additions for Cluster API and HuaweiCloud; ARM64 + build support added.' + - AWS/Azure/GCE received numerous reliability/performance improvements; in 1.21.1 + AWS gains proper IMDSv2 support and reduced memory usage; Packet adds providerID + prefix support and configurable controller node label. + breaking_changes: + - Error type returned by `IncreaseSize` changed from `apiError` to `cloudProviderError` + (could affect error handling or log parsing in integrations/tests). chart_version: 9.13.1 - images: ['k8s.gcr.io/autoscaling/cluster-autoscaler:v1.21.1'] + images: + - k8s.gcr.io/autoscaling/cluster-autoscaler:v1.21.1 - version: 1.20.0 - kube: ['1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Adds Helm chart support for the Magnum cloud provider., 'Cluster - API provider: switches to using Kubernetes Unstructured objects, adds node - autodiscovery support and support for --cloud-config; updates the annotation - group identifier used.'] - features: ['Performance improvements: faster binpacking and scale-down simulations - via fewer scheduler PreFilter calls; large-cluster scale-down unneeded-node - detection sped up 5x+.', 'New metrics/observability: exposes --max-nodes-total - as a metric.', 'New platform support: ARM64 image/build support; added providers - (Apache CloudStack, Exoscale, IONOS) and expanded support for HuaweiCloud - and Packet.', 'Improved scale-down behavior: best-effort eviction for DaemonSet - pods on non-empty nodes; more accurate node utilization by accounting for - DaemonSet requests in allocatable denominator.', 'Multiple cloud-provider - fixes and enhancements across AWS/Azure/GCE (pricing, caching, labels, throttling/backoff - behavior, template labels, etc.).'] - breaking_changes: [Error type returned from IncreaseSize changed from apiError - to cloudProviderError (could affect integrations relying on the specific - error type)., 'Image registry/name changes between 1.18.x and 1.20.0: 1.20.0 - images are published under k8s.gcr.io/autoscaling/* whereas 1.18.1 notes - reference k8s-artifacts-prod registries; update any pinned image repos accordingly.'] + kube: + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Adds Helm chart support for the Magnum cloud provider. + - 'Cluster API provider: switches to using Kubernetes Unstructured objects, + adds node autodiscovery support and support for --cloud-config; updates the + annotation group identifier used.' + features: + - 'Performance improvements: faster binpacking and scale-down simulations via + fewer scheduler PreFilter calls; large-cluster scale-down unneeded-node detection + sped up 5x+.' + - 'New metrics/observability: exposes --max-nodes-total as a metric.' + - 'New platform support: ARM64 image/build support; added providers (Apache + CloudStack, Exoscale, IONOS) and expanded support for HuaweiCloud and Packet.' + - 'Improved scale-down behavior: best-effort eviction for DaemonSet pods on + non-empty nodes; more accurate node utilization by accounting for DaemonSet + requests in allocatable denominator.' + - Multiple cloud-provider fixes and enhancements across AWS/Azure/GCE (pricing, + caching, labels, throttling/backoff behavior, template labels, etc.). + breaking_changes: + - Error type returned from IncreaseSize changed from apiError to cloudProviderError + (could affect integrations relying on the specific error type). + - 'Image registry/name changes between 1.18.x and 1.20.0: 1.20.0 images are + published under k8s.gcr.io/autoscaling/* whereas 1.18.1 notes reference k8s-artifacts-prod + registries; update any pinned image repos accordingly.' chart_version: 9.9.2 - images: ['k8s.gcr.io/autoscaling/cluster-autoscaler:v1.20.0'] + images: + - k8s.gcr.io/autoscaling/cluster-autoscaler:v1.20.0 - version: 1.18.1 - kube: ['1.18'] + kube: + - '1.18' requirements: [] incompatibilities: [] summary: null chart_version: 9.4.0 - images: ['us.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1'] + images: + - us.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1 name: cluster-autoscaler - icon: https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/assets/logo/descheduler-stacked-color.png git_url: https://github.com/kubernetes-sigs/descheduler @@ -15846,7 +19056,10 @@ addons: chart_name: descheduler versions: - version: 0.36.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -15859,22 +19072,31 @@ addons: \ Helm RBAC/ClusterRole was updated to account for **PVC-related failures**\ \ observed around 0.35.x; ensure you apply the new RBAC on upgrade (don\u2019\ t reuse old rendered manifests).\n" - chart_updates: ['Helm chart: add initContainers support.', 'Helm chart: allow - overriding ServiceMonitor apiVersion.', 'Helm chart: update RBAC/ClusterRole - to sync with base manifests and fix PVC-related permission issues.', 'Chart - metadata: icon URL updated.', "CI/security plumbing changes (pinned actions/plugins,\ - \ updated scanners) that don\u2019t affect runtime behavior."] - features: ["PodLifeTime strategy gained additional filters: condition, container\ - \ exit code, owner kind, and transition time\u2014enabling more precise\ - \ eviction targeting.", Helm chart can now inject init containers into the - descheduler Pod for pre-start workflows., ServiceMonitor apiVersion is now - configurable to improve compatibility with different Prometheus Operator - versions.] + chart_updates: + - 'Helm chart: add initContainers support.' + - 'Helm chart: allow overriding ServiceMonitor apiVersion.' + - 'Helm chart: update RBAC/ClusterRole to sync with base manifests and fix PVC-related + permission issues.' + - 'Chart metadata: icon URL updated.' + - "CI/security plumbing changes (pinned actions/plugins, updated scanners) that\ + \ don\u2019t affect runtime behavior." + features: + - "PodLifeTime strategy gained additional filters: condition, container exit\ + \ code, owner kind, and transition time\u2014enabling more precise eviction\ + \ targeting." + - Helm chart can now inject init containers into the descheduler Pod for pre-start + workflows. + - ServiceMonitor apiVersion is now configurable to improve compatibility with + different Prometheus Operator versions. breaking_changes: [] chart_version: 0.36.0 - images: ['registry.k8s.io/descheduler/descheduler:v0.36.0'] + images: + - registry.k8s.io/descheduler/descheduler:v0.36.0 - version: 0.35.1 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: @@ -15890,21 +19112,29 @@ addons: \ upgrade` and specifically review rendered RBAC and workload spec for any\ \ drift (serviceAccount, clusterrole rules, probes, securityContext, and any\ \ new initContainer blocks)." - chart_updates: [Chart bump for descheduler v0.35.0 (included in v0.35.1)., 'Helm - chart: add initContainers support (PR #1826).', 'Helm chart: synchronize - ClusterRole/RBAC with upstream base manifests (cherry-picked #1836).', 'Helm - chart: update icon URL in Chart.yaml (PR #1838).', 'CI/testing related: - pin helm-unittest plugin version; bump chart-testing-action (PR #1834).'] - features: ['Helm chart can now configure init containers for the descheduler - workload, enabling pre-start tasks like config generation or fetching artifacts.', - 'PodLifeTime plugin extended with additional selectors/criteria such as condition, - exit code, and owner kind (helps target evictions more precisely if you - use PodLifeTime).'] + chart_updates: + - Chart bump for descheduler v0.35.0 (included in v0.35.1). + - 'Helm chart: add initContainers support (PR #1826).' + - 'Helm chart: synchronize ClusterRole/RBAC with upstream base manifests (cherry-picked + #1836).' + - 'Helm chart: update icon URL in Chart.yaml (PR #1838).' + - 'CI/testing related: pin helm-unittest plugin version; bump chart-testing-action + (PR #1834).' + features: + - Helm chart can now configure init containers for the descheduler workload, + enabling pre-start tasks like config generation or fetching artifacts. + - PodLifeTime plugin extended with additional selectors/criteria such as condition, + exit code, and owner kind (helps target evictions more precisely if you use + PodLifeTime). breaking_changes: [] chart_version: 0.35.1 - images: ['registry.k8s.io/descheduler/descheduler:v0.35.1'] + images: + - registry.k8s.io/descheduler/descheduler:v0.35.1 - version: 0.34.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -15929,34 +19159,45 @@ addons: - **RBAC/permissions note:** if you use the built-in metrics collector / Prometheus\ \ integration, re-check RBAC after upgrade (v0.33.0 added perms when metricsCollector\ \ enabled; v0.34.0 expands Prometheus options)." - chart_updates: [Removes references to deprecated/obsolete `deschedulerPolicy` - fields from chart values., Renders `deschedulerPolicy` via Helm `tpl` for - more flexible templating., Updates default evictor configuration approach - (removes no-op defaults; aligns with `podProtections`)., 'Sets `automountServiceAccountToken: - true` on the Deployment.', Adds `activeDeadlineSeconds` to CronJob spec - in the chart., Adds labels/annotations propagation to CronJob/Job; adds - customizable Deployment annotations., Fixes liveness probe timeout in the - chart.] - features: [RemovePodsHavingTooManyRestarts can now sort candidate pods by restart - count to evict the worst offenders first., 'Prometheus metrics source supports - different URL schemes (e.g., http/https) for more flexible configuration.', - Eviction requests can include annotations to improve observability/auditing., - 'DefaultEvictorArgs gains PodProtections (including an option for pods with - resource claims), improving safety controls on what can be evicted.', 'PodLifeTime - plugin can now allow Succeeded/Failed pod phases when configured, broadening - what it can act on.'] - breaking_changes: [The chart removed obsolete `deschedulerPolicy` value fields; - existing `values.yaml` that still set them must be updated to the new structure - or they will no longer take effect., '`deschedulerPolicy` is processed with - `tpl`; unescaped `{{ ... }}` sequences inside the policy may now be evaluated - as templates, changing rendered output compared to previous versions.', - Default evictor defaults changed (no more no-op defaults); if you relied on - implicit/default evictor settings you may need to explicitly configure `DefaultEvictorArgs`/`podProtections` - to preserve prior behavior.] + chart_updates: + - Removes references to deprecated/obsolete `deschedulerPolicy` fields from + chart values. + - Renders `deschedulerPolicy` via Helm `tpl` for more flexible templating. + - Updates default evictor configuration approach (removes no-op defaults; aligns + with `podProtections`). + - 'Sets `automountServiceAccountToken: true` on the Deployment.' + - Adds `activeDeadlineSeconds` to CronJob spec in the chart. + - Adds labels/annotations propagation to CronJob/Job; adds customizable Deployment + annotations. + - Fixes liveness probe timeout in the chart. + features: + - RemovePodsHavingTooManyRestarts can now sort candidate pods by restart count + to evict the worst offenders first. + - Prometheus metrics source supports different URL schemes (e.g., http/https) + for more flexible configuration. + - Eviction requests can include annotations to improve observability/auditing. + - DefaultEvictorArgs gains PodProtections (including an option for pods with + resource claims), improving safety controls on what can be evicted. + - PodLifeTime plugin can now allow Succeeded/Failed pod phases when configured, + broadening what it can act on. + breaking_changes: + - The chart removed obsolete `deschedulerPolicy` value fields; existing `values.yaml` + that still set them must be updated to the new structure or they will no longer + take effect. + - '`deschedulerPolicy` is processed with `tpl`; unescaped `{{ ... }}` sequences + inside the policy may now be evaluated as templates, changing rendered output + compared to previous versions.' + - Default evictor defaults changed (no more no-op defaults); if you relied on + implicit/default evictor settings you may need to explicitly configure `DefaultEvictorArgs`/`podProtections` + to preserve prior behavior. chart_version: 0.34.0 - images: ['registry.k8s.io/descheduler/descheduler:v0.34.0'] + images: + - registry.k8s.io/descheduler/descheduler:v0.34.0 - version: 0.33.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -15971,30 +19212,39 @@ addons: re-validate them against the new chart. ' - chart_updates: [Chart/image version bumps to align with descheduler v0.33.0., - 'RBAC fixes: add missing permission for policy at ClusterRole.', RBAC additions - when `metricsCollector` is enabled., 'Docs/NOTES changes in chart: move - values.yaml comment about custom configmap into NOTES.txt output; README - updated to mention `cmdOptions.dry-run`.', Manifests/docs updated for v0.33.0.] - features: ['Adds `grace_period_seconds` to `DeschedulerPolicy`, allowing a configurable - grace period for pod eviction.', LowNodeUtilization gains per-plugin `evictionLimits` - to cap evictions., "Low/NodeUtilization can integrate with Prometheus for\ - \ \u201Cactual utilization\u201D and allows selecting a metrics source via\ - \ a string for extensibility.", "Introduces a \u201Cstrict eviction policy\u201D\ - \ mode to tighten eviction behavior.", 'Node utilization computation becomes - more generic, can report utilization for selected resources, and skips nodes - lacking required extended resources when averaging.'] - breaking_changes: [Potential behavior changes in Low/NodeUtilization plugins - due to refactoring of thresholds/usage assessment and more generic node - classification; validate outcomes in a staging cluster before production - rollout., "If you rely on custom/minimal RBAC, the chart\u2019s new/changed\ - \ permissions (especially for policy resources and `metricsCollector`) may\ - \ require updating your security review/overrides to avoid install/upgrade\ - \ failures."] + chart_updates: + - Chart/image version bumps to align with descheduler v0.33.0. + - 'RBAC fixes: add missing permission for policy at ClusterRole.' + - RBAC additions when `metricsCollector` is enabled. + - 'Docs/NOTES changes in chart: move values.yaml comment about custom configmap + into NOTES.txt output; README updated to mention `cmdOptions.dry-run`.' + - Manifests/docs updated for v0.33.0. + features: + - Adds `grace_period_seconds` to `DeschedulerPolicy`, allowing a configurable + grace period for pod eviction. + - LowNodeUtilization gains per-plugin `evictionLimits` to cap evictions. + - "Low/NodeUtilization can integrate with Prometheus for \u201Cactual utilization\u201D\ + \ and allows selecting a metrics source via a string for extensibility." + - "Introduces a \u201Cstrict eviction policy\u201D mode to tighten eviction\ + \ behavior." + - Node utilization computation becomes more generic, can report utilization + for selected resources, and skips nodes lacking required extended resources + when averaging. + breaking_changes: + - Potential behavior changes in Low/NodeUtilization plugins due to refactoring + of thresholds/usage assessment and more generic node classification; validate + outcomes in a staging cluster before production rollout. + - "If you rely on custom/minimal RBAC, the chart\u2019s new/changed permissions\ + \ (especially for policy resources and `metricsCollector`) may require updating\ + \ your security review/overrides to avoid install/upgrade failures." chart_version: 0.33.0 - images: ['registry.k8s.io/descheduler/descheduler:v0.33.0'] + images: + - registry.k8s.io/descheduler/descheduler:v0.33.0 - version: 0.32.2 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -16012,22 +19262,29 @@ addons: \ configurable.\n- v0.32.2 chart RBAC fixes:\n - Adds **missing ClusterRole\ \ permission for policy**.\n - Adds **additional permissions when `metricsCollector`\ \ is enabled** (compare your custom RBAC to upstream)." - chart_updates: ["Chart bumped/updated as part of v0.31 line (notably an automated\ - \ upgrade mentioned as \u201Chelm: upgrade to v0.30.1\u201D in the notes).", - Added Helm unit tests (helps detect template/value regressions)., RBAC/ClusterRole - permissions corrected in v0.32.2 (policy + metricsCollector).] - features: ['PodEvictor enhancements: new options, made thread-safe, and supports - limiting total pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`).', - 'KEP-1397 work: integration with the evacuation API as an alternative to the - eviction API (forward-looking; may be gated/optional depending on your config).', - PodLifeTime plugin now checks init and ephemeral containers., 'Helm: namespace - override settings added for more flexible deployments.'] - breaking_changes: [Removal of `descheduler/v1alpha1` type; policies/manifests - referring to v1alpha1 must be updated to the supported API version(s).] + chart_updates: + - "Chart bumped/updated as part of v0.31 line (notably an automated upgrade\ + \ mentioned as \u201Chelm: upgrade to v0.30.1\u201D in the notes)." + - Added Helm unit tests (helps detect template/value regressions). + - RBAC/ClusterRole permissions corrected in v0.32.2 (policy + metricsCollector). + features: + - 'PodEvictor enhancements: new options, made thread-safe, and supports limiting + total pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`).' + - 'KEP-1397 work: integration with the evacuation API as an alternative to the + eviction API (forward-looking; may be gated/optional depending on your config).' + - PodLifeTime plugin now checks init and ephemeral containers. + - 'Helm: namespace override settings added for more flexible deployments.' + breaking_changes: + - Removal of `descheduler/v1alpha1` type; policies/manifests referring to v1alpha1 + must be updated to the supported API version(s). chart_version: 0.32.2 - images: ['registry.k8s.io/descheduler/descheduler:v0.32.2'] + images: + - registry.k8s.io/descheduler/descheduler:v0.32.2 - version: 0.31.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -16050,48 +19307,65 @@ addons: \ now omit `securityContext` for Deployment/CronJob based on values. If you\ \ depend on a specific `securityContext`, ensure it remains enabled/configured\ \ after upgrade." - chart_updates: [Chart templates updated to correctly type `replicas` and handle - `cmdOption` falsey values., Default deschedulerPolicy templating corrected; - behavior may differ if you depended on defaults., Added namespace override - support in the Helm chart., Fixed leader election configuration key to `resourceNamespace` - in chart values/templates., Made `securityContext` conditional for Deployment - and CronJob; improved Helm unit tests.] - features: [Pod evictor enhancements and new options; groundwork for eviction - request handling and thread-safety improvements., Support for limiting the - **total** number of pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`)., - PodLifeTime plugin gained checks for init containers and ephemeral containers., - 'Integration work for KEP-1397: optional evacuation API flow as an alternative - to the eviction API (foundational work in this release).'] - breaking_changes: [Removed the `descheduler/v1alpha1` API type. Any manifests/policies - still referencing v1alpha1 must be updated to the supported policy API version - used by your deployment., Helm leader election namespace value key corrected - to `resourceNamespace`; configurations using the old key will stop applying - after upgrade.] + chart_updates: + - Chart templates updated to correctly type `replicas` and handle `cmdOption` + falsey values. + - Default deschedulerPolicy templating corrected; behavior may differ if you + depended on defaults. + - Added namespace override support in the Helm chart. + - Fixed leader election configuration key to `resourceNamespace` in chart values/templates. + - Made `securityContext` conditional for Deployment and CronJob; improved Helm + unit tests. + features: + - Pod evictor enhancements and new options; groundwork for eviction request + handling and thread-safety improvements. + - Support for limiting the **total** number of pods evicted per rescheduling + cycle (`maxNoOfPodsToEvictTotal`). + - PodLifeTime plugin gained checks for init containers and ephemeral containers. + - 'Integration work for KEP-1397: optional evacuation API flow as an alternative + to the eviction API (foundational work in this release).' + breaking_changes: + - Removed the `descheduler/v1alpha1` API type. Any manifests/policies still + referencing v1alpha1 must be updated to the supported policy API version used + by your deployment. + - Helm leader election namespace value key corrected to `resourceNamespace`; + configurations using the old key will stop applying after upgrade. chart_version: 0.31.0 - images: ['registry.k8s.io/descheduler/descheduler:v0.31.0'] + images: + - registry.k8s.io/descheduler/descheduler:v0.31.0 - version: 0.30.2 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Descheduler v0.29.0 includes several Helm-related improvements - and one breaking-ish template/values adjustment to avoid a CronJob args - unmarshal error., 'Helm chart adds support for CronJob `timeZone`, `dnsConfig`, - Pod `securityContext`, and `ipFamilyPolicy` configuration.'] - features: ['Improved TopologySpreadConstraint handling, adding support for `nodeTaintsPolicy`, - `nodeAffinityPolicy`, and `matchLabelKeys`.', PodLifeTime strategy now considers - pods in `ImagePullBackOff`., 'Logging improvements (structured errors, JSON - logging fixes, more readable node utilization percentages, correct ownerKey).', - 'Compatibility and security updates: dependency bumps for multiple CVEs and - updated Kubernetes/Go dependencies, including Kubernetes 1.29 support.'] - breaking_changes: [Helm CronJob args values format changed to avoid an unmarshal - error; existing custom `cronJob.args`/args configuration may need adjustment - when upgrading.] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Descheduler v0.29.0 includes several Helm-related improvements and one breaking-ish + template/values adjustment to avoid a CronJob args unmarshal error. + - Helm chart adds support for CronJob `timeZone`, `dnsConfig`, Pod `securityContext`, + and `ipFamilyPolicy` configuration. + features: + - Improved TopologySpreadConstraint handling, adding support for `nodeTaintsPolicy`, + `nodeAffinityPolicy`, and `matchLabelKeys`. + - PodLifeTime strategy now considers pods in `ImagePullBackOff`. + - Logging improvements (structured errors, JSON logging fixes, more readable + node utilization percentages, correct ownerKey). + - 'Compatibility and security updates: dependency bumps for multiple CVEs and + updated Kubernetes/Go dependencies, including Kubernetes 1.29 support.' + breaking_changes: + - Helm CronJob args values format changed to avoid an unmarshal error; existing + custom `cronJob.args`/args configuration may need adjustment when upgrading. chart_version: 0.30.2 - images: ['registry.k8s.io/descheduler/descheduler:v0.30.2'] + images: + - registry.k8s.io/descheduler/descheduler:v0.30.2 - version: 0.29.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -16111,27 +19385,35 @@ addons: **Action for upgrade:** diff your current `values.yaml` against the new chart defaults and specifically validate any custom `cronJob.*`, `dnsConfig`, `securityContext`, and networking-related settings (`ipFamilyPolicy`).' - chart_updates: ["Helm chart version was bumped alongside image updates as part\ - \ of the v0.28.1\u2192v0.29.0 release train.", 'Chart gained additional - configurability for CronJob (`timeZone`), Pod spec (`dnsConfig`, `securityContext`), - and networking (`ipFamilyPolicy`).', CronJob args templating/values handling - was changed to prevent unmarshal errors (can impact existing values).] - features: ['TopologySpreadConstraints support was expanded (nodeTaintsPolicy, - nodeAffinityPolicy, and matchLabelKeys handling).', '`PodLifeTime` plugin - now considers pods in `ImagePullBackOff` container status, which can increase - the set of pods eligible for eviction under that policy.', 'Logging improvements: - more structured error logs during eviction and more accurate/human-readable - node utilization and topologySpreadConstraint fields.'] - breaking_changes: ["Potential Helm values behavior change for CronJob args:\ - \ prior `cronJob.args` values may fail to render or may need to be reformatted\ - \ due to the unmarshal fix\u2014verify during `helm template`/dry-run.", - 'Kubernetes 1.29 dependency/go-version bump: if you run older Kubernetes versions - or have strict version-skew constraints, validate descheduler compatibility - against your managed provider/K8s version before upgrading.'] + chart_updates: + - "Helm chart version was bumped alongside image updates as part of the v0.28.1\u2192\ + v0.29.0 release train." + - Chart gained additional configurability for CronJob (`timeZone`), Pod spec + (`dnsConfig`, `securityContext`), and networking (`ipFamilyPolicy`). + - CronJob args templating/values handling was changed to prevent unmarshal errors + (can impact existing values). + features: + - TopologySpreadConstraints support was expanded (nodeTaintsPolicy, nodeAffinityPolicy, + and matchLabelKeys handling). + - '`PodLifeTime` plugin now considers pods in `ImagePullBackOff` container status, + which can increase the set of pods eligible for eviction under that policy.' + - 'Logging improvements: more structured error logs during eviction and more + accurate/human-readable node utilization and topologySpreadConstraint fields.' + breaking_changes: + - "Potential Helm values behavior change for CronJob args: prior `cronJob.args`\ + \ values may fail to render or may need to be reformatted due to the unmarshal\ + \ fix\u2014verify during `helm template`/dry-run." + - 'Kubernetes 1.29 dependency/go-version bump: if you run older Kubernetes versions + or have strict version-skew constraints, validate descheduler compatibility + against your managed provider/K8s version before upgrading.' chart_version: 0.29.0 - images: ['registry.k8s.io/descheduler/descheduler:v0.29.0'] + images: + - registry.k8s.io/descheduler/descheduler:v0.29.0 - version: 0.28.1 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -16144,38 +19426,51 @@ addons: \ if you deploy descheduler as a CronJob and your cluster supports `spec.timeZone`).\n\ - **New optional `dnsConfig` support**: You can now provide `dnsConfig` via\ \ values to customize pod DNS settings (nameservers/searches/options)." - chart_updates: ['Helm chart: fixed CronJob args rendering to prevent unmarshal - errors (PRs #1229, #1231).', 'Helm chart: added CronJob `timeZone` value - support (PR #1245).', 'Helm chart: added ability to set `dnsConfig` for - the workload (PR #1260).'] - features: ['TopologySpreadConstraints handling improved: respects `nodeTaintsPolicy` - and `nodeAffinityPolicy` and adds support for `matchLabelKeys`.', 'Improved - logging/observability: structured eviction errors, corrected ownerKey display, - fixed JSON logging, and more readable node utilization percentages.', Better - compatibility with managed Kubernetes providers via version-skew fixes., - 'Security hardening: dependency bumps for CVE-2023-44487, CVE-2023-25151, - and CVE-2023-47108.'] + chart_updates: + - 'Helm chart: fixed CronJob args rendering to prevent unmarshal errors (PRs + #1229, #1231).' + - 'Helm chart: added CronJob `timeZone` value support (PR #1245).' + - 'Helm chart: added ability to set `dnsConfig` for the workload (PR #1260).' + features: + - 'TopologySpreadConstraints handling improved: respects `nodeTaintsPolicy` + and `nodeAffinityPolicy` and adds support for `matchLabelKeys`.' + - 'Improved logging/observability: structured eviction errors, corrected ownerKey + display, fixed JSON logging, and more readable node utilization percentages.' + - Better compatibility with managed Kubernetes providers via version-skew fixes. + - 'Security hardening: dependency bumps for CVE-2023-44487, CVE-2023-25151, + and CVE-2023-47108.' breaking_changes: [] chart_version: 0.28.1 - images: ['registry.k8s.io/descheduler/descheduler:v0.28.1'] + images: + - registry.k8s.io/descheduler/descheduler:v0.28.1 - version: 0.27.1 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['v0.26.1: Reverted Dockerfile ENTRYPOINT/CMD split (no user-facing - chart values change).', 'v0.26.1: Helm chart updated to v0.26.0 (aligns - chart/app; review chart version bump in your repo).', 'v0.27.1: Fixes plugin - argument conversion when using multiple profiles with the same plugin (behavioral - bugfix; no values change noted).'] - features: [v0.27.1 improves stability when configuring multiple descheduler - profiles that reuse the same plugin by correctly converting plugin arguments.] + chart_updates: + - 'v0.26.1: Reverted Dockerfile ENTRYPOINT/CMD split (no user-facing chart values + change).' + - 'v0.26.1: Helm chart updated to v0.26.0 (aligns chart/app; review chart version + bump in your repo).' + - 'v0.27.1: Fixes plugin argument conversion when using multiple profiles with + the same plugin (behavioral bugfix; no values change noted).' + features: + - v0.27.1 improves stability when configuring multiple descheduler profiles + that reuse the same plugin by correctly converting plugin arguments. breaking_changes: [] chart_version: 0.27.1 - images: ['registry.k8s.io/descheduler/descheduler:v0.27.1'] + images: + - registry.k8s.io/descheduler/descheduler:v0.27.1 - version: 0.26.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -16185,17 +19480,23 @@ addons: \ schema changes are called out in the provided notes; validate by diffing\ \ your current `values.yaml` against the new chart\u2019s `values.yaml` and\ \ running a `helm template`/`helm diff`.\n" - chart_updates: [Helm chart version bump to **v0.26.0** (as referenced in the - v0.26.1 release notes).] - features: ['Fixes default value assignment for the `EvictLocalStoragePods` option, - making behavior more consistent when the value is omitted.'] - breaking_changes: [None explicitly mentioned in the provided v0.25.1 and v0.26.1 - notes; still validate against intermediate releases (v0.26.0) for any API/config - deprecations.] + chart_updates: + - Helm chart version bump to **v0.26.0** (as referenced in the v0.26.1 release + notes). + features: + - Fixes default value assignment for the `EvictLocalStoragePods` option, making + behavior more consistent when the value is omitted. + breaking_changes: + - None explicitly mentioned in the provided v0.25.1 and v0.26.1 notes; still + validate against intermediate releases (v0.26.0) for any API/config deprecations. chart_version: 0.26.1 - images: ['registry.k8s.io/descheduler/descheduler:v0.26.1'] + images: + - registry.k8s.io/descheduler/descheduler:v0.26.1 - version: 0.25.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -16208,20 +19509,26 @@ addons: against the new chart defaults and documentation. ' - chart_updates: [Helm chart bumped to **v1.25.0** (per v0.25.1 release notes)., - v0.24.1 included "helm chart fixes" and a fix to the version command to parse - helm chart tags (already in your starting version).] - features: [No new end-user features are called out in the provided notes; v0.25.1 - appears to be primarily a chart bump plus a backported fix (issue 960) and - documentation updates.] - breaking_changes: ["No explicit breaking changes are mentioned in the provided\ - \ release notes. The main risk is **Helm chart major-version jump (0.x \u2192\ - \ 1.x)** which can imply breaking changes in values/templating even if not\ - \ called out."] + chart_updates: + - Helm chart bumped to **v1.25.0** (per v0.25.1 release notes). + - v0.24.1 included "helm chart fixes" and a fix to the version command to parse + helm chart tags (already in your starting version). + features: + - No new end-user features are called out in the provided notes; v0.25.1 appears + to be primarily a chart bump plus a backported fix (issue 960) and documentation + updates. + breaking_changes: + - "No explicit breaking changes are mentioned in the provided release notes.\ + \ The main risk is **Helm chart major-version jump (0.x \u2192 1.x)** which\ + \ can imply breaking changes in values/templating even if not called out." chart_version: 0.25.2 - images: ['k8s.gcr.io/descheduler/descheduler:v0.25.1'] + images: + - k8s.gcr.io/descheduler/descheduler:v0.25.1 - version: 0.24.1 - kube: ['1.24', '1.23', '1.22'] + kube: + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: @@ -16233,47 +19540,67 @@ addons: - **If you pin image tags manually:** update the Descheduler image tag from `v0.23.1` to `v0.24.1` (`k8s.gcr.io/descheduler/descheduler:v0.24.1`).' - chart_updates: ['Helm chart updated to v0.24 (PR #796).', 'Helm chart fixes - in release-1.24 branch (PR #817).', 'Version command fixed to parse Helm - chart tags correctly (PR #824).'] + chart_updates: + - 'Helm chart updated to v0.24 (PR #796).' + - 'Helm chart fixes in release-1.24 branch (PR #817).' + - 'Version command fixed to parse Helm chart tags correctly (PR #824).' features: [] breaking_changes: [] chart_version: 0.24.1 - images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.24.1'] + images: + - alpine:latest + - k8s.gcr.io/descheduler/descheduler:v0.24.1 - version: 0.23.1 - kube: ['1.23', '1.22', '1.21'] + kube: + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v0.23.1 includes a fix for a panic when running descheduler v0.23 - as a Kubernetes CronJob., v0.23.1 bumps the Go toolchain to 1.17.7 to address - CVE-2021-44716.] + features: + - v0.23.1 includes a fix for a panic when running descheduler v0.23 as a Kubernetes + CronJob. + - v0.23.1 bumps the Go toolchain to 1.17.7 to address CVE-2021-44716. breaking_changes: [] chart_version: 0.23.2 - images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.23.1'] + images: + - alpine:latest + - k8s.gcr.io/descheduler/descheduler:v0.23.1 - version: 0.22.1 - kube: ['1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Patch upgrade from descheduler v0.21.0 to v0.22.1; ensure the - deployed container image tag is updated to `k8s.gcr.io/descheduler/descheduler:v0.22.1`.', - The v0.22.1 application release is a crash fix for the `RemoveFailedPods` - strategy; validate whether this strategy is enabled in your policy/config - and prioritize this upgrade if it is.] - features: [v0.22.1 is a patch release that fixes a crash in the new `RemoveFailedPods` - strategy., 'v0.21.0 introduced multiple operational and scheduling-related - enhancements: running as non-root (UID 1000), metrics collection, new/updated - strategies (e.g., HighNodeUtilization), and additional filtering knobs (labelSelector, - ignore pods with PVCs, soft topology spread constraints).'] + kube: + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Patch upgrade from descheduler v0.21.0 to v0.22.1; ensure the deployed container + image tag is updated to `k8s.gcr.io/descheduler/descheduler:v0.22.1`. + - The v0.22.1 application release is a crash fix for the `RemoveFailedPods` + strategy; validate whether this strategy is enabled in your policy/config + and prioritize this upgrade if it is. + features: + - v0.22.1 is a patch release that fixes a crash in the new `RemoveFailedPods` + strategy. + - 'v0.21.0 introduced multiple operational and scheduling-related enhancements: + running as non-root (UID 1000), metrics collection, new/updated strategies + (e.g., HighNodeUtilization), and additional filtering knobs (labelSelector, + ignore pods with PVCs, soft topology spread constraints).' breaking_changes: [] chart_version: 0.22.1 - images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.22.1'] + images: + - alpine:latest + - k8s.gcr.io/descheduler/descheduler:v0.22.1 - version: 0.21.0 - kube: ['1.21', '1.20', '1.19'] + kube: + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16289,32 +19616,42 @@ addons: \ to specific nodes.\n- **Docs/values fixes**:\n - Fixed `values.yaml` indentation\ \ (#498).\n - Corrected chart docs for container requests/limits (#526).\n\ - **Helm chart testing**:\n - Added a **helm test** hook (#527).\n" - chart_updates: [Workload manifests updated to run as non-root (UID 1000) and - support `runAsNonRoot` (aligns with upstream security changes)., CronJob - template enhanced with `nodeSelector` support., 'Chart hygiene updates: - `values.yaml` indentation fix and documentation corrections for resources.', - Added Helm test hook for basic install validation.] - features: ['Runs descheduler as non-root by default (UID 1000), improving security - posture and compatibility with restricted PodSecurity policies.', 'Adds - metrics collection support, enabling scraping/observability of descheduler - behavior.', 'New/expanded eviction filtering: labelSelector-based filtering, - option to ignore pods with PVCs, and optional eviction of system-critical - pods (configurable).', 'TopologySpreadConstraint strategy enhancements, - including support for soft constraints and labelSelector filtering during - eviction.', 'New/updated strategies and behavior: HighNodeUtilization strategy, - improved NodeFit feature, and LowNodeUtilization extended resource support.', - Updated Kubernetes dependency compatibility to 1.21 and expanded multi-arch - images (adds ARM32v7).] - breaking_changes: ['Descheduler now defaults to **running as non-root (UID 1000)**; - clusters/environments that assume root (custom securityContext, PSP, file - permissions on mounted volumes, or restrictive policies) may require adjustments.', - Kubernetes library/dependency bump to **1.21.0** may effectively drop compatibility - with older Kubernetes versions; validate your cluster version and API availability - before upgrading.] + chart_updates: + - Workload manifests updated to run as non-root (UID 1000) and support `runAsNonRoot` + (aligns with upstream security changes). + - CronJob template enhanced with `nodeSelector` support. + - 'Chart hygiene updates: `values.yaml` indentation fix and documentation corrections + for resources.' + - Added Helm test hook for basic install validation. + features: + - Runs descheduler as non-root by default (UID 1000), improving security posture + and compatibility with restricted PodSecurity policies. + - Adds metrics collection support, enabling scraping/observability of descheduler + behavior. + - 'New/expanded eviction filtering: labelSelector-based filtering, option to + ignore pods with PVCs, and optional eviction of system-critical pods (configurable).' + - TopologySpreadConstraint strategy enhancements, including support for soft + constraints and labelSelector filtering during eviction. + - 'New/updated strategies and behavior: HighNodeUtilization strategy, improved + NodeFit feature, and LowNodeUtilization extended resource support.' + - Updated Kubernetes dependency compatibility to 1.21 and expanded multi-arch + images (adds ARM32v7). + breaking_changes: + - Descheduler now defaults to **running as non-root (UID 1000)**; clusters/environments + that assume root (custom securityContext, PSP, file permissions on mounted + volumes, or restrictive policies) may require adjustments. + - Kubernetes library/dependency bump to **1.21.0** may effectively drop compatibility + with older Kubernetes versions; validate your cluster version and API availability + before upgrading. chart_version: 0.21.0 - images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.21.0'] + images: + - alpine:latest + - k8s.gcr.io/descheduler/descheduler:v0.21.0 - version: 0.20.0 - kube: ['1.20', '1.19', '1.18'] + kube: + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: @@ -16331,30 +19668,41 @@ addons: \ move those settings into values.\n- **TopologySpreadConstraint strategy\ \ namespaces** can be configured via Helm (PR #455) \u2014 check your values\ \ if you use that strategy.\n" - chart_updates: ["Chart renamed (PR #436) \u2014 update chart reference in Helm/GitOps.", - 'Add PodSecurityPolicy support to the chart templates (PR #418).', 'Expose - CronJob scheduling/history settings in values: startingDeadlineSeconds, - successfulJobsHistoryLimit, failedJobsHistoryLimit (PRs #444, #453).', 'Add - container resource configuration in chart (PR #443).', 'Helm support for - listing namespaces for topologySpreadConstraint strategy (PR #455).'] - features: [New **PodTopologySpread** strategy to rebalance pods across topology - domains (#413)., RemoveDuplicates and TopologySpread-related strategies - gain **namespace filtering** (#406) and improved namespace handling (#455)., - PodLifeTime strategy can now customize which **podStatusPhases** count (#393)., - 'New logging-format flag and broader structured logging improvements (#412, - #376/#394).', 'Helm/chart improvements: PSP support, CronJob timing and - history limits, configurable resources (#418, #444, #453, #443).', 'Descheduler - updated for Kubernetes 1.20 dependencies and multi-arch images (#464, #449).'] - breaking_changes: [Helm **chart rename** may break automated upgrades or GitOps - references until you update the chart name/repo/path (#436)., "If you relied\ - \ on old CLI flags previously deprecated in 0.19.0 (node-selector, max-pods-to-evict-per-node,\ - \ evict-local-storage-pods), 0.20.0 continues the move toward policy fields;\ - \ validate your deployment isn\u2019t still depending on removed/ignored\ - \ flags."] + chart_updates: + - "Chart renamed (PR #436) \u2014 update chart reference in Helm/GitOps." + - 'Add PodSecurityPolicy support to the chart templates (PR #418).' + - 'Expose CronJob scheduling/history settings in values: startingDeadlineSeconds, + successfulJobsHistoryLimit, failedJobsHistoryLimit (PRs #444, #453).' + - 'Add container resource configuration in chart (PR #443).' + - 'Helm support for listing namespaces for topologySpreadConstraint strategy + (PR #455).' + features: + - New **PodTopologySpread** strategy to rebalance pods across topology domains + (#413). + - RemoveDuplicates and TopologySpread-related strategies gain **namespace filtering** + (#406) and improved namespace handling (#455). + - PodLifeTime strategy can now customize which **podStatusPhases** count (#393). + - 'New logging-format flag and broader structured logging improvements (#412, + #376/#394).' + - 'Helm/chart improvements: PSP support, CronJob timing and history limits, + configurable resources (#418, #444, #453, #443).' + - 'Descheduler updated for Kubernetes 1.20 dependencies and multi-arch images + (#464, #449).' + breaking_changes: + - Helm **chart rename** may break automated upgrades or GitOps references until + you update the chart name/repo/path (#436). + - "If you relied on old CLI flags previously deprecated in 0.19.0 (node-selector,\ + \ max-pods-to-evict-per-node, evict-local-storage-pods), 0.20.0 continues\ + \ the move toward policy fields; validate your deployment isn\u2019t still\ + \ depending on removed/ignored flags." chart_version: 0.20.0 - images: ['k8s.gcr.io/descheduler/descheduler:v0.20.0'] + images: + - k8s.gcr.io/descheduler/descheduler:v0.20.0 - version: 0.19.0 - kube: ['1.19', '1.18', '1.17'] + kube: + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: @@ -16372,28 +19720,38 @@ addons: rather than extraArgs/command flags. ' - chart_updates: [Helm chart is now a first-class release artifact (added around - this cycle) and v0.19.0 has a dedicated chart release tag `descheduler-helm-chart-0.19.0`., - 'Chart maintainer metadata updated (#375) and Helm release process/documentation - improved (#351, #356, #359).'] - features: [Namespace-based pod filtering support was added (you can scope strategies - to specific namespaces)., Custom priority threshold support was added for - priority-based decisions/evictions., Kubernetes dependencies were bumped - for Kubernetes 1.19 compatibility and the project moved to Go 1.15.] - breaking_changes: [Image registry/repository location changed to `k8s.gcr.io/descheduler/descheduler`; - environments with allowlists/mirrors must be updated., 'Several command-line - flags were deprecated (`node-selector`, `max-pods-to-evict-per-node`, `evict-local-storage-pods`) - in favor of policy `v1alpha1` fields; upgrades relying on those flags should - migrate to policy-based configuration to avoid future removal.'] + chart_updates: + - Helm chart is now a first-class release artifact (added around this cycle) + and v0.19.0 has a dedicated chart release tag `descheduler-helm-chart-0.19.0`. + - 'Chart maintainer metadata updated (#375) and Helm release process/documentation + improved (#351, #356, #359).' + features: + - Namespace-based pod filtering support was added (you can scope strategies + to specific namespaces). + - Custom priority threshold support was added for priority-based decisions/evictions. + - Kubernetes dependencies were bumped for Kubernetes 1.19 compatibility and + the project moved to Go 1.15. + breaking_changes: + - Image registry/repository location changed to `k8s.gcr.io/descheduler/descheduler`; + environments with allowlists/mirrors must be updated. + - Several command-line flags were deprecated (`node-selector`, `max-pods-to-evict-per-node`, + `evict-local-storage-pods`) in favor of policy `v1alpha1` fields; upgrades + relying on those flags should migrate to policy-based configuration to avoid + future removal. chart_version: 0.19.2 - images: ['k8s.gcr.io/descheduler/descheduler:v0.19.0'] + images: + - k8s.gcr.io/descheduler/descheduler:v0.19.0 - version: 0.18.0 - kube: ['1.18', '1.17', '1.16'] + kube: + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null chart_version: 0.18.2 - images: ['us.gcr.io/k8s-artifacts-prod/descheduler/descheduler:v0.18.0'] + images: + - us.gcr.io/k8s-artifacts-prod/descheduler/descheduler:v0.18.0 name: descheduler - icon: https://github.com/kubernetes-sigs/external-dns/blob/master/docs/img/external-dns.png?raw=true git_url: https://github.com/kubernetes-sigs/external-dns @@ -16401,70 +19759,133 @@ addons: helm_repository_url: https://kubernetes-sigs.github.io/external-dns versions: - version: 0.21.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Charts: Fix ptsc indentation (#6054).', 'Charts: Add schema - for provider.webhook.serviceMonitor (#5932).', 'Charts: Skip cluster-scope - RBAC when running namespaced (#5843).'] - features: ['New Kubernetes client rate-limiting flags: `--kube-api-qps` and - `--kube-api-burst` to control API load.', 'Events can be emitted for managed - resources (Ingress/Service/Pod/Node/CRD) with standardized messages, improving - debuggability.', 'Expanded DNS record support: NAPTR (AWS/Route53 + TXT - registry), SRV/NAPTR in TXT registry, MX trailing-dot handling, and generalized - PTR support across providers.', 'Cloudflare can batch DNS record changes, - reducing API calls; Azure supports DNS record metadata/tags.', Memory/performance - improvements via informer object transformers and reduced cache footprint; - new metric for ownership conflicts (`skipped_records_owner_mismatch_per_sync`).] - breaking_changes: ['DigitalOcean in-tree provider removed; deployments using - the built-in DigitalOcean provider must switch to an alternative (e.g., - webhook provider) or stay pinned.', CloudFoundry source support removed; - any setups relying on CloudFoundry resources must migrate away., Gateway - API sources migrated to `gateway.networking.k8s.io/v1` (Gateway/HTTPRoute); - clusters still using beta APIs must upgrade CRDs/resources., Istio sources - migrated to `networking.istio.io/v1` for Gateway/VirtualService; older Istio - API versions will no longer be watched., "PTR record support generalized\ - \ beyond rfc2136; expect behavior/flags/annotations around PTR to change\u2014\ - test provider compatibility.", Pi-hole v5 API support deprecated; plan to - move to v6 API., 'Service source now ignores unschedulable nodes; if you - previously relied on DNS records from unschedulable nodes, behavior will - change.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Charts: Fix ptsc indentation (#6054).' + - 'Charts: Add schema for provider.webhook.serviceMonitor (#5932).' + - 'Charts: Skip cluster-scope RBAC when running namespaced (#5843).' + features: + - 'New Kubernetes client rate-limiting flags: `--kube-api-qps` and `--kube-api-burst` + to control API load.' + - Events can be emitted for managed resources (Ingress/Service/Pod/Node/CRD) + with standardized messages, improving debuggability. + - 'Expanded DNS record support: NAPTR (AWS/Route53 + TXT registry), SRV/NAPTR + in TXT registry, MX trailing-dot handling, and generalized PTR support across + providers.' + - Cloudflare can batch DNS record changes, reducing API calls; Azure supports + DNS record metadata/tags. + - Memory/performance improvements via informer object transformers and reduced + cache footprint; new metric for ownership conflicts (`skipped_records_owner_mismatch_per_sync`). + breaking_changes: + - DigitalOcean in-tree provider removed; deployments using the built-in DigitalOcean + provider must switch to an alternative (e.g., webhook provider) or stay pinned. + - CloudFoundry source support removed; any setups relying on CloudFoundry resources + must migrate away. + - Gateway API sources migrated to `gateway.networking.k8s.io/v1` (Gateway/HTTPRoute); + clusters still using beta APIs must upgrade CRDs/resources. + - Istio sources migrated to `networking.istio.io/v1` for Gateway/VirtualService; + older Istio API versions will no longer be watched. + - "PTR record support generalized beyond rfc2136; expect behavior/flags/annotations\ + \ around PTR to change\u2014test provider compatibility." + - Pi-hole v5 API support deprecated; plan to move to v6 API. + - Service source now ignores unschedulable nodes; if you previously relied on + DNS records from unschedulable nodes, behavior will change. chart_version: 1.21.1 - images: ['registry.k8s.io/external-dns/external-dns:v0.21.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.21.0 - version: 0.20.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['CLI parsing/flag handling was migrated from kingpin to cobra - (dual-parity), which can subtly affect how flags are parsed/aliased in manifests - and Helm values -> args; review your configured args carefully.', 'Chart - release aligns with app v0.20.0 image tag; no explicit Helm values deprecations - were called out in the provided notes, but validate against your current - values.yaml due to the CLI migration.', 'If you rely on the `--min-ttl` - flag, be aware it was unintentionally removed in v0.20.0 and is expected - to be restored in the next release.'] - features: ['New flags to support OwnerID migration, making it easier to move - between ownership identifiers without recreating all records.', 'Custom - annotation prefix support for split-horizon DNS, enabling multiple DNS views - using different annotation namespaces.', 'Cloudflare provider now supports - tags for records (where supported), improving record organization and filtering.', - CoreDNS provider gained new annotations for groups and improved etcd client - usage with context support., 'Additional provider/source enhancements: AWS - adds ap-southeast-6 region; F5 Virtual Server source adds host aliases support.'] - breaking_changes: ['`--min-ttl` was unintentionally removed in v0.20.0; any - deployment depending on it will fail to start or will ignore the setting - until the flag is restored in a later version.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - CLI parsing/flag handling was migrated from kingpin to cobra (dual-parity), + which can subtly affect how flags are parsed/aliased in manifests and Helm + values -> args; review your configured args carefully. + - Chart release aligns with app v0.20.0 image tag; no explicit Helm values deprecations + were called out in the provided notes, but validate against your current values.yaml + due to the CLI migration. + - If you rely on the `--min-ttl` flag, be aware it was unintentionally removed + in v0.20.0 and is expected to be restored in the next release. + features: + - New flags to support OwnerID migration, making it easier to move between ownership + identifiers without recreating all records. + - Custom annotation prefix support for split-horizon DNS, enabling multiple + DNS views using different annotation namespaces. + - Cloudflare provider now supports tags for records (where supported), improving + record organization and filtering. + - CoreDNS provider gained new annotations for groups and improved etcd client + usage with context support. + - 'Additional provider/source enhancements: AWS adds ap-southeast-6 region; + F5 Virtual Server source adds host aliases support.' + breaking_changes: + - '`--min-ttl` was unintentionally removed in v0.20.0; any deployment depending + on it will fail to start or will ignore the setting until the flag is restored + in a later version.' chart_version: 1.20.0 - images: ['registry.k8s.io/external-dns/external-dns:v0.20.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.20.0 - version: 0.19.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16483,27 +19904,51 @@ addons: \ RBAC after upgrade.\n- **Schema update**: Helm values schema updated to\ \ accept **`policy: create-only`** as a valid type (useful if you want to\ \ prevent deletions).\n" - chart_updates: ['Adds a dedicated Helm value to configure `annotationFilter` - (PR #5737).', 'Fixes `.extraContainers` values schema/type to be an array - (PR #5564).', 'RBAC fixes for namespaced Gateway sources (PR #5578).', 'Makes - EndpointSlice RBAC permissions conditional (PR #5746).', 'Helm values schema - updated to allow `policy: create-only` (PR #5627).'] - features: ['~10x lower average memory usage for pod/node sources by using informer - transformers (PR #5596).', 'Adds `build_info` Prometheus metric for easier - version/build visibility (PR #5643).', 'Adds AWS Route53 support for ap-east-2 - and geoproximity routing policies (PRs #5638, #5347).', 'Adds pod source - support for annotation and label filters (PR #5583).', 'Chart: easier configuration - of `annotationFilter` via a dedicated Helm value (PR #5737).'] - breaking_changes: ['Nodes source now exposes external IPv6 by default, which - can change which AAAA records are published unless you override with flags - (PR #5575).', 'Traefik legacy listeners on the `traefik.containo.us` API - group are disabled, so older Traefik CRDs/listeners may stop being watched - unless you switch to the supported API group/config (PR #5565).'] + chart_updates: + - 'Adds a dedicated Helm value to configure `annotationFilter` (PR #5737).' + - 'Fixes `.extraContainers` values schema/type to be an array (PR #5564).' + - 'RBAC fixes for namespaced Gateway sources (PR #5578).' + - 'Makes EndpointSlice RBAC permissions conditional (PR #5746).' + - 'Helm values schema updated to allow `policy: create-only` (PR #5627).' + features: + - '~10x lower average memory usage for pod/node sources by using informer transformers + (PR #5596).' + - 'Adds `build_info` Prometheus metric for easier version/build visibility (PR + #5643).' + - 'Adds AWS Route53 support for ap-east-2 and geoproximity routing policies + (PRs #5638, #5347).' + - 'Adds pod source support for annotation and label filters (PR #5583).' + - 'Chart: easier configuration of `annotationFilter` via a dedicated Helm value + (PR #5737).' + breaking_changes: + - 'Nodes source now exposes external IPv6 by default, which can change which + AAAA records are published unless you override with flags (PR #5575).' + - 'Traefik legacy listeners on the `traefik.containo.us` API group are disabled, + so older Traefik CRDs/listeners may stop being watched unless you switch to + the supported API group/config (PR #5565).' chart_version: 1.19.0 - images: ['registry.k8s.io/external-dns/external-dns:v0.19.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.19.0 - version: 0.18.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16524,31 +19969,56 @@ addons: \ in-tree `ibmcloud`, `tencentcloud`, or `ultradns`, you must pin older versions\ \ or migrate to a webhook provider. This may require chart values updates\ \ to the `provider` setting and any provider-specific config.\n" - chart_updates: [RBAC updates are required for EndpointSlices; note that the - v0.18.0 app release says this is included in the *next* Helm chart release - (so upgrading the app image without upgrading the chart/RBAC can break Service - source)., 'Helm chart release workflow/process fixes mentioned upstream - (not functional changes, but suggests chart version selection matters).'] - features: ['Cloudflare: support for MX records and DNS record comments; improved - regional hostnames behavior.', Service source now uses EndpointSlices (more - scalable than Endpoints)., FQDN templating improvements (ExecTemplate functions; - pod/node/service-related enhancements)., New/updated metrics including `consecutiveSoftErrors` - and metrics for all supported endpoint types., Optional `--force-default-targets` - mitigation flag to control default-target behavior.] - breaking_changes: ['RBAC: Service source now uses EndpointSlices; without EndpointSlice - permissions, ExternalDNS may fail to read service endpoints.', Metrics output - was significantly reworked; existing dashboards/alerts scraping specific - series/labels will likely break., Removed `--txt-new-format-only` flag and - deprecated legacy TXT registry format; only the new TXT format is supported - now., 'Removed in-tree providers: ibmcloud, tencentcloud, and ultradns; - must migrate (webhook) or stay on an older version.', Default-targets behavior - changed; may affect record targets unless you opt into the mitigation flag - (`--force-default-targets`).] + chart_updates: + - RBAC updates are required for EndpointSlices; note that the v0.18.0 app release + says this is included in the *next* Helm chart release (so upgrading the app + image without upgrading the chart/RBAC can break Service source). + - Helm chart release workflow/process fixes mentioned upstream (not functional + changes, but suggests chart version selection matters). + features: + - 'Cloudflare: support for MX records and DNS record comments; improved regional + hostnames behavior.' + - Service source now uses EndpointSlices (more scalable than Endpoints). + - FQDN templating improvements (ExecTemplate functions; pod/node/service-related + enhancements). + - New/updated metrics including `consecutiveSoftErrors` and metrics for all + supported endpoint types. + - Optional `--force-default-targets` mitigation flag to control default-target + behavior. + breaking_changes: + - 'RBAC: Service source now uses EndpointSlices; without EndpointSlice permissions, + ExternalDNS may fail to read service endpoints.' + - Metrics output was significantly reworked; existing dashboards/alerts scraping + specific series/labels will likely break. + - Removed `--txt-new-format-only` flag and deprecated legacy TXT registry format; + only the new TXT format is supported now. + - 'Removed in-tree providers: ibmcloud, tencentcloud, and ultradns; must migrate + (webhook) or stay on an older version.' + - Default-targets behavior changed; may affect record targets unless you opt + into the mitigation flag (`--force-default-targets`). chart_version: 1.18.0 - images: ['registry.k8s.io/external-dns/external-dns:v0.18.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.18.0 - version: 0.17.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16564,62 +20034,110 @@ addons: - No other explicit required values changes were called out in these notes; the main operator-facing changes are provider/flag related (see breaking/risks).' - chart_updates: [Helm chart schema and validation improvements (added missing - schema values; updated schema)., 'Chart supports `extraArgs` as a map in - addition to a list, enabling per-arg overrides.', 'Minor chart typing fix: - add missing types for empty values.'] - features: ['Helm chart: `extraArgs` can now be a map as well as a list to make - overriding individual arguments easier.', 'Cloudflare: support multiple - custom hostnames (plus fixes for duplicates/regional hostnames edge cases).', - 'Pi-hole: added optional v6 support and IPv6 dual format support.', 'Node - source: can optionally exclude unschedulable nodes.', 'Node source: optional - exposure/handling of internal IPv6 addresses (`expose-internal-ipv6`) per - IPv6 proposal 002.', Zone finder is IDNA-aware; also improved handling of - underscores in DNS records., OVH provider was heavily rewritten (functional - and behavioral improvements).] - breaking_changes: ['OpenStack Designate **in-tree provider removed** (`chore(openstack - designate)!` #5126). If you used `--provider=designate`, you must move to - the OpenStack webhook provider before upgrading.', 'OVH provider rewrite - may require **new/updated ACLs/credentials/permissions**; treat as a potentially - breaking behavioral change and follow the provider docs/PR #5143.', 'Known - issue: Active Directory provider has a **severe regression since v0.16.0** - (#5240) and is not fixed in v0.17.0 per notes; avoid upgrading or plan mitigation - if you rely on AD.', 'Deprecation heads-up: Pi-hole v5 is deprecated (v6 - support added) and will be removed in a future release.', 'Deprecation heads-up: - legacy TXT registry format is planned to be removed in the next minor version; - no migration script is provided, so plan record cleanup/migration now.'] + chart_updates: + - Helm chart schema and validation improvements (added missing schema values; + updated schema). + - Chart supports `extraArgs` as a map in addition to a list, enabling per-arg + overrides. + - 'Minor chart typing fix: add missing types for empty values.' + features: + - 'Helm chart: `extraArgs` can now be a map as well as a list to make overriding + individual arguments easier.' + - 'Cloudflare: support multiple custom hostnames (plus fixes for duplicates/regional + hostnames edge cases).' + - 'Pi-hole: added optional v6 support and IPv6 dual format support.' + - 'Node source: can optionally exclude unschedulable nodes.' + - 'Node source: optional exposure/handling of internal IPv6 addresses (`expose-internal-ipv6`) + per IPv6 proposal 002.' + - Zone finder is IDNA-aware; also improved handling of underscores in DNS records. + - OVH provider was heavily rewritten (functional and behavioral improvements). + breaking_changes: + - 'OpenStack Designate **in-tree provider removed** (`chore(openstack designate)!` + #5126). If you used `--provider=designate`, you must move to the OpenStack + webhook provider before upgrading.' + - 'OVH provider rewrite may require **new/updated ACLs/credentials/permissions**; + treat as a potentially breaking behavioral change and follow the provider + docs/PR #5143.' + - 'Known issue: Active Directory provider has a **severe regression since v0.16.0** + (#5240) and is not fixed in v0.17.0 per notes; avoid upgrading or plan mitigation + if you rely on AD.' + - 'Deprecation heads-up: Pi-hole v5 is deprecated (v6 support added) and will + be removed in a future release.' + - 'Deprecation heads-up: legacy TXT registry format is planned to be removed + in the next minor version; no migration script is provided, so plan record + cleanup/migration now.' chart_version: 1.17.0 - images: ['registry.k8s.io/external-dns/external-dns:v0.17.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.17.0 - version: 0.16.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Webhook provider improvements (webhook-* annotations forwarded to - webhooks) and additional webhook provider options documented (e.g., Infoblox, - Unifi).', CoreDNS provider gains etcd authentication support (and related - HTTPS doc updates)., AWS provider can use local AWS credential profiles - from a .credentials file., RFC2136 provider adds optional PTR record support., - 'Gateway API support evolves: GRPCRoute client updated to stable v1 and Gateway - API gains dual-stack support, plus a follow-up revert to v1beta1 objects - in v0.15.0 notes.'] - breaking_changes: [v0.15.0 drops several unmaintained in-tree providers; users - must stay on older versions or migrate to webhook providers for those DNS - providers., Infoblox in-tree provider is removed (use the Infoblox webhook - provider instead)., Cloudflare had a breaking change in v0.16.0 that is - fixed in v0.16.1; still treat Cloudflare upgrades cautiously., 'TXT registry - now has an option to use only the new TXT format; the old format is planned - for removal in the next release, so plan a migration if you rely on legacy - TXT ownership records.', OpenStack Designate in-tree provider is slated - for removal next version; migrate to the external webhook provider.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Webhook provider improvements (webhook-* annotations forwarded to webhooks) + and additional webhook provider options documented (e.g., Infoblox, Unifi). + - CoreDNS provider gains etcd authentication support (and related HTTPS doc + updates). + - AWS provider can use local AWS credential profiles from a .credentials file. + - RFC2136 provider adds optional PTR record support. + - 'Gateway API support evolves: GRPCRoute client updated to stable v1 and Gateway + API gains dual-stack support, plus a follow-up revert to v1beta1 objects in + v0.15.0 notes.' + breaking_changes: + - v0.15.0 drops several unmaintained in-tree providers; users must stay on older + versions or migrate to webhook providers for those DNS providers. + - Infoblox in-tree provider is removed (use the Infoblox webhook provider instead). + - Cloudflare had a breaking change in v0.16.0 that is fixed in v0.16.1; still + treat Cloudflare upgrades cautiously. + - TXT registry now has an option to use only the new TXT format; the old format + is planned for removal in the next release, so plan a migration if you rely + on legacy TXT ownership records. + - OpenStack Designate in-tree provider is slated for removal next version; migrate + to the external webhook provider. chart_version: 1.16.1 - images: ['registry.k8s.io/external-dns/external-dns:v0.16.1'] + images: + - registry.k8s.io/external-dns/external-dns:v0.16.1 - version: 0.15.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16631,65 +20149,112 @@ addons: \n> Practical action: run `helm diff upgrade` and pay extra attention to the\ \ webhook Deployment/Service/SA resources and any values under webhook-related\ \ keys you use.\n" - chart_updates: ['Helm chart webhook integration fixes: webhook workload now - uses the configured resource values; additional chart fixes for webhook - provider support (verify rendered manifests).'] - features: [Provider cache added to reduce repeated provider lookups and improve - performance/efficiency., 'CoreDNS provider: added etcd authentication support - (and accompanying docs for etcd HTTPS).', 'AWS provider: can use AWS profiles - via a `.credentials` file (useful when not relying on IRSA/ambient credentials).', - 'RFC2136 provider: optional PTR record support.', 'Webhook provider improvements: - passes `webhook-*` annotations through to webhook providers; webhook flags - are no longer marked experimental.', 'Gateway API: dual-stack support added.', - 'Ambassador Host source: supports annotation/label filters.'] - breaking_changes: ['Unmaintained providers were removed in v0.15.0; if you rely - on one of the dropped in-tree providers, you must stay on an older ExternalDNS - version or migrate to a webhook provider implementation.', Infoblox **in-tree** - provider was removed; use the new **Infoblox webhook provider** instead., - 'GRPCRoute client updated from `v1alpha2` to stable `v1`; if you use GRPCRoute-related - features, validate your Gateway API CRDs/versions and manifests accordingly.'] + chart_updates: + - 'Helm chart webhook integration fixes: webhook workload now uses the configured + resource values; additional chart fixes for webhook provider support (verify + rendered manifests).' + features: + - Provider cache added to reduce repeated provider lookups and improve performance/efficiency. + - 'CoreDNS provider: added etcd authentication support (and accompanying docs + for etcd HTTPS).' + - 'AWS provider: can use AWS profiles via a `.credentials` file (useful when + not relying on IRSA/ambient credentials).' + - 'RFC2136 provider: optional PTR record support.' + - 'Webhook provider improvements: passes `webhook-*` annotations through to + webhook providers; webhook flags are no longer marked experimental.' + - 'Gateway API: dual-stack support added.' + - 'Ambassador Host source: supports annotation/label filters.' + breaking_changes: + - Unmaintained providers were removed in v0.15.0; if you rely on one of the + dropped in-tree providers, you must stay on an older ExternalDNS version or + migrate to a webhook provider implementation. + - Infoblox **in-tree** provider was removed; use the new **Infoblox webhook + provider** instead. + - GRPCRoute client updated from `v1alpha2` to stable `v1`; if you use GRPCRoute-related + features, validate your Gateway API CRDs/versions and manifests accordingly. chart_version: 1.15.0 - images: ['registry.k8s.io/external-dns/external-dns:v0.15.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.15.0 - version: 0.14.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Helm chart release referenced as \u201CReleased chart for v0.13.6\u201D\ - \ (PR #3917). No explicit values schema changes were included in the provided\ - \ notes, so assume chart defaults may have shifted with image/tag bump;\ - \ verify with `helm diff` and the chart\u2019s `values.yaml` between your\ - \ chart versions.", 'Container image continues to be published as `registry.k8s.io/external-dns/external-dns:`; - v0.13.1 and v0.14.0 both use registry.k8s.io (align your image repository - overrides if you still use k8s.gcr.io).', "(From the v0.13.1 notes you included)\ - \ the Helm chart added support for configuring `dnsPolicy` for the Deployment\ - \ and changed Deployment update strategy to `Recreate` to avoid multiple\ - \ external-dns pods conflicting\u2014ensure this matches your availability\ - \ expectations during upgrades."] - features: ['Webhook provider is officially supported in v0.14.0, enabling out-of-tree - provider implementations and a mode to run external-dns as a webhook server - (`--webhook-server`).', 'New CLI flags: `--exclude-record-types` to prevent - managing specific DNS record types, and `--label-filter` support for the - node source.', 'Provider/source enhancements: Azure AAAA (IPv6) record support; - Linode NS record support; target-annotation support expanded across more - sources; Gateway/Gateway API improvements including annotation target override - on Gateway.', 'Operational/observability: new metric `external_dns_controller_last_reconcile_timestamp_seconds` - for tracking last reconcile time.'] - breaking_changes: ['`--run-aws-provider-as-webhook` flag was removed in v0.14.0; - if you used it, migrate to the new webhook provider model and/or `--webhook-server` - as appropriate.', 'Build/runtime environment change: external-dns is now - built with Go 1.21; if you depend on custom builds/plugins or strict base-image - compliance scanning, re-validate.', 'Behavioral changes worth validating: - AWS Alias records are represented as record type A; ClusterIP services with - `internal-hostname` annotation now use ServiceIP; these may affect record - outputs in some setups.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Helm chart release referenced as \u201CReleased chart for v0.13.6\u201D (PR\ + \ #3917). No explicit values schema changes were included in the provided\ + \ notes, so assume chart defaults may have shifted with image/tag bump; verify\ + \ with `helm diff` and the chart\u2019s `values.yaml` between your chart versions." + - Container image continues to be published as `registry.k8s.io/external-dns/external-dns:`; + v0.13.1 and v0.14.0 both use registry.k8s.io (align your image repository + overrides if you still use k8s.gcr.io). + - "(From the v0.13.1 notes you included) the Helm chart added support for configuring\ + \ `dnsPolicy` for the Deployment and changed Deployment update strategy to\ + \ `Recreate` to avoid multiple external-dns pods conflicting\u2014ensure this\ + \ matches your availability expectations during upgrades." + features: + - Webhook provider is officially supported in v0.14.0, enabling out-of-tree + provider implementations and a mode to run external-dns as a webhook server + (`--webhook-server`). + - 'New CLI flags: `--exclude-record-types` to prevent managing specific DNS + record types, and `--label-filter` support for the node source.' + - 'Provider/source enhancements: Azure AAAA (IPv6) record support; Linode NS + record support; target-annotation support expanded across more sources; Gateway/Gateway + API improvements including annotation target override on Gateway.' + - 'Operational/observability: new metric `external_dns_controller_last_reconcile_timestamp_seconds` + for tracking last reconcile time.' + breaking_changes: + - '`--run-aws-provider-as-webhook` flag was removed in v0.14.0; if you used + it, migrate to the new webhook provider model and/or `--webhook-server` as + appropriate.' + - 'Build/runtime environment change: external-dns is now built with Go 1.21; + if you depend on custom builds/plugins or strict base-image compliance scanning, + re-validate.' + - 'Behavioral changes worth validating: AWS Alias records are represented as + record type A; ClusterIP services with `internal-hostname` annotation now + use ServiceIP; these may affect record outputs in some setups.' chart_version: 1.14.3 - images: ['registry.k8s.io/external-dns/external-dns:v0.14.0'] + images: + - registry.k8s.io/external-dns/external-dns:v0.14.0 - version: 0.13.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16706,25 +20271,49 @@ addons: \ be aware of the known bug where deletions could incorrectly trigger TXT\ \ record deletions; ensure you are not running an affected build before/while\ \ upgrading or validate TXT ownership records after the upgrade." - chart_updates: [Helm chart supports configuring `dnsPolicy` on the Deployment., - Deployment update strategy set to `Recreate` to prevent multiple pods conflicting - during upgrades., Chart/manifests updated to newer ExternalDNS image versions - and to use `registry.k8s.io` image registry in deployment YAML.] - features: ['Target filtering can be based on network, improving control over - which endpoints are considered.', 'AWS provider supports ExternalID when - assuming a role, improving compatibility with stricter IAM setups.', 'New - DNS providers added: Tencent Cloud and Plural DNS.', 'Gateway API dependency - upgraded (v0.5.0), improving Gateway API route source support compatibility.'] - breaking_changes: [Deployment strategy change to `Recreate` alters rollout behavior; - expect brief downtime during upgrades and ensure only one replica is used - to avoid provider conflicts., Image registry change to `registry.k8s.io` - may break clusters with strict image allowlists or mirroring configurations - unless updated.] + chart_updates: + - Helm chart supports configuring `dnsPolicy` on the Deployment. + - Deployment update strategy set to `Recreate` to prevent multiple pods conflicting + during upgrades. + - Chart/manifests updated to newer ExternalDNS image versions and to use `registry.k8s.io` + image registry in deployment YAML. + features: + - Target filtering can be based on network, improving control over which endpoints + are considered. + - AWS provider supports ExternalID when assuming a role, improving compatibility + with stricter IAM setups. + - 'New DNS providers added: Tencent Cloud and Plural DNS.' + - Gateway API dependency upgraded (v0.5.0), improving Gateway API route source + support compatibility. + breaking_changes: + - Deployment strategy change to `Recreate` alters rollout behavior; expect brief + downtime during upgrades and ensure only one replica is used to avoid provider + conflicts. + - Image registry change to `registry.k8s.io` may break clusters with strict + image allowlists or mirroring configurations unless updated. chart_version: 1.12.0 - images: ['k8s.gcr.io/external-dns/external-dns:v0.13.1'] + images: + - k8s.gcr.io/external-dns/external-dns:v0.13.1 - version: 0.12.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16735,29 +20324,52 @@ addons: \ you can ignore it; if you do, set it explicitly.\n- No other Helm values\ \ changes are clearly called out in the provided notes (the rest are docs/CI\ \ fixes or app/provider changes)." - chart_updates: [Helm chart published/released as **v1.8.0**., Deployment template - now supports setting `shareProcessNamespace`., 'Minor chart/documentation - fixes (e.g., installation command line correction).'] - features: [New **Gateway API route sources** support (can generate DNS records - from Gateway API routes)., New **IBM Cloud DNS provider**., New **registry - record type** support (enhances record ownership/registry behavior)., 'Headless - Service enhancements: can set target to `NodeExternalIP` or via annotation.', - 'RFC2136 security improvement: Kerberos password is no longer exposed in logs.', - OpenShift Route source improved by using Route status more effectively., 'Istio - improvements: reuse existing VirtualService informer and add debug logging - when endpoints are missing.'] - breaking_changes: ['**Known critical bug in v0.12.0:** deletions of Kubernetes - resources may incorrectly trigger deletion of TXT records (affects deletions, - not additions) when upgrading from earlier versions. Mitigate by postponing - upgrade, being ready to manually recreate records, or downgrading; fix tracked - in PR #2811.', "Potential behavior changes for specific providers due to\ - \ dependency/client migrations (e.g., Infoblox client v2) \u2014 validate\ - \ in staging if you use these providers."] + chart_updates: + - Helm chart published/released as **v1.8.0**. + - Deployment template now supports setting `shareProcessNamespace`. + - Minor chart/documentation fixes (e.g., installation command line correction). + features: + - New **Gateway API route sources** support (can generate DNS records from Gateway + API routes). + - New **IBM Cloud DNS provider**. + - New **registry record type** support (enhances record ownership/registry behavior). + - 'Headless Service enhancements: can set target to `NodeExternalIP` or via + annotation.' + - 'RFC2136 security improvement: Kerberos password is no longer exposed in logs.' + - OpenShift Route source improved by using Route status more effectively. + - 'Istio improvements: reuse existing VirtualService informer and add debug + logging when endpoints are missing.' + breaking_changes: + - '**Known critical bug in v0.12.0:** deletions of Kubernetes resources may + incorrectly trigger deletion of TXT records (affects deletions, not additions) + when upgrading from earlier versions. Mitigate by postponing upgrade, being + ready to manually recreate records, or downgrading; fix tracked in PR #2811.' + - "Potential behavior changes for specific providers due to dependency/client\ + \ migrations (e.g., Infoblox client v2) \u2014 validate in staging if you\ + \ use these providers." chart_version: 1.10.1 - images: ['k8s.gcr.io/external-dns/external-dns:v0.12.0'] + images: + - k8s.gcr.io/external-dns/external-dns:v0.12.0 - version: 0.11.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -16777,62 +20389,102 @@ addons: \ documented/accepted values.\n\n> Note: The app release notes include a \u201C\ feat(chart): Update chart to use v0.10.2\u201D entry; ensure your helm chart\ \ version actually targets external-dns **v0.11.0** when doing the upgrade." - chart_updates: ['RBAC updates: added cluster role permissions for other sources; - restored/added permissions needed for Istio-related sources (services + - istio-gateway).', Helm chart gained `txtSuffix` value for TXT registry ownership - records., Helm chart gained support for `topologySpreadConstraints` on the - Deployment., Helm chart allows adding annotations to the Deployment., Helm - chart docs corrected the list of valid `logLevel` options.] - features: [RFC2136 provider now supports creating/updating NS records (useful - for delegations managed via RFC2136)., 'OpenShift Route source now has an - event handler, improving responsiveness/updates when Routes change.', New - SafeDNS provider added., 'BlueCat provider enhancements: supports proxy - env vars and adds new CLI options including full deploy functionality.', - 'AWS improvements: CloudFront canonical hosted zone added and additional tests/behavior - around routing policies; AWS SD provider cleanup improvements.'] - breaking_changes: ['No explicit breaking changes are called out in the provided - v0.11.0 notes; most changes are additive (RBAC, providers, chart values) - plus dependency bumps.', 'Potential operational change: image base updated - (Alpine 3.15) and Go version bumped to 1.17; if you have strict runtime/compliance - constraints, re-validate the image and behavior in your environment.'] + chart_updates: + - 'RBAC updates: added cluster role permissions for other sources; restored/added + permissions needed for Istio-related sources (services + istio-gateway).' + - Helm chart gained `txtSuffix` value for TXT registry ownership records. + - Helm chart gained support for `topologySpreadConstraints` on the Deployment. + - Helm chart allows adding annotations to the Deployment. + - Helm chart docs corrected the list of valid `logLevel` options. + features: + - RFC2136 provider now supports creating/updating NS records (useful for delegations + managed via RFC2136). + - OpenShift Route source now has an event handler, improving responsiveness/updates + when Routes change. + - New SafeDNS provider added. + - 'BlueCat provider enhancements: supports proxy env vars and adds new CLI options + including full deploy functionality.' + - 'AWS improvements: CloudFront canonical hosted zone added and additional tests/behavior + around routing policies; AWS SD provider cleanup improvements.' + breaking_changes: + - No explicit breaking changes are called out in the provided v0.11.0 notes; + most changes are additive (RBAC, providers, chart values) plus dependency + bumps. + - 'Potential operational change: image base updated (Alpine 3.15) and Go version + bumped to 1.17; if you have strict runtime/compliance constraints, re-validate + the image and behavior in your environment.' chart_version: 1.9.0 - images: ['k8s.gcr.io/external-dns/external-dns:v0.11.0'] + images: + - k8s.gcr.io/external-dns/external-dns:v0.11.0 - version: 0.10.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['External-DNS upstream added an official Helm chart in v0.10.0 - (PR #2208). If you were previously deploying via raw manifests/kustomize - or a third-party chart, decide whether to migrate to the new chart and reconcile - values/RBAC/serviceAccount naming accordingly.', "Kustomize tooling in the\ - \ repo was bumped (kustomize v0.9.0) and the repo includes various CI/security\ - \ tooling additions (CodeQL, Trivy, Dependabot). These don\u2019t affect\ - \ runtime directly but may change how you consume/build manifests if you\ - \ vendor them."] - features: [Official Helm chart added upstream (new supported install path)., - Controller updated for Kubernetes v1.22 to use networking.k8s.io/v1 Ingress - API (improves compatibility on newer clusters)., Security posture improvements - via dependency bumps and base image fixes (alpine vulnerabilities) which - may reduce CVE findings.] - breaking_changes: ['Ingress handling updated toward networking.k8s.io/v1; if - your cluster is <1.19 or you still rely on extensions/v1beta1 or networking.k8s.io/v1beta1 - Ingress, validate API availability and your Ingress manifests before upgrading.', - 'If switching to the newly introduced official Helm chart, treat it as a deployment/migration - change: flags/args mapping, resource names, and RBAC may differ from your - current installation method.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'External-DNS upstream added an official Helm chart in v0.10.0 (PR #2208). + If you were previously deploying via raw manifests/kustomize or a third-party + chart, decide whether to migrate to the new chart and reconcile values/RBAC/serviceAccount + naming accordingly.' + - "Kustomize tooling in the repo was bumped (kustomize v0.9.0) and the repo\ + \ includes various CI/security tooling additions (CodeQL, Trivy, Dependabot).\ + \ These don\u2019t affect runtime directly but may change how you consume/build\ + \ manifests if you vendor them." + features: + - Official Helm chart added upstream (new supported install path). + - Controller updated for Kubernetes v1.22 to use networking.k8s.io/v1 Ingress + API (improves compatibility on newer clusters). + - Security posture improvements via dependency bumps and base image fixes (alpine + vulnerabilities) which may reduce CVE findings. + breaking_changes: + - Ingress handling updated toward networking.k8s.io/v1; if your cluster is <1.19 + or you still rely on extensions/v1beta1 or networking.k8s.io/v1beta1 Ingress, + validate API availability and your Ingress manifests before upgrading. + - 'If switching to the newly introduced official Helm chart, treat it as a deployment/migration + change: flags/args mapping, resource names, and RBAC may differ from your + current installation method.' chart_version: 1.3.2 - images: ['k8s.gcr.io/external-dns/external-dns:v0.10.0'] + images: + - k8s.gcr.io/external-dns/external-dns:v0.10.0 - version: 0.9.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', - '1.12', '1.11', '1.10'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' + - '1.10' requirements: [] incompatibilities: [] summary: null chart_version: 1.2.0 - images: ['k8s.gcr.io/external-dns/external-dns:v0.9.0'] + images: + - k8s.gcr.io/external-dns/external-dns:v0.9.0 name: external-dns - icon: https://raw.githubusercontent.com/external-secrets/external-secrets/main/assets/eso-logo-large.png git_url: https://github.com/external-secrets/external-secrets @@ -16840,27 +20492,34 @@ addons: helm_repository_url: https://charts.external-secrets.io versions: - version: 2.10.0 - kube: ['1.36'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart was released for external-secrets app v2.9.0 (chart - packaging update only; no chart-specific value changes were called out in - the provided notes)., Deployment now applies a TLS security profile (may - introduce/enable stricter TLS settings depending on cluster defaults and - chart configuration).] - features: ['Conjur: added PushSecret support.', 'OpenBao: added `auth.kubernetes` - authentication method support.', 'Passbolt: added support for custom fields - and surfaced custom field functions in the SDK.', 'Providers: added Nebius - MysteryBox service-account token federation auth option.', 'GitHub provider: - added support for Dependabot secrets.', "Core: reconcile now reports \u201C\ - safe\u201D reconcile errors via status conditions (improves observability)."] + kube: + - '1.36' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart was released for external-secrets app v2.9.0 (chart packaging update + only; no chart-specific value changes were called out in the provided notes). + - Deployment now applies a TLS security profile (may introduce/enable stricter + TLS settings depending on cluster defaults and chart configuration). + features: + - 'Conjur: added PushSecret support.' + - 'OpenBao: added `auth.kubernetes` authentication method support.' + - 'Passbolt: added support for custom fields and surfaced custom field functions + in the SDK.' + - 'Providers: added Nebius MysteryBox service-account token federation auth + option.' + - 'GitHub provider: added support for Dependabot secrets.' + - "Core: reconcile now reports \u201Csafe\u201D reconcile errors via status\ + \ conditions (improves observability)." breaking_changes: [] chart_version: 2.10.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.10.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.10.0 - version: 2.9.0 - kube: ['1.36'] + kube: + - '1.36' requirements: [] incompatibilities: [] summary: @@ -16880,20 +20539,26 @@ addons: recheck cache-related values after upgrade. ' - chart_updates: [Adds opt-in `schedulerName` and `runtimeClassName` support for - pods., 'Conjur Helm installation improvements: adds install timeout and - pins Conjur server image version.', Fixes chart behavior where cache enablement - could be removed when `installCRD=false`., Assorted dependency/security - maintenance in the release pipeline (no chart action required).] - features: ['1Password SDK: adds **environments** support, enabling selection/segmentation - across 1Password environments.', 'Helm chart: opt-in support for configuring - `schedulerName` and `runtimeClassName` on pods for advanced scheduling and - runtime isolation.'] + chart_updates: + - Adds opt-in `schedulerName` and `runtimeClassName` support for pods. + - 'Conjur Helm installation improvements: adds install timeout and pins Conjur + server image version.' + - Fixes chart behavior where cache enablement could be removed when `installCRD=false`. + - Assorted dependency/security maintenance in the release pipeline (no chart + action required). + features: + - '1Password SDK: adds **environments** support, enabling selection/segmentation + across 1Password environments.' + - 'Helm chart: opt-in support for configuring `schedulerName` and `runtimeClassName` + on pods for advanced scheduling and runtime isolation.' breaking_changes: [] chart_version: 2.9.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.9.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.9.0 - version: 2.8.0 - kube: ['1.36', '1.35'] + kube: + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: @@ -16914,21 +20579,28 @@ addons: in Helm values; confirm your current value still makes sense after upgrade. ' - chart_updates: [Added `aggregateToAdmin` toggle for RBAC aggregation., Added - optional `NetworkPolicy` manifests/values support., Added `startupProbe` - configuration support for the webhook Deployment.] - features: [Added a GitLab deploy token generator (new generator option for GitLab - auth flows)., AWS Certificate Manager provider implemented (new backend/provider - for reading cert material)., Leader election lease timings are now configurable - (tune for HA and slow API servers)., ExternalSecrets now support a `CreateOrMerge` - creation policy (merge behavior when writing target Secrets)., 'SecretStore - `refreshInterval` now accepts a duration string (e.g., `"5m"`) in addition - to existing formats.'] + chart_updates: + - Added `aggregateToAdmin` toggle for RBAC aggregation. + - Added optional `NetworkPolicy` manifests/values support. + - Added `startupProbe` configuration support for the webhook Deployment. + features: + - Added a GitLab deploy token generator (new generator option for GitLab auth + flows). + - AWS Certificate Manager provider implemented (new backend/provider for reading + cert material). + - Leader election lease timings are now configurable (tune for HA and slow API + servers). + - ExternalSecrets now support a `CreateOrMerge` creation policy (merge behavior + when writing target Secrets). + - SecretStore `refreshInterval` now accepts a duration string (e.g., `"5m"`) + in addition to existing formats. breaking_changes: [] chart_version: 2.8.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.8.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.8.0 - version: 2.7.0 - kube: ['1.35'] + kube: + - '1.35' requirements: [] incompatibilities: [] summary: @@ -16947,43 +20619,56 @@ addons: they still apply. ' - chart_updates: ['Helm charts released as 2.6.0 (from app release notes: PR #6427).', - 'Chart templates truncate component names to comply with 63-char DNS label - constraints (PR #6428).', 'Expose `storeRequeueInterval` as a chart value - (PR #6140).', 'Scope cert-controller RBAC to managed CRDs and webhook secret - (PR #6481).'] - features: ['Dedicated OpenBao provider added, plus OpenBao enhancements (custom - CAs via `caBundle`/`caProvider`, new auth methods `userPass`/`appRole`, - and namespace support).', ExternalSecret gains `SyncWindows` to gate/limit - periodic refresh windows., AWS Secrets Manager provider adds `replicationLocations`., - 'Templating improvements: new `hexdec` function and ability to decode `templateFrom` - values.', 'New providers/capabilities: BeyondTrust WorkloadCredentials provider; - Infisical adds PushSecret support and better 404 handling; 1Password SDK - adds GetAllSecrets.'] - breaking_changes: ['PushSecret behavior for Kubernetes provider changed: when - pushing, the operator replaces the entire remote secret instead of merging - (PR #6485). This may overwrite fields you previously expected to be preserved.'] + chart_updates: + - 'Helm charts released as 2.6.0 (from app release notes: PR #6427).' + - 'Chart templates truncate component names to comply with 63-char DNS label + constraints (PR #6428).' + - 'Expose `storeRequeueInterval` as a chart value (PR #6140).' + - 'Scope cert-controller RBAC to managed CRDs and webhook secret (PR #6481).' + features: + - Dedicated OpenBao provider added, plus OpenBao enhancements (custom CAs via + `caBundle`/`caProvider`, new auth methods `userPass`/`appRole`, and namespace + support). + - ExternalSecret gains `SyncWindows` to gate/limit periodic refresh windows. + - AWS Secrets Manager provider adds `replicationLocations`. + - 'Templating improvements: new `hexdec` function and ability to decode `templateFrom` + values.' + - 'New providers/capabilities: BeyondTrust WorkloadCredentials provider; Infisical + adds PushSecret support and better 404 handling; 1Password SDK adds GetAllSecrets.' + breaking_changes: + - 'PushSecret behavior for Kubernetes provider changed: when pushing, the operator + replaces the entire remote secret instead of merging (PR #6485). This may + overwrite fields you previously expected to be preserved.' chart_version: 2.7.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.7.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.7.0 - version: 2.6.0 - kube: ['1.35', '1.34'] + kube: + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Helm chart released for app v2.5.0 (packaging update)., 'Chart - bugfix: PodDisruptionBudget now renders the PDB spec even when `minAvailable` - or `maxUnavailable` is set to `0` (previously treated as empty/falsey).'] - features: ['Keeper provider: adds `provider_api_calls_count` metric to help - observe/alert on provider API usage.', 'Passbolt: supports `v5-custom-fields` - resource type (enables syncing secrets stored as custom fields).', 'Testing: - adds OpenBao end-to-end test coverage (improves confidence for Vault/OpenBao - users).'] + chart_updates: + - Helm chart released for app v2.5.0 (packaging update). + - 'Chart bugfix: PodDisruptionBudget now renders the PDB spec even when `minAvailable` + or `maxUnavailable` is set to `0` (previously treated as empty/falsey).' + features: + - 'Keeper provider: adds `provider_api_calls_count` metric to help observe/alert + on provider API usage.' + - 'Passbolt: supports `v5-custom-fields` resource type (enables syncing secrets + stored as custom fields).' + - 'Testing: adds OpenBao end-to-end test coverage (improves confidence for Vault/OpenBao + users).' breaking_changes: [] chart_version: 2.6.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.6.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.6.0 - version: 2.5.0 - kube: ['1.35', '1.34'] + kube: + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -17001,75 +20686,100 @@ addons: \ #6343).\n- **Controller args rendering cleanup:** Removed a stale args guard\ \ in the controller deployment. If you have custom `extraArgs`/args overrides,\ \ validate the rendered manifest after upgrade (PR #6347).\n" - chart_updates: [Chart released for app v2.4.1 baseline (v2.5.0 release notes - include chart release housekeeping)., 'RBAC templates updated: conditional - `serviceaccounts/token` rule; RBAC permissions now depend on `processClusterExternalSecret`.', - 'Scoped RBAC defaults changed: `scopedNamespace` defaults to Helm release - namespace when `scopedRBAC` is enabled.', Controller deployment template - cleaned up by removing a stale args guard.] - features: ['Pulumi provider: added OIDC-based authentication support.', Added - liveness `healthz` checks for the cert-controller and webhook components - (improves probe behavior/operability)., 'GCP: Workload Identity Federation - impersonation can optionally specify a service account email.', 'Security/metrics: - added authentication and authorization for the metrics endpoint via FilterProvider.', - 'AWS: ability to inject Kubernetes context as STS session tags.'] - breaking_changes: ['RBAC behavior changes in the Helm chart can effectively - remove permissions you previously had: `serviceaccounts/token` access may - no longer be granted unless enabled, and `externalsecrets` write RBAC is - reduced when `processClusterExternalSecret` is false. Review RBAC diffs - and adjust values if needed.', 'If you enable `scopedRBAC`, `scopedNamespace` - now implicitly becomes the release namespace; set it explicitly if your - installation expects a different target namespace.'] + chart_updates: + - Chart released for app v2.4.1 baseline (v2.5.0 release notes include chart + release housekeeping). + - 'RBAC templates updated: conditional `serviceaccounts/token` rule; RBAC permissions + now depend on `processClusterExternalSecret`.' + - 'Scoped RBAC defaults changed: `scopedNamespace` defaults to Helm release + namespace when `scopedRBAC` is enabled.' + - Controller deployment template cleaned up by removing a stale args guard. + features: + - 'Pulumi provider: added OIDC-based authentication support.' + - Added liveness `healthz` checks for the cert-controller and webhook components + (improves probe behavior/operability). + - 'GCP: Workload Identity Federation impersonation can optionally specify a + service account email.' + - 'Security/metrics: added authentication and authorization for the metrics + endpoint via FilterProvider.' + - 'AWS: ability to inject Kubernetes context as STS session tags.' + breaking_changes: + - 'RBAC behavior changes in the Helm chart can effectively remove permissions + you previously had: `serviceaccounts/token` access may no longer be granted + unless enabled, and `externalsecrets` write RBAC is reduced when `processClusterExternalSecret` + is false. Review RBAC diffs and adjust values if needed.' + - If you enable `scopedRBAC`, `scopedNamespace` now implicitly becomes the release + namespace; set it explicitly if your installation expects a different target + namespace. chart_version: 2.5.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.5.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.5.0 - version: 2.4.0 - kube: ['1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart released for app v2.3.0 (chart packaging/refresh - as part of v2.4.0 release)., 'Chart fix: add `failurePolicy` to the ClusterSecretStore - validating webhook configuration (may affect admission behavior during webhook - outages).'] - features: ['Leader election: new `--leader-election-id` flag to support HA deployments - and allow multiple ESO instances with distinct leader locks.', 'Keeper provider: - support fetching secrets by either ID or name.', 'DVLS provider: add name - support for entries.', 'VaultDynamicSecret: GET method can now take parameters - from the spec; also separates GET parameters from other calls to avoid mixing - request types.'] - breaking_changes: ['Conjur provider: PushSecret and DeleteSecret now explicitly - return an error when used (if you relied on silent no-op behavior, this - will now fail).'] + kube: + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart released for app v2.3.0 (chart packaging/refresh as part of v2.4.0 + release). + - 'Chart fix: add `failurePolicy` to the ClusterSecretStore validating webhook + configuration (may affect admission behavior during webhook outages).' + features: + - 'Leader election: new `--leader-election-id` flag to support HA deployments + and allow multiple ESO instances with distinct leader locks.' + - 'Keeper provider: support fetching secrets by either ID or name.' + - 'DVLS provider: add name support for entries.' + - 'VaultDynamicSecret: GET method can now take parameters from the spec; also + separates GET parameters from other calls to avoid mixing request types.' + breaking_changes: + - 'Conjur provider: PushSecret and DeleteSecret now explicitly return an error + when used (if you relied on silent no-op behavior, this will now fail).' chart_version: 2.4.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.4.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.4.0 - version: 2.3.0 - kube: ['1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Charts were released alongside app v2.3.0 (release charts v2.2.0 - noted); no explicit Helm values changes called out in the provided notes., - 'Helm chart dependency bump: Bitwarden chart version updated to v0.6.0.'] - features: ['Doppler provider: ETag-based caching to reduce unnecessary fetches - and improve performance.', New OVHcloud provider implementation., PushSecret - support added for Delinea Secret Server., 'GCP Workload Identity Federation: - support service account impersonation when using a Kubernetes service account.', - 'PushSecret: add `dataTo` support for bulk secret pushing.', 'GitHub provider: - new `orgSecretVisibility` field.', '1Password SDK: expanded PushSecret support - (multi-field and complete PushSecret) and better native item ID support.', - 'Vault: VaultRole attribute added for TLS auth.', Vault token cache feature - promoted out of experimental with expiry validation improvements., 'Security/behavior - controls: new source null byte policy.'] - breaking_changes: ['Templating change: `getHostByName` was removed from template - functions; templates relying on it must be updated.', 'Templating dependency - change: sprig dependency removed; any templates implicitly relying on sprig-only - functions should be validated (function availability may differ).'] + kube: + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Charts were released alongside app v2.3.0 (release charts v2.2.0 noted); no + explicit Helm values changes called out in the provided notes. + - 'Helm chart dependency bump: Bitwarden chart version updated to v0.6.0.' + features: + - 'Doppler provider: ETag-based caching to reduce unnecessary fetches and improve + performance.' + - New OVHcloud provider implementation. + - PushSecret support added for Delinea Secret Server. + - 'GCP Workload Identity Federation: support service account impersonation when + using a Kubernetes service account.' + - 'PushSecret: add `dataTo` support for bulk secret pushing.' + - 'GitHub provider: new `orgSecretVisibility` field.' + - '1Password SDK: expanded PushSecret support (multi-field and complete PushSecret) + and better native item ID support.' + - 'Vault: VaultRole attribute added for TLS auth.' + - Vault token cache feature promoted out of experimental with expiry validation + improvements. + - 'Security/behavior controls: new source null byte policy.' + breaking_changes: + - 'Templating change: `getHostByName` was removed from template functions; templates + relying on it must be updated.' + - 'Templating dependency change: sprig dependency removed; any templates implicitly + relying on sprig-only functions should be validated (function availability + may differ).' chart_version: 2.3.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.3.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.3.0 - version: 2.2.0 - kube: ['1.35', '1.34'] + kube: + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -17082,27 +20792,35 @@ addons: \ readiness probe support for the `external-secrets` deployment was added\ \ (chart feature). Review your values to optionally enable/tune `readinessProbe`\ \ for the controller.\n" - chart_updates: [Added readinessProbe support for the external-secrets deployment - (chart feature)., Chart publishing/build pipeline adjusted (Docker build - v4); mostly internal but worth noting if you mirror/validate images or rely - on build metadata., Security/dependency updates in the operator image and - build chain (includes grpc CVE fix).] - features: ['GCP Secret Manager: can auto-detect `projectID` from the GCP metadata - server, reducing required configuration on GCE/GKE.', "Kubectl printers\ - \ for ExternalSecret/PushSecret now show a \u201CLast Sync\u201D column\ - \ for easier troubleshooting/ops visibility.", Passbolt provider now supports - the v5 API., Azure Key Vault provider can surface expiration time for secrets., - 'Templating: added a `certSANs` function to extract SANs from certificates.', - 'cloud.ru provider: added support for configuring a path.', '1Password provider: - supports native item IDs.', "AWS: tags and resource policy can be synced\ - \ even when the secret value hasn\u2019t changed (better drift correction)."] - breaking_changes: [Flux + OCIRepository chart consumers must update to use a - `layerSelector` when pulling the chart from the OCI registry; without it - Flux may fail to fetch/extract the chart.] + chart_updates: + - Added readinessProbe support for the external-secrets deployment (chart feature). + - Chart publishing/build pipeline adjusted (Docker build v4); mostly internal + but worth noting if you mirror/validate images or rely on build metadata. + - Security/dependency updates in the operator image and build chain (includes + grpc CVE fix). + features: + - 'GCP Secret Manager: can auto-detect `projectID` from the GCP metadata server, + reducing required configuration on GCE/GKE.' + - "Kubectl printers for ExternalSecret/PushSecret now show a \u201CLast Sync\u201D\ + \ column for easier troubleshooting/ops visibility." + - Passbolt provider now supports the v5 API. + - Azure Key Vault provider can surface expiration time for secrets. + - 'Templating: added a `certSANs` function to extract SANs from certificates.' + - 'cloud.ru provider: added support for configuring a path.' + - '1Password provider: supports native item IDs.' + - "AWS: tags and resource policy can be synced even when the secret value hasn\u2019\ + t changed (better drift correction)." + breaking_changes: + - Flux + OCIRepository chart consumers must update to use a `layerSelector` + when pulling the chart from the OCI registry; without it Flux may fail to + fetch/extract the chart. chart_version: 2.2.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.2.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.2.0 - version: 2.1.0 - kube: ['1.35', '1.34'] + kube: + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -17117,45 +20835,58 @@ addons: \ annotations after upgrade.\n\n> No explicit values renames/removals were\ \ listed in the provided notes; validate against the chart\u2019s `values.yaml`/README\ \ when you pull the new chart." - chart_updates: [Helm chart refreshed for the v2.1.0 release., Added a chart - option to enable leader election for the cert-manager/cert-controller component., - Fixed incorrectly set annotations on the cert-controller metrics Service.] - features: ['Kubernetes TLS handling now falls back to system CA roots when no - CA bundle is configured, reducing configuration friction for outbound TLS.', - 'Allows cross-namespace PushSecret when using ClusterSecretStore, enabling - more flexible multi-namespace workflows.', 'Added a new provider integration: - Nebius MysteryBox.', 'Implemented a `SecretExists` check, improving behavior/logic - around secret presence detection.', 'Metrics and caching logic were corrected - and missing metrics added, improving observability and correctness.'] - breaking_changes: ["No new breaking changes were called out for v2.1.0 in the\ - \ provided notes. Note: v2.0.1 reiterates that the earlier sprig templating\ - \ function changes are breaking\u2014retest any ExternalSecret templates\ - \ that use sprig functions."] + chart_updates: + - Helm chart refreshed for the v2.1.0 release. + - Added a chart option to enable leader election for the cert-manager/cert-controller + component. + - Fixed incorrectly set annotations on the cert-controller metrics Service. + features: + - Kubernetes TLS handling now falls back to system CA roots when no CA bundle + is configured, reducing configuration friction for outbound TLS. + - Allows cross-namespace PushSecret when using ClusterSecretStore, enabling + more flexible multi-namespace workflows. + - 'Added a new provider integration: Nebius MysteryBox.' + - Implemented a `SecretExists` check, improving behavior/logic around secret + presence detection. + - Metrics and caching logic were corrected and missing metrics added, improving + observability and correctness. + breaking_changes: + - "No new breaking changes were called out for v2.1.0 in the provided notes.\ + \ Note: v2.0.1 reiterates that the earlier sprig templating function changes\ + \ are breaking\u2014retest any ExternalSecret templates that use sprig functions." chart_version: 2.1.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.1.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.1.0 - version: 2.0.1 - kube: ['1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart was released for v2.0.0 (no explicit values/schema - changes called out in these notes); review chart version alignment when - bumping app image/tag., "Chart previously bumped to 1.3.2 as part of v2.0.0;\ - \ v2.0.1 notes don\u2019t mention further chart version/value changes."] - features: ['HostAliases support was added to the Helm chart (v2.0.0), enabling - you to configure pod-level /etc/hosts entries via chart values.', 'Validating - webhook failurePolicy for SecretStore is now determined dynamically (v2.0.0), - improving webhook behavior across environments.'] - breaking_changes: [Providers Alibaba and Device42 were removed in v2.0.0; any - SecretStore/ClusterSecretStore using them will stop working and must be - migrated to a supported provider., Sprig dependency update in v2.0.1 changes - some templating functions; templates in ExternalSecret/ClusterExternalSecret - that relied on old sprig behavior may render differently or fail.] + kube: + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart was released for v2.0.0 (no explicit values/schema changes called + out in these notes); review chart version alignment when bumping app image/tag. + - "Chart previously bumped to 1.3.2 as part of v2.0.0; v2.0.1 notes don\u2019\ + t mention further chart version/value changes." + features: + - HostAliases support was added to the Helm chart (v2.0.0), enabling you to + configure pod-level /etc/hosts entries via chart values. + - Validating webhook failurePolicy for SecretStore is now determined dynamically + (v2.0.0), improving webhook behavior across environments. + breaking_changes: + - Providers Alibaba and Device42 were removed in v2.0.0; any SecretStore/ClusterSecretStore + using them will stop working and must be migrated to a supported provider. + - Sprig dependency update in v2.0.1 changes some templating functions; templates + in ExternalSecret/ClusterExternalSecret that relied on old sprig behavior + may render differently or fail. chart_version: 2.0.1 - images: ['ghcr.io/external-secrets/external-secrets:v2.0.1'] + images: + - ghcr.io/external-secrets/external-secrets:v2.0.1 - version: 2.0.0 - kube: ['1.34'] + kube: + - '1.34' requirements: [] incompatibilities: [] summary: @@ -17171,106 +20902,135 @@ addons: \ for Secretstore dynamically`). If you previously relied on a fixed failurePolicy\ \ setting, re-check resulting rendered manifests and admission behavior in\ \ your cluster.\n" - chart_updates: [Added `hostAliases` support in the Helm chart (lets you inject - host aliases into pods)., Validating webhook failurePolicy for SecretStore - is now determined dynamically (behavior/manifest may differ from prior releases)., - Chart housekeeping/cleanup and chart version bump noted as part of the release - process.] - features: [Helm chart now supports configuring `hostAliases` for External Secrets - pods., 'SecretStore validating webhook failurePolicy is now set dynamically, - improving compatibility across cluster conditions.'] - breaking_changes: [Providers **Alibaba** and **Device42** were removed (unsupported/unmaintained). - Any `SecretStore`/`ClusterSecretStore` using these providers will stop working - and must be migrated to a supported provider before upgrading.] + chart_updates: + - Added `hostAliases` support in the Helm chart (lets you inject host aliases + into pods). + - Validating webhook failurePolicy for SecretStore is now determined dynamically + (behavior/manifest may differ from prior releases). + - Chart housekeeping/cleanup and chart version bump noted as part of the release + process. + features: + - Helm chart now supports configuring `hostAliases` for External Secrets pods. + - SecretStore validating webhook failurePolicy is now set dynamically, improving + compatibility across cluster conditions. + breaking_changes: + - Providers **Alibaba** and **Device42** were removed (unsupported/unmaintained). + Any `SecretStore`/`ClusterSecretStore` using these providers will stop working + and must be migrated to a supported provider before upgrading. chart_version: 2.0.0 - images: ['ghcr.io/external-secrets/external-secrets:v2.0.0'] + images: + - ghcr.io/external-secrets/external-secrets:v2.0.0 - version: 1.3.2 - kube: ['1.34'] + kube: + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Helm chart released/updated around this range (notably: chart - release 1.2.0 in app v1.2.1 notes; chart release for v1.3.1 mentioned in - v1.3.2 notes).', 'Chart: added/ensured tests for `readinessProbe` values/rendering - (PR #5769).'] - features: ['Infisical provider: added support for `caBundle` and `caProvider` - to trust custom CAs when talking to Infisical.'] + chart_updates: + - 'Helm chart released/updated around this range (notably: chart release 1.2.0 + in app v1.2.1 notes; chart release for v1.3.1 mentioned in v1.3.2 notes).' + - 'Chart: added/ensured tests for `readinessProbe` values/rendering (PR #5769).' + features: + - 'Infisical provider: added support for `caBundle` and `caProvider` to trust + custom CAs when talking to Infisical.' breaking_changes: [] chart_version: 1.3.2 - images: ['ghcr.io/external-secrets/external-secrets:v1.3.2'] + images: + - ghcr.io/external-secrets/external-secrets:v1.3.2 - version: 1.2.1 - kube: ['1.34'] + kube: + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Helm chart bumped from 1.1.0 (noted in app v1.1.1 release notes) - to 1.2.0 (noted in app v1.2.1 release notes).] - features: ['Infisical provider: added caBundle and caProvider support for custom/cluster - CA handling.', 'Doppler provider: added configurable retry settings.', 'BeyondTrust - provider: enabled pushing secrets to BeyondTrust.', 'Password generator: - can generate and expose multiple passwords.', 'Oracle provider: implemented - SecretExists check/behavior.', 'Helm chart: added dynamic labelSelector - when topologySpreadConstraints labelSelector is not defined.'] + chart_updates: + - Helm chart bumped from 1.1.0 (noted in app v1.1.1 release notes) to 1.2.0 + (noted in app v1.2.1 release notes). + features: + - 'Infisical provider: added caBundle and caProvider support for custom/cluster + CA handling.' + - 'Doppler provider: added configurable retry settings.' + - 'BeyondTrust provider: enabled pushing secrets to BeyondTrust.' + - 'Password generator: can generate and expose multiple passwords.' + - 'Oracle provider: implemented SecretExists check/behavior.' + - 'Helm chart: added dynamic labelSelector when topologySpreadConstraints labelSelector + is not defined.' breaking_changes: [] chart_version: 1.2.1 - images: ['ghcr.io/external-secrets/external-secrets:v1.2.1'] + images: + - ghcr.io/external-secrets/external-secrets:v1.2.1 - version: 1.1.1 - kube: ['1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart released for operator v1.0.0 (from v0.20.4); includes - a fix to normalize the default certificate duration value., Helm chart released - as version 1.1.0 as part of the v1.1.1 application release notes., 'Helm - chart enhancement: add dynamic labelSelector when topologySpreadConstraints - is set but labelSelector is not explicitly defined.'] - features: [Dynamic target implementation for external secrets sources (new behavior - around how targets can be selected/handled)., 'esoctl: new bootstrap generator - commands to help generate/initialize generator-related resources.', 'Doppler - provider: configurable retry settings support.', 'BeyondTrust provider: - enable pushing secrets (write/push support).', 'Oracle provider: implement - SecretExists support (improves behavior/validation when checking for existing - secrets).', 'Generator: password generator can generate and expose multiple - passwords.', 'Bitwarden Secrets Manager: `bitwardenServerSDKURL` is now - required for `bitwardensecretsmanager`.', 'Helm: dynamic labelSelector defaulting - for topologySpreadConstraints to reduce misconfiguration.'] - breaking_changes: [Bitwarden Secrets Manager integration now requires `bitwardenServerSDKURL` - for `bitwardensecretsmanager`; existing configs without it will fail until - set.] + kube: + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart released for operator v1.0.0 (from v0.20.4); includes a fix to + normalize the default certificate duration value. + - Helm chart released as version 1.1.0 as part of the v1.1.1 application release + notes. + - 'Helm chart enhancement: add dynamic labelSelector when topologySpreadConstraints + is set but labelSelector is not explicitly defined.' + features: + - Dynamic target implementation for external secrets sources (new behavior around + how targets can be selected/handled). + - 'esoctl: new bootstrap generator commands to help generate/initialize generator-related + resources.' + - 'Doppler provider: configurable retry settings support.' + - 'BeyondTrust provider: enable pushing secrets (write/push support).' + - 'Oracle provider: implement SecretExists support (improves behavior/validation + when checking for existing secrets).' + - 'Generator: password generator can generate and expose multiple passwords.' + - 'Bitwarden Secrets Manager: `bitwardenServerSDKURL` is now required for `bitwardensecretsmanager`.' + - 'Helm: dynamic labelSelector defaulting for topologySpreadConstraints to reduce + misconfiguration.' + breaking_changes: + - Bitwarden Secrets Manager integration now requires `bitwardenServerSDKURL` + for `bitwardensecretsmanager`; existing configs without it will fail until + set. chart_version: 1.1.1 - images: ['ghcr.io/external-secrets/external-secrets:v1.1.1'] + images: + - ghcr.io/external-secrets/external-secrets:v1.1.1 - version: 1.0.0 - kube: ['1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart release/update is included for v0.20.4 (from v0.20.3) - but v1.0.0 notes provided do not include specific chart value/key changes - beyond one default normalization and internal chart cleanups mentioned in - PR titles., 'Chart-related changes called out: removed unused values from - the chart (in v0.20.4) and normalized the default certificate duration value - (in v1.0.0).'] - features: [Dynamic target implementation for ExternalSecret sources (new dynamic - target behavior/implementation)., 'esoctl: new bootstrap generator commands - to help generate bootstrap manifests/config for generators.', 'Generators: - added a hex generator.', 'AWS Secrets Manager: ability to define a resource - policy via metadata.', E2E managed tests were re-implemented (improves test - coverage/reliability rather than user-facing runtime behavior).] - breaking_changes: ['Possible Helm values impact: chart removed unused values - (if you set any of those keys, Helm will now ignore/possibly error depending - on tooling) and the default certificate duration value was normalized (could - change effective cert validity if you relied on the previous implicit default).', - 'Go module separation/internal build changes (generally not runtime-breaking - for users, but could affect downstream builds/forks or custom images if - you vendor/import ESO modules).'] + kube: + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart release/update is included for v0.20.4 (from v0.20.3) but v1.0.0 + notes provided do not include specific chart value/key changes beyond one + default normalization and internal chart cleanups mentioned in PR titles. + - 'Chart-related changes called out: removed unused values from the chart (in + v0.20.4) and normalized the default certificate duration value (in v1.0.0).' + features: + - Dynamic target implementation for ExternalSecret sources (new dynamic target + behavior/implementation). + - 'esoctl: new bootstrap generator commands to help generate bootstrap manifests/config + for generators.' + - 'Generators: added a hex generator.' + - 'AWS Secrets Manager: ability to define a resource policy via metadata.' + - E2E managed tests were re-implemented (improves test coverage/reliability + rather than user-facing runtime behavior). + breaking_changes: + - 'Possible Helm values impact: chart removed unused values (if you set any + of those keys, Helm will now ignore/possibly error depending on tooling) and + the default certificate duration value was normalized (could change effective + cert validity if you relied on the previous implicit default).' + - Go module separation/internal build changes (generally not runtime-breaking + for users, but could affect downstream builds/forks or custom images if you + vendor/import ESO modules). chart_version: 1.0.0 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v1.0.0'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v1.0.0 - version: 0.20.4 - kube: ['1.34'] + kube: + - '1.34' requirements: [] incompatibilities: [] summary: @@ -17279,66 +21039,82 @@ addons: \ includes keys that are no longer referenced, they may be ignored or trigger\ \ schema/lint failures depending on your tooling\u2014run a diff/`helm template`\ \ and remove any obsolete keys.\n" - chart_updates: ['Helm chart released for v0.20.3 as part of the v0.20.4 notes - (PR #5467).', 'Chart values were cleaned up by removing unused options (PR - #5334).'] - features: [New **hex generator** was added (generators)., AWS Secrets Manager - now supports defining a **resource policy via metadata**., "E2E \u201Cmanaged\ - \ tests\u201D were re-implemented (primarily CI/test infrastructure, not\ - \ user-facing behavior).", 'Infisical provider gained additional auth methods - (Kubernetes, AWS, token auth) noted earlier in the range (from v0.19.2 notes).'] - breaking_changes: ['STSSessionToken generator documentation indicates the **JWT - token authentication option was removed**; if you relied on that auth mode, - migrate to a supported method.', UBI-based container images were updated - from **UBI8 to UBI9**; this can be breaking for environments with strict - base-image allowlists or vulnerability/compliance baselines.] + chart_updates: + - 'Helm chart released for v0.20.3 as part of the v0.20.4 notes (PR #5467).' + - 'Chart values were cleaned up by removing unused options (PR #5334).' + features: + - New **hex generator** was added (generators). + - AWS Secrets Manager now supports defining a **resource policy via metadata**. + - "E2E \u201Cmanaged tests\u201D were re-implemented (primarily CI/test infrastructure,\ + \ not user-facing behavior)." + - Infisical provider gained additional auth methods (Kubernetes, AWS, token + auth) noted earlier in the range (from v0.19.2 notes). + breaking_changes: + - STSSessionToken generator documentation indicates the **JWT token authentication + option was removed**; if you relied on that auth mode, migrate to a supported + method. + - UBI-based container images were updated from **UBI8 to UBI9**; this can be + breaking for environments with strict base-image allowlists or vulnerability/compliance + baselines. chart_version: 0.20.4 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.20.4'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.20.4 - version: 0.19.2 - kube: ['1.33'] + kube: + - '1.33' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Helm chart was re-released alongside the app version (v0.18.1 - chart release mentioned in v0.18.2 notes; v0.19.1 chart release mentioned - in v0.19.2 notes). No explicit values/schema changes are called out in the - provided notes., 'Container image options changed operationally: v0.18.2 - notes warn UBI images are broken; v0.19.2 includes working `-ubi` and `-ubi-boringssl` - images again.'] - features: ['Infisical provider enhancements: additional auth methods (Kubernetes, - AWS, token) in v0.19.2; earlier v0.18.2 added Azure auth/refactor to Go - SDK.', 'GitLab provider: support for custom CAs (v0.18.2).', 'AWS Parameter - Store: support selecting parameters by AWS tags (v0.18.2).', 'Bitwarden - SDK server subchart: ability to set namespace (v0.18.2).'] + chart_updates: + - Helm chart was re-released alongside the app version (v0.18.1 chart release + mentioned in v0.18.2 notes; v0.19.1 chart release mentioned in v0.19.2 notes). + No explicit values/schema changes are called out in the provided notes. + - 'Container image options changed operationally: v0.18.2 notes warn UBI images + are broken; v0.19.2 includes working `-ubi` and `-ubi-boringssl` images again.' + features: + - 'Infisical provider enhancements: additional auth methods (Kubernetes, AWS, + token) in v0.19.2; earlier v0.18.2 added Azure auth/refactor to Go SDK.' + - 'GitLab provider: support for custom CAs (v0.18.2).' + - 'AWS Parameter Store: support selecting parameters by AWS tags (v0.18.2).' + - 'Bitwarden SDK server subchart: ability to set namespace (v0.18.2).' breaking_changes: [] chart_version: 0.19.2 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.19.2'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.19.2 - version: 0.18.2 - kube: ['1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['v0.17.0: Helm chart updated (release notes mention chart update - to v0.16.2); no explicit value changes called out in provided notes.', 'v0.18.2: - Helm chart released for v0.18.1 (packaging/release process); no explicit - helm values changes called out in provided notes.', 'v0.18.2: bitwarden-sdk-server - subchart now supports configuring its namespace (new chart capability).'] - features: ['v0.17.0: Added a 1Password SDK-based provider.', 'v0.17.0: Infisical - provider now supports secrets within paths for `data` references.', 'v0.17.0: - Vault provider can cache separate clients per namespace when needed.', 'v0.18.2: - GitLab provider supports custom CAs.', 'v0.18.2: Infisical provider adds - Azure auth and refactors to the Go SDK.', 'v0.18.2: AWS Parameter Store - supports filtering/working with AWS tags.', 'v0.18.2: Bitwarden SDK server - subchart allows setting the namespace.'] - breaking_changes: ['v0.17.0: Stops serving `external-secrets.io/v1beta1` APIs; - all manifests must be migrated to `external-secrets.io/v1` before upgrading - from 0.16.x to 0.17.0.'] + kube: + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'v0.17.0: Helm chart updated (release notes mention chart update to v0.16.2); + no explicit value changes called out in provided notes.' + - 'v0.18.2: Helm chart released for v0.18.1 (packaging/release process); no + explicit helm values changes called out in provided notes.' + - 'v0.18.2: bitwarden-sdk-server subchart now supports configuring its namespace + (new chart capability).' + features: + - 'v0.17.0: Added a 1Password SDK-based provider.' + - 'v0.17.0: Infisical provider now supports secrets within paths for `data` + references.' + - 'v0.17.0: Vault provider can cache separate clients per namespace when needed.' + - 'v0.18.2: GitLab provider supports custom CAs.' + - 'v0.18.2: Infisical provider adds Azure auth and refactors to the Go SDK.' + - 'v0.18.2: AWS Parameter Store supports filtering/working with AWS tags.' + - 'v0.18.2: Bitwarden SDK server subchart allows setting the namespace.' + breaking_changes: + - 'v0.17.0: Stops serving `external-secrets.io/v1beta1` APIs; all manifests + must be migrated to `external-secrets.io/v1` before upgrading from 0.16.x + to 0.17.0.' chart_version: 0.18.2 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.18.2'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.18.2 - version: 0.17.0 - kube: ['1.33'] + kube: + - '1.33' requirements: [] incompatibilities: [] summary: @@ -17351,30 +21127,36 @@ addons: \ and some chart-release fixes, but the notes provided don\u2019t list additional\ \ required values changes beyond the RBAC aggregation toggle and the Grafana\ \ dashboard addition.\n" - chart_updates: [Added Grafana dashboard manifests to the Helm chart (0.16.2)., - Added Helm option to disable RBAC aggregation labels (`aggregate-to-view` - / `aggregate-to-edit`) on default ClusterRoles (0.16.2)., 'Chart release - process fixes (0.17.0): avoid re-releasing an already released chart; remove - an in-chart comment; fix logic around releasing charts.'] - features: ['Generic webhook provider: added NTLM authentication support (0.16.2).', - Improved GitHub provider error reporting (0.17.0)., 'GCP PushSecret: fixed - location replication behavior (0.17.0).', 'Infisical provider: support secrets - within paths for `data` references (0.17.0).', 'Vault provider: cache separate - clients per namespace when needed (0.17.0).', Added a new 1Password SDK-based - provider (0.17.0)., 'Helm: optional Grafana dashboard for observability - (0.16.2).'] - breaking_changes: ['**v0.17.0 stops serving `external-secrets.io/v1beta1` APIs.** - You must update all External Secrets Operator CR manifests from `apiVersion: - external-secrets.io/v1beta1` to `apiVersion: external-secrets.io/v1` before - upgrading from 0.16.x to 0.17.0. The intended change is just removing `beta1`, - and 0.16.2 already supports `v1` to allow a safe transition.', '**v0.16.2 - Generator refresh behavior changed.** If you use Generators with `refreshInterval: - 0` or a refresh policy intended to prevent updates, 0.16.2 will force updates - anyway; review Generator usage/expectations before and after upgrading.'] + chart_updates: + - Added Grafana dashboard manifests to the Helm chart (0.16.2). + - Added Helm option to disable RBAC aggregation labels (`aggregate-to-view` + / `aggregate-to-edit`) on default ClusterRoles (0.16.2). + - 'Chart release process fixes (0.17.0): avoid re-releasing an already released + chart; remove an in-chart comment; fix logic around releasing charts.' + features: + - 'Generic webhook provider: added NTLM authentication support (0.16.2).' + - Improved GitHub provider error reporting (0.17.0). + - 'GCP PushSecret: fixed location replication behavior (0.17.0).' + - 'Infisical provider: support secrets within paths for `data` references (0.17.0).' + - 'Vault provider: cache separate clients per namespace when needed (0.17.0).' + - Added a new 1Password SDK-based provider (0.17.0). + - 'Helm: optional Grafana dashboard for observability (0.16.2).' + breaking_changes: + - '**v0.17.0 stops serving `external-secrets.io/v1beta1` APIs.** You must update + all External Secrets Operator CR manifests from `apiVersion: external-secrets.io/v1beta1` + to `apiVersion: external-secrets.io/v1` before upgrading from 0.16.x to 0.17.0. + The intended change is just removing `beta1`, and 0.16.2 already supports + `v1` to allow a safe transition.' + - '**v0.16.2 Generator refresh behavior changed.** If you use Generators with + `refreshInterval: 0` or a refresh policy intended to prevent updates, 0.16.2 + will force updates anyway; review Generator usage/expectations before and + after upgrading.' chart_version: 0.17.0 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.17.0'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.17.0 - version: 0.16.2 - kube: ['1.32'] + kube: + - '1.32' requirements: [] incompatibilities: [] summary: @@ -17383,235 +21165,376 @@ addons: t want ESO roles automatically aggregated into the built-in `view/edit` roles).\n\ - **Helm chart adds a Grafana dashboard** (if you deploy dashboards via Helm,\ \ expect new/updated dashboard resources).\n" - chart_updates: [Helm chart release bumped to v0.16.1 (chart packaging changes - aligned with app v0.16.x)., 'Helm: Added a bundled Grafana dashboard.', - 'Helm: Added values/support to disable `aggregate-to-view`/`aggregate-to-edit` - labels on default ClusterRoles.'] - features: [Grafana dashboard support was added to the Helm chart for easier - observability/monitoring., Generic webhook generator gained NTLM authentication - support (relevant if you use the webhook generator with NTLM-protected endpoints).] - breaking_changes: ['**Generators behavior change:** If you use Generators with - `refreshInterval: 0` (or another refreshPolicy intended to prevent updates), - upgrading to **v0.16.2 will force that value to be updated**, potentially - causing unexpected secret refreshes/rotations.'] + chart_updates: + - Helm chart release bumped to v0.16.1 (chart packaging changes aligned with + app v0.16.x). + - 'Helm: Added a bundled Grafana dashboard.' + - 'Helm: Added values/support to disable `aggregate-to-view`/`aggregate-to-edit` + labels on default ClusterRoles.' + features: + - Grafana dashboard support was added to the Helm chart for easier observability/monitoring. + - Generic webhook generator gained NTLM authentication support (relevant if + you use the webhook generator with NTLM-protected endpoints). + breaking_changes: + - '**Generators behavior change:** If you use Generators with `refreshInterval: + 0` (or another refreshPolicy intended to prevent updates), upgrading to **v0.16.2 + will force that value to be updated**, potentially causing unexpected secret + refreshes/rotations.' chart_version: 0.16.2 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.16.2'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.16.2 - version: 0.15.1 - kube: ['1.32'] + kube: + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v0.14.4 introduced a Prometheus status metric for PushSecret objects., - v0.14.4 added support for tagging secrets when pushing to Azure Key Vault., - v0.14.4 enabled pushing an entire secret to AWS Secrets Manager (PushSecret - use case)., v0.14.4 made Vault auth an optional entry in its configuration/secret - reference., v0.14.4 updated AWS identity documentation to include the EKS - pod identity flow., v0.14.4 updated the project to build with Go 1.24.] + features: + - v0.14.4 introduced a Prometheus status metric for PushSecret objects. + - v0.14.4 added support for tagging secrets when pushing to Azure Key Vault. + - v0.14.4 enabled pushing an entire secret to AWS Secrets Manager (PushSecret + use case). + - v0.14.4 made Vault auth an optional entry in its configuration/secret reference. + - v0.14.4 updated AWS identity documentation to include the EKS pod identity + flow. + - v0.14.4 updated the project to build with Go 1.24. breaking_changes: [] chart_version: 0.15.1 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.15.1'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.15.1 - version: 0.14.4 - kube: ['1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Chart bundle updated to app v0.14.3 as part of the v0.14.4 release - notes (no explicit chart-value changes called out in the provided notes).] - features: ['AWS Parameter Store PushSecret: new metadata/spec structure supports - configuring tier, KMS key, secretType, and policies/attributes (breaking - vs previous metadata format).', 'New generator: Quay generator support.', - New renderer for template data and secrets (rendering improvements/CLI tooling - referenced as esoctl)., 'PushSecret observability: Prometheus status metric - for PushSecret objects.', 'Azure Key Vault PushSecret: ability to specify - tags when pushing secrets.', 'AWS Secrets Manager PushSecret: option to - push the entire secret payload.', 'Vault: allowEmptyResponse for VaultDynamicSecret; - and vault auth entry can be optional.', 'Vault provider: allow UUID as vault - and item name.', 'Infisical provider: allow reference expansion when searching - by key; improved error handling to avoid silent failures.'] - breaking_changes: [AWS Parameter Store PushSecret metadata format changed (METADATA - structure breaking change). Existing PushSecrets using old metadata must - be migrated to the new PushSecretMetadata spec structure before/with upgrade.] + kube: + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Chart bundle updated to app v0.14.3 as part of the v0.14.4 release notes (no + explicit chart-value changes called out in the provided notes). + features: + - 'AWS Parameter Store PushSecret: new metadata/spec structure supports configuring + tier, KMS key, secretType, and policies/attributes (breaking vs previous metadata + format).' + - 'New generator: Quay generator support.' + - New renderer for template data and secrets (rendering improvements/CLI tooling + referenced as esoctl). + - 'PushSecret observability: Prometheus status metric for PushSecret objects.' + - 'Azure Key Vault PushSecret: ability to specify tags when pushing secrets.' + - 'AWS Secrets Manager PushSecret: option to push the entire secret payload.' + - 'Vault: allowEmptyResponse for VaultDynamicSecret; and vault auth entry can + be optional.' + - 'Vault provider: allow UUID as vault and item name.' + - 'Infisical provider: allow reference expansion when searching by key; improved + error handling to avoid silent failures.' + breaking_changes: + - AWS Parameter Store PushSecret metadata format changed (METADATA structure + breaking change). Existing PushSecrets using old metadata must be migrated + to the new PushSecretMetadata spec structure before/with upgrade. chart_version: 0.14.4 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.14.4'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.14.4 - version: 0.13.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [No Helm chart-specific changelog provided in the supplied notes - (only application release notes)., 'Assume Helm chart version bumps alongside - app versions; verify chart version and values schema by running `helm show - values` for both versions and diffing, and review rendered manifests with - `helm template`.'] - features: ['AWS Parameter Store PushSecret: can now configure Parameter Store - tier (Standard/Advanced) and richer metadata options (KMS key, policies, - attributes).', 'Generators: new Quay generator support.', 'VaultDynamicSecret: - new `allowEmptyResponse` option to tolerate empty responses.', 'Template - rendering: added a renderer for template data and secrets (new/updated CLI - plumbing; release notes mention rename in release action from `render` to - `esoctl`).', 'Infisical provider: improved error handling so missing secrets/incorrect - auth no longer fail silently.'] - breaking_changes: [AWS Parameter Store PushSecret metadata structure changed - (v0.13.0). Existing PushSecret manifests using the old metadata layout will - break and must be updated to the new `PushSecretMetadata` structure documented - in the provider docs., '(From 0.12.1, still relevant if you skipped it) - AWS provider permission update: Bulk/Batch fetch for multiple secrets requires - adding the BulkFetch/batch endpoint permission to IAM policies.', '(From - 0.12.1, still relevant) GCP Secret Manager PushSecret metadata format was - standardized (including CMEK); older manifests will stop working until updated.', - "(From 0.12.1, still relevant) Generator JSON tag typo fix (`ecrRAuthorizationTokenSpec`\ - \ \u2192 `ecrAuthorizationTokenSpec`) may affect any custom tooling/JSON-based\ - \ specs relying on the old field name."] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart-specific changelog provided in the supplied notes (only application + release notes). + - Assume Helm chart version bumps alongside app versions; verify chart version + and values schema by running `helm show values` for both versions and diffing, + and review rendered manifests with `helm template`. + features: + - 'AWS Parameter Store PushSecret: can now configure Parameter Store tier (Standard/Advanced) + and richer metadata options (KMS key, policies, attributes).' + - 'Generators: new Quay generator support.' + - 'VaultDynamicSecret: new `allowEmptyResponse` option to tolerate empty responses.' + - 'Template rendering: added a renderer for template data and secrets (new/updated + CLI plumbing; release notes mention rename in release action from `render` + to `esoctl`).' + - 'Infisical provider: improved error handling so missing secrets/incorrect + auth no longer fail silently.' + breaking_changes: + - AWS Parameter Store PushSecret metadata structure changed (v0.13.0). Existing + PushSecret manifests using the old metadata layout will break and must be + updated to the new `PushSecretMetadata` structure documented in the provider + docs. + - '(From 0.12.1, still relevant if you skipped it) AWS provider permission update: + Bulk/Batch fetch for multiple secrets requires adding the BulkFetch/batch + endpoint permission to IAM policies.' + - (From 0.12.1, still relevant) GCP Secret Manager PushSecret metadata format + was standardized (including CMEK); older manifests will stop working until + updated. + - "(From 0.12.1, still relevant) Generator JSON tag typo fix (`ecrRAuthorizationTokenSpec`\ + \ \u2192 `ecrAuthorizationTokenSpec`) may affect any custom tooling/JSON-based\ + \ specs relying on the old field name." chart_version: 0.13.0 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.13.0'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.13.0 - version: 0.12.1 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Application version moves from v0.11.0 to v0.12.1 (note: v0.12.0 - tag exists but release failed; v0.12.1 is the intended upgrade target).', - "OLM note from v0.11.0: 0.11.0 is the last OLM release \u201Cuntil further\ - \ notice\u201D; you can keep OLM manifests but must set `image.tag` to run\ - \ newer ESO images."] - features: ['AWS provider now uses a bulk/batch fetch mechanism when retrieving - multiple secrets, reducing API calls.', GCP Secrets Manager PushSecret gains - CMEK support and a standardized metadata structure., 1Password PushSecret - adds support for tags and configurable destination vault., AWS ECR Public - authorization token generator support was added., Template helper `filterCertChain` - was added; default controller QPS/Burst increased to 50/100; various provider - robustness fixes (GitLab/Vault/GCP labels).] - breaking_changes: ['AWS provider permission change: additional permission required - for the BulkFetch/batch endpoint when fetching multiple secrets.', 'Generator - JSON tag typo fixed: `ecrRAuthorizationTokenSpec` corrected (manifests using - the old field/tag may break).', GCP Secrets Manager PushSecret metadata - format was standardized; existing PushSecret manifests may stop working - until updated to the new structure.] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Application version moves from v0.11.0 to v0.12.1 (note: v0.12.0 tag exists + but release failed; v0.12.1 is the intended upgrade target).' + - "OLM note from v0.11.0: 0.11.0 is the last OLM release \u201Cuntil further\ + \ notice\u201D; you can keep OLM manifests but must set `image.tag` to run\ + \ newer ESO images." + features: + - AWS provider now uses a bulk/batch fetch mechanism when retrieving multiple + secrets, reducing API calls. + - GCP Secrets Manager PushSecret gains CMEK support and a standardized metadata + structure. + - 1Password PushSecret adds support for tags and configurable destination vault. + - AWS ECR Public authorization token generator support was added. + - Template helper `filterCertChain` was added; default controller QPS/Burst + increased to 50/100; various provider robustness fixes (GitLab/Vault/GCP labels). + breaking_changes: + - 'AWS provider permission change: additional permission required for the BulkFetch/batch + endpoint when fetching multiple secrets.' + - 'Generator JSON tag typo fixed: `ecrRAuthorizationTokenSpec` corrected (manifests + using the old field/tag may break).' + - GCP Secrets Manager PushSecret metadata format was standardized; existing + PushSecret manifests may stop working until updated to the new structure. chart_version: 0.12.1 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.12.1'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.12.1 - version: 0.11.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [New reconciliation approach reduces Kubernetes API calls; introduces - managed-secrets caching as the new default and supports partial/managed - secret caching behavior changes., ClusterGenerators and generator caching - added (cluster-wide generators)., 'Azure Key Vault: can push expiration - date to secrets.', 'BeyondTrust provider: API key authentication support.', - 'Delinea Secret Server: support multiple Items fields.'] - breaking_changes: ['OLM: 0.11.0 is the last release available for OLM until - further notice; OLM users may need to pin image.tag going forward.', 'Secret - key cleanup behavior changed: keys previously created by ExternalSecret - but no longer present in template/data/dataFrom will now be removed from - target Secrets (even with CreationPolicy=Merge).', 'With CreationPolicy=Owner, - operator now fully recalculates desired Secret state each loop and will - not retain extra keys, potentially removing previously retained keys on - upgrade.', CRDs now include stricter validation (kubebuilder markers) which - can reject previously-accepted but incomplete/invalid manifests., Memory - usage may increase if not using --enable-secrets-caching; caching flag defaults/behavior - changed (managed secrets caching default).] - chart_version: 0.11.0 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.11.0'] - - version: 0.10.7 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Docs/helm: release v0.10.6 helm chart docs update (no functional - change indicated).'] - features: ["Adds YAML-based encoding option for \u201Cget secrets as map\u201D\ - \ functionality.", Fixes Azure Key Vault provider URL suffix to resolve - OpenID discovery issues (improves Azure auth reliability).] + chart_updates: [] + features: + - New reconciliation approach reduces Kubernetes API calls; introduces managed-secrets + caching as the new default and supports partial/managed secret caching behavior + changes. + - ClusterGenerators and generator caching added (cluster-wide generators). + - 'Azure Key Vault: can push expiration date to secrets.' + - 'BeyondTrust provider: API key authentication support.' + - 'Delinea Secret Server: support multiple Items fields.' + breaking_changes: + - 'OLM: 0.11.0 is the last release available for OLM until further notice; OLM + users may need to pin image.tag going forward.' + - 'Secret key cleanup behavior changed: keys previously created by ExternalSecret + but no longer present in template/data/dataFrom will now be removed from target + Secrets (even with CreationPolicy=Merge).' + - With CreationPolicy=Owner, operator now fully recalculates desired Secret + state each loop and will not retain extra keys, potentially removing previously + retained keys on upgrade. + - CRDs now include stricter validation (kubebuilder markers) which can reject + previously-accepted but incomplete/invalid manifests. + - Memory usage may increase if not using --enable-secrets-caching; caching flag + defaults/behavior changed (managed secrets caching default). + chart_version: 0.11.0 + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.11.0 + - version: 0.10.7 + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Docs/helm: release v0.10.6 helm chart docs update (no functional change indicated).' + features: + - "Adds YAML-based encoding option for \u201Cget secrets as map\u201D functionality." + - Fixes Azure Key Vault provider URL suffix to resolve OpenID discovery issues + (improves Azure auth reliability). breaking_changes: [] chart_version: 0.10.7 - images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.10.7'] + images: + - oci.external-secrets.io/external-secrets/external-secrets:v0.10.7 - version: 0.9.20 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', - '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['New provider integrations: Infisical, Device42, and Bitwarden Secret - Manager.', 'GCP PushSecret: support specifying a location/region for pushed - secrets.', 'AWS SSM Parameter Store: support setting parameter Type, and - reduce API calls (fetch once).', 'ClusterSecretStore: namespaceConditions - now support glob patterns for namespace matching.', 'PushSecret: add logic - to skip unmanaged stores; support pushing whole Kubernetes Secrets to Google - Cloud Secret Manager and Azure Key Vault.', 'Kubernetes provider: add AuthRef - support for improved auth configuration.', 'Logging: add log.level and log.encoding - options across components.', 'cert-controller performance/scaling: allow - restricting CRDs/webhooks in informer cache; enable partial cache when installCRDs=true.'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'New provider integrations: Infisical, Device42, and Bitwarden Secret Manager.' + - 'GCP PushSecret: support specifying a location/region for pushed secrets.' + - 'AWS SSM Parameter Store: support setting parameter Type, and reduce API calls + (fetch once).' + - 'ClusterSecretStore: namespaceConditions now support glob patterns for namespace + matching.' + - 'PushSecret: add logic to skip unmanaged stores; support pushing whole Kubernetes + Secrets to Google Cloud Secret Manager and Azure Key Vault.' + - 'Kubernetes provider: add AuthRef support for improved auth configuration.' + - 'Logging: add log.level and log.encoding options across components.' + - 'cert-controller performance/scaling: allow restricting CRDs/webhooks in informer + cache; enable partial cache when installCRDs=true.' breaking_changes: [] chart_version: 0.9.20 - images: ['ghcr.io/external-secrets/external-secrets:v0.9.20'] + images: + - ghcr.io/external-secrets/external-secrets:v0.9.20 - version: 0.8.7 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['From the provided notes, v0.7.2 introduced new capabilities like - referent auth for AWS/GCP/Azure, AWS role chaining, KeyVault PushSecret - support, and HashiCorp Vault deletion policy handling.', The provided v0.8.7 - entry includes image tags and release assets only; no feature list was included - in the notes you supplied.] - breaking_changes: ['No breaking changes are mentioned in the provided release - notes for either v0.7.2 or v0.8.7; however, this does not guarantee there - were none across intermediate 0.8.x releases.'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - From the provided notes, v0.7.2 introduced new capabilities like referent + auth for AWS/GCP/Azure, AWS role chaining, KeyVault PushSecret support, and + HashiCorp Vault deletion policy handling. + - The provided v0.8.7 entry includes image tags and release assets only; no + feature list was included in the notes you supplied. + breaking_changes: + - No breaking changes are mentioned in the provided release notes for either + v0.7.2 or v0.8.7; however, this does not guarantee there were none across + intermediate 0.8.x releases. chart_version: 0.8.7 - images: ['ghcr.io/external-secrets/external-secrets:v0.8.7'] + images: + - ghcr.io/external-secrets/external-secrets:v0.8.7 - version: 0.7.2 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['HashiCorp Vault: deletion policy support.', 'AWS: role chaining - support.', 'Referent auth support for GCP and AWS (Secrets Manager/Parameter - Store), plus Azure referent auth.', 'Azure Key Vault: PushSecret support.'] + features: + - 'HashiCorp Vault: deletion policy support.' + - 'AWS: role chaining support.' + - Referent auth support for GCP and AWS (Secrets Manager/Parameter Store), plus + Azure referent auth. + - 'Azure Key Vault: PushSecret support.' breaking_changes: [] chart_version: 0.7.2 - images: ['ghcr.io/external-secrets/external-secrets:v0.7.2'] + images: + - ghcr.io/external-secrets/external-secrets:v0.7.2 - version: 0.6.1 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator image tags were corrected; the default/main image - is now built and published with a proper `-ubi` variant, and the release - publishes SBOM/provenance assets.', "Controller-runtime dependency was bumped\ - \ (0.12.3 \u2192 0.13.0), which can impact Kubernetes compatibility and\ - \ controller behavior indirectly.", 'Several fixes landed around deletion - behavior and path building logic, which may affect reconciliation outcomes - in edge cases.'] - features: ['ClusterSecretStore gained a namespace condition, enabling scoping/selection - logic based on namespaces.', An Oracle validator was implemented (improves - provider/validation behavior for Oracle-related integrations)., Releases - now attach SBOM and provenance files (supply-chain metadata) to GitHub releases.] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator image tags were corrected; the default/main image is now built and + published with a proper `-ubi` variant, and the release publishes SBOM/provenance + assets. + - "Controller-runtime dependency was bumped (0.12.3 \u2192 0.13.0), which can\ + \ impact Kubernetes compatibility and controller behavior indirectly." + - Several fixes landed around deletion behavior and path building logic, which + may affect reconciliation outcomes in edge cases. + features: + - ClusterSecretStore gained a namespace condition, enabling scoping/selection + logic based on namespaces. + - An Oracle validator was implemented (improves provider/validation behavior + for Oracle-related integrations). + - Releases now attach SBOM and provenance files (supply-chain metadata) to GitHub + releases. breaking_changes: [] chart_version: 0.6.1 - images: ['ghcr.io/external-secrets/external-secrets:v0.6.1'] + images: + - ghcr.io/external-secrets/external-secrets:v0.6.1 - version: 0.5.9 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -17629,46 +21552,75 @@ addons: > No other explicit Helm values changes were included in the provided notes; review your current values for ServiceAccount/metrics/DNS settings and decide if you want to adopt the new knobs.' - chart_updates: [Adds Helm templating/values for extra ServiceAccount labels., - Adds Helm chart support for DNS options., Adds Helm flags to create additional - metrics Services for other scrapers., Adds kustomization file under `config/crds/bases` - (useful for non-Helm install/CRD management workflows).] - features: ['AWS provider: retry/throttling handling improved via a retryer implementation - (better behavior under AWS API rate limits).', 'New kubectl-friendly output: - additional columns for relevant CRDs to improve `kubectl get` visibility.', - Configurable cache and throttling options (helps performance and stability - under load)., Implements `dataFrom` key rewrite (new/updated behavior for - rewriting keys when importing multiple secrets)., 'IBM provider: adds support - for container auth.', 1Password integration improvements (plus docs updates).] - breaking_changes: ["No explicit breaking changes are called out in the provided\ - \ notes. The biggest behavior change risk is the `dataFrom` key rewrite\ - \ implementation\u2014verify your ExternalSecret/ClusterSecretStore usage\ - \ and rendered Secret keys in a non-prod environment before rolling out."] + chart_updates: + - Adds Helm templating/values for extra ServiceAccount labels. + - Adds Helm chart support for DNS options. + - Adds Helm flags to create additional metrics Services for other scrapers. + - Adds kustomization file under `config/crds/bases` (useful for non-Helm install/CRD + management workflows). + features: + - 'AWS provider: retry/throttling handling improved via a retryer implementation + (better behavior under AWS API rate limits).' + - 'New kubectl-friendly output: additional columns for relevant CRDs to improve + `kubectl get` visibility.' + - Configurable cache and throttling options (helps performance and stability + under load). + - Implements `dataFrom` key rewrite (new/updated behavior for rewriting keys + when importing multiple secrets). + - 'IBM provider: adds support for container auth.' + - 1Password integration improvements (plus docs updates). + breaking_changes: + - "No explicit breaking changes are called out in the provided notes. The biggest\ + \ behavior change risk is the `dataFrom` key rewrite implementation\u2014\ + verify your ExternalSecret/ClusterSecretStore usage and rendered Secret keys\ + \ in a non-prod environment before rolling out." chart_version: 0.5.9 - images: ['ghcr.io/external-secrets/external-secrets:v0.5.9'] + images: + - ghcr.io/external-secrets/external-secrets:v0.5.9 - version: 0.4.4 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['v0.3.11: Added ability to provide a custom CA for the Yandex Lockbox - provider.', 'v0.3.11: Updated the project to Go 1.17 and included various - minor fixes.', 'v0.4.4: Patch release focused on security updates plus minor - documentation improvements (AWS custom endpoints, template snippet fix).', - 'v0.4.4: Dependency bumps including controller-runtime 0.11.1 and updates - to Google Secret Manager/IAM and other libraries.'] + features: + - 'v0.3.11: Added ability to provide a custom CA for the Yandex Lockbox provider.' + - 'v0.3.11: Updated the project to Go 1.17 and included various minor fixes.' + - 'v0.4.4: Patch release focused on security updates plus minor documentation + improvements (AWS custom endpoints, template snippet fix).' + - 'v0.4.4: Dependency bumps including controller-runtime 0.11.1 and updates + to Google Secret Manager/IAM and other libraries.' breaking_changes: [] chart_version: 0.4.4 - images: ['ghcr.io/external-secrets/external-secrets:v0.4.4'] + images: + - ghcr.io/external-secrets/external-secrets:v0.4.4 - version: 0.3.11 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null chart_version: 0.3.11 - images: ['ghcr.io/external-secrets/external-secrets:v0.3.11'] + images: + - ghcr.io/external-secrets/external-secrets:v0.3.11 name: external-secrets - icon: https://avatars.githubusercontent.com/u/52158677?s=200&v=4 git_url: https://github.com/fluxcd/flux2 @@ -17678,28 +21630,53 @@ addons: eolApiSlug: flux versions: - version: 2.9.0 - kube: ['1.36', '1.35', '1.34', '1.33'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null - version: 2.8.0 - kube: ['1.36', '1.35', '1.34', '1.33'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null - version: 2.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null - version: 2.6.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null eolAt: '2026-06-30' - version: 2.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null @@ -17711,58 +21688,82 @@ addons: helm_repository_url: https://kubernetes.github.io/ingress-nginx versions: - version: 1.15.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Controller image updates only: controller v1.15.1 (new digests) - and related build pipeline bumps.', 'Template change: remove path from a - generated comment (cosmetic; no behavior change expected).', 'CI/tooling - refresh: Kubernetes test version to v1.35.3, Helm to v4.1.3, Test Runner - to v2.2.9, plus Go dependency updates and rebuilt side images.'] + chart_updates: + - 'Controller image updates only: controller v1.15.1 (new digests) and related + build pipeline bumps.' + - 'Template change: remove path from a generated comment (cosmetic; no behavior + change expected).' + - 'CI/tooling refresh: Kubernetes test version to v1.35.3, Helm to v4.1.3, Test + Runner to v2.2.9, plus Go dependency updates and rebuilt side images.' features: [] breaking_changes: [] chart_version: 4.15.1 - images: ['registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd - version: 1.15.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Template hardening/quoting improvements: quote all `location`/`server_name` - directives (and escape quotes/backslashes) and quote `proxy_pass` to reduce - config-generation edge cases.', 'Admission controller tweaks: remove an - obsolete error log; set admission controller request size/limit to 9MB.', - 'Controller behavior fixes: host/path overlap detection for multiple rules; - sync resiliency when node clock jumps to the future; avoid panic when `cpu.max` - is empty.', 'SSL/TLS passthrough & PROXY protocol: enable SSL passthrough - earlier when requested for HTTP-only hosts; use 4KiB buffers for PROXY protocol - parsing in TLS passthrough.', 'Annotations validation: tighter regex for - `proxy-cookie-domain`; add anchors to auth method regex; consider aliases - in risk evaluation.', "Images/toolchain bumps: NGINX image to v2.2.5\u2013\ - v2.2.8 across the series; Alpine base to v3.23.x; Go runtime to v1.26.1\ - \ (and incremental 1.25.x bumps).", 'Docs/Project status: documentation - updated to highlight retirement; PROXY protocol limitation on GKE default - load balancer clarified.'] - features: ['Improved safety and correctness of generated NGINX config via broader - quoting/escaping in templates, reducing potential misparsing with special - characters.', More robust SSL passthrough/PROXY protocol handling in TLS - passthrough mode (buffer sizing and enabling behavior)., 'Better annotation - validation/interpretation (cookie domain regex, auth method anchors, alias-aware - risk evaluation).'] - breaking_changes: ['Project retirement notices were added; while not a code-breaking - change, it impacts long-term support planning and should be treated as an - upgrade consideration.', 'Template quoting/escaping changes can alter the - rendered NGINX configuration; if you rely on unusual `server_name`, `location`, - or upstream formats, validate rendered config and behavior in staging.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Template hardening/quoting improvements: quote all `location`/`server_name` + directives (and escape quotes/backslashes) and quote `proxy_pass` to reduce + config-generation edge cases.' + - 'Admission controller tweaks: remove an obsolete error log; set admission + controller request size/limit to 9MB.' + - 'Controller behavior fixes: host/path overlap detection for multiple rules; + sync resiliency when node clock jumps to the future; avoid panic when `cpu.max` + is empty.' + - 'SSL/TLS passthrough & PROXY protocol: enable SSL passthrough earlier when + requested for HTTP-only hosts; use 4KiB buffers for PROXY protocol parsing + in TLS passthrough.' + - 'Annotations validation: tighter regex for `proxy-cookie-domain`; add anchors + to auth method regex; consider aliases in risk evaluation.' + - "Images/toolchain bumps: NGINX image to v2.2.5\u2013v2.2.8 across the series;\ + \ Alpine base to v3.23.x; Go runtime to v1.26.1 (and incremental 1.25.x bumps)." + - 'Docs/Project status: documentation updated to highlight retirement; PROXY + protocol limitation on GKE default load balancer clarified.' + features: + - Improved safety and correctness of generated NGINX config via broader quoting/escaping + in templates, reducing potential misparsing with special characters. + - More robust SSL passthrough/PROXY protocol handling in TLS passthrough mode + (buffer sizing and enabling behavior). + - Better annotation validation/interpretation (cookie domain regex, auth method + anchors, alias-aware risk evaluation). + breaking_changes: + - Project retirement notices were added; while not a code-breaking change, it + impacts long-term support planning and should be treated as an upgrade consideration. + - Template quoting/escaping changes can alter the rendered NGINX configuration; + if you rely on unusual `server_name`, `location`, or upstream formats, validate + rendered config and behavior in staging. chart_version: 4.15.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.15.0@sha256:4eea9a4cc2cb6ddcb7da14d377aaf452e68bd3dbe87fe280755d225c4d5e7e4e', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.8@sha256:d7e8257f8d8bce64b6df55f81fba92011a6a77269b3350f8b997b152af348dba'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.15.0@sha256:4eea9a4cc2cb6ddcb7da14d377aaf452e68bd3dbe87fe280755d225c4d5e7e4e + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.8@sha256:d7e8257f8d8bce64b6df55f81fba92011a6a77269b3350f8b997b152af348dba - version: 1.14.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -17802,33 +21803,45 @@ addons: \ changelog for the chart version you\u2019ll actually upgrade to (e.g., v4.13.x\ \ \u2192 v4.14.x). Before executing the upgrade, also review the **chart release\ \ notes** for the exact chart versions in use." - chart_updates: ['Controller image updated to v1.14.0 (and chroot variant), including - NGINX base bumps to v2.2.x and Alpine base bumps (3.22.x).', 'Status handling - improved: supports multiple Node IP addresses when publishing ingress status.', - 'Admission/webhook and chart plumbing updated: extra init containers are templatable; - webhook patch job gains volumes; new ServiceMonitor scrapeTimeout knob; - resize policy support; chart distribution via OCI.', 'Security and robustness - improvements: panic handling in service deletion handler; hardened socket - creation; path validation nil-pointer fix; stronger cipher preference ordering.'] - features: ['SSL Proxy now supports **PROXY protocol v2**, enabling richer client - connection metadata when running behind compatible load balancers/proxies.', - 'Ingress status reporting can now handle **multiple node IPs**, improving - correctness on multi-NIC / multi-address nodes.', 'Ingress path validation - now allows a `.` character in `Exact` and `Prefix` paths, expanding valid - routing patterns.', Chart adds optional `ServiceMonitor` `scrapeTimeout` - configuration for Prometheus Operator users.] - breaking_changes: ['Removal of a default value: `proxy-busy-buffers-size` default - was removed (and related fixes followed). If you relied on the old implicit - default, set it explicitly in the ConfigMap/values to preserve behavior.', - "\u201CBye bye, v1.11.\u201D indicates end-of-support for older Kubernetes/legacy\ - \ compatibility paths (exact minimum supported Kubernetes not stated in\ - \ your paste). Validate your cluster version meets the supported matrix\ - \ for controller v1.14.0 before upgrading."] + chart_updates: + - Controller image updated to v1.14.0 (and chroot variant), including NGINX + base bumps to v2.2.x and Alpine base bumps (3.22.x). + - 'Status handling improved: supports multiple Node IP addresses when publishing + ingress status.' + - 'Admission/webhook and chart plumbing updated: extra init containers are templatable; + webhook patch job gains volumes; new ServiceMonitor scrapeTimeout knob; resize + policy support; chart distribution via OCI.' + - 'Security and robustness improvements: panic handling in service deletion + handler; hardened socket creation; path validation nil-pointer fix; stronger + cipher preference ordering.' + features: + - SSL Proxy now supports **PROXY protocol v2**, enabling richer client connection + metadata when running behind compatible load balancers/proxies. + - Ingress status reporting can now handle **multiple node IPs**, improving correctness + on multi-NIC / multi-address nodes. + - Ingress path validation now allows a `.` character in `Exact` and `Prefix` + paths, expanding valid routing patterns. + - Chart adds optional `ServiceMonitor` `scrapeTimeout` configuration for Prometheus + Operator users. + breaking_changes: + - 'Removal of a default value: `proxy-busy-buffers-size` default was removed + (and related fixes followed). If you relied on the old implicit default, set + it explicitly in the ConfigMap/values to preserve behavior.' + - "\u201CBye bye, v1.11.\u201D indicates end-of-support for older Kubernetes/legacy\ + \ compatibility paths (exact minimum supported Kubernetes not stated in your\ + \ paste). Validate your cluster version meets the supported matrix for controller\ + \ v1.14.0 before upgrading." chart_version: 4.14.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:e4127065d0317bd11dc64c4dd38dcf7fb1c3d72e468110b4086e636dbaac943d', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4@sha256:bcfc926ed57831edf102d62c5c0e259572591df4796ef1420b87f9cf6092497f'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:e4127065d0317bd11dc64c4dd38dcf7fb1c3d72e468110b4086e636dbaac943d + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4@sha256:bcfc926ed57831edf102d62c5c0e259572591df4796ef1420b87f9cf6092497f - version: 1.13.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -17868,43 +21881,56 @@ addons: \ values after the ServiceMonitor rework.\n- If you used PSP, remove PSP-related\ \ values/resources and ensure PSA policies allow the controller to run.\n\ - If you used OTel via init container/image, migrate to built-in module configuration.\n" - chart_updates: [Controller image updated from v1.12.0 to v1.13.0 (new controller - and chroot images)., NGINX/OpenResty base updated (OpenResty bumped to v1.27.1.x; - NGINX base and related images bumped through 2.x series)., 'Chart additions: - `controller.service.trafficDistribution`, service labels for external/internal - services, `runtimeClassName`, `activeDeadlineSeconds`, and cert-manager - admission webhook revisionHistoryLimit settings.', 'Chart maintenance: removed - validation for an already-removed API; multiple bumps of kube-webhook-certgen - and test runner images.', Ongoing security and dependency updates (Go toolchain - bumped to 1.24.x in v1.13.0 line; controller includes several security fixes - in 1.12.x).] - features: [Traffic distribution support added to the controller (and exposed - via chart value `controller.service.trafficDistribution`)., NGINX now adds - an `X-Original-Forwarded-Host` header to preserve the original forwarded - host., Improved client IP determination in NGINX for more accurate real - client address handling., NJS (NGINX JavaScript) support added to the NGINX - build used by ingress-nginx., 'Annotations/security hardening: deny newlines - in annotations; reload on custom header changes (improves correctness when - headers are updated).'] - breaking_changes: ['Metrics are disabled by default (`--enable-metrics` now - defaults to false). If you scrape controller metrics, you must explicitly - re-enable them via Helm values/args.', 'Security defaults were tightened - in the 1.12 line: annotation validation enabled by default, cross-namespace - resources disallowed by default, stricter path type validation enabled. - This can break previously-working but unsafe configurations.', Global rate - limit feature was removed (config keys and related annotations no longer - exist). Any Ingress using those annotations will stop working as intended., - 'Third-party Lua plugin support was removed (`plugins` config and `/etc/nginx/lua/plugins` - loading). If you relied on custom Lua plugins, they will no longer be executed.', - PodSecurityPolicy resources were removed from the Helm chart; clusters depending - on PSP must migrate to PSA/other policy mechanisms., OpenTelemetry init - container/image was removed from the deployment packaging; OTel must be - configured using the built-in module approach.] + chart_updates: + - Controller image updated from v1.12.0 to v1.13.0 (new controller and chroot + images). + - NGINX/OpenResty base updated (OpenResty bumped to v1.27.1.x; NGINX base and + related images bumped through 2.x series). + - 'Chart additions: `controller.service.trafficDistribution`, service labels + for external/internal services, `runtimeClassName`, `activeDeadlineSeconds`, + and cert-manager admission webhook revisionHistoryLimit settings.' + - 'Chart maintenance: removed validation for an already-removed API; multiple + bumps of kube-webhook-certgen and test runner images.' + - Ongoing security and dependency updates (Go toolchain bumped to 1.24.x in + v1.13.0 line; controller includes several security fixes in 1.12.x). + features: + - Traffic distribution support added to the controller (and exposed via chart + value `controller.service.trafficDistribution`). + - NGINX now adds an `X-Original-Forwarded-Host` header to preserve the original + forwarded host. + - Improved client IP determination in NGINX for more accurate real client address + handling. + - NJS (NGINX JavaScript) support added to the NGINX build used by ingress-nginx. + - 'Annotations/security hardening: deny newlines in annotations; reload on custom + header changes (improves correctness when headers are updated).' + breaking_changes: + - Metrics are disabled by default (`--enable-metrics` now defaults to false). + If you scrape controller metrics, you must explicitly re-enable them via Helm + values/args. + - 'Security defaults were tightened in the 1.12 line: annotation validation + enabled by default, cross-namespace resources disallowed by default, stricter + path type validation enabled. This can break previously-working but unsafe + configurations.' + - Global rate limit feature was removed (config keys and related annotations + no longer exist). Any Ingress using those annotations will stop working as + intended. + - Third-party Lua plugin support was removed (`plugins` config and `/etc/nginx/lua/plugins` + loading). If you relied on custom Lua plugins, they will no longer be executed. + - PodSecurityPolicy resources were removed from the Helm chart; clusters depending + on PSP must migrate to PSA/other policy mechanisms. + - OpenTelemetry init container/image was removed from the deployment packaging; + OTel must be configured using the built-in module approach. chart_version: 4.13.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.13.0@sha256:dc75a7baec7a3b827a5d7ab0acd10ab507904c7dad692365b3e3b596eca1afd2', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0@sha256:c9f76a75fd00e975416ea1b73300efd413116de0de8570346ed90766c5b5cefb'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.13.0@sha256:dc75a7baec7a3b827a5d7ab0acd10ab507904c7dad692365b3e3b596eca1afd2 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0@sha256:c9f76a75fd00e975416ea1b73300efd413116de0de8570346ed90766c5b5cefb - version: 1.12.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -17941,37 +21967,52 @@ addons: \ behavior.\n\n### 8) Chart cleanup\n- Chart: Remove `isControllerTagValid`\ \ (internal chart validation).\n\n**Action:** if you had automation relying\ \ on that value, remove it from your values file.\n" - chart_updates: [Metrics now disabled by default (controller flag default change)., - Controller image updated to v1.12.0; underlying base images bumped (notably - Alpine 3.21) and Go toolchain updates., 'Chart includes several operational - enhancements: ServiceMonitor rework, more unit tests, topology spread guidance, - PDB alignment, and rollout deadline option.', 'Security posture changes - ship with 1.12.0 (annotation validation on by default, stricter defaults).'] - features: [Native histogram support for histogram metrics (improves Prometheus - histogram handling when enabled)., New `--metrics-per-undefined-host` option - to control metrics cardinality for undefined hosts., CORS origins now allow - any protocol (more flexible CORS configuration)., 'New docs/guides added - (e.g., maintenance page, Pod Security Admission, AWS health check annotations).'] - breaking_changes: [Metrics are disabled by default (`--enable-metrics` now defaults - to false); you must explicitly enable if you scrape metrics., "Security\ - \ defaults tightened: annotation validation enabled by default; `allow-cross-namespace-resources`\ - \ disabled by default; `strict-validate-path-type` enabled by default; default\ - \ `annotations-risk-level` lowered to High\u2014this can cause previously-accepted\ - \ Ingresses/annotations to be rejected.", Global rate limit feature removed - (config keys and related annotations removed); remove any usage before upgrading., - 3rd-party Lua plugin support removed (the `plugins` config option and `/etc/nginx/lua/plugins` - user plugin mechanism no longer works)., PodSecurityPolicy resources removed - from the Helm chart; clusters depending on PSP must migrate to PSA/other - controls., s390x image support dropped; cannot run controller on s390x nodes., - Metric `ingress_upstream_latency_seconds` removed; dashboards/alerts must - be updated if they reference it., 'OpenTelemetry init container/image removed - from the chart; if you relied on it, update your values and validate OTel - configuration.'] + chart_updates: + - Metrics now disabled by default (controller flag default change). + - Controller image updated to v1.12.0; underlying base images bumped (notably + Alpine 3.21) and Go toolchain updates. + - 'Chart includes several operational enhancements: ServiceMonitor rework, more + unit tests, topology spread guidance, PDB alignment, and rollout deadline + option.' + - Security posture changes ship with 1.12.0 (annotation validation on by default, + stricter defaults). + features: + - Native histogram support for histogram metrics (improves Prometheus histogram + handling when enabled). + - New `--metrics-per-undefined-host` option to control metrics cardinality for + undefined hosts. + - CORS origins now allow any protocol (more flexible CORS configuration). + - New docs/guides added (e.g., maintenance page, Pod Security Admission, AWS + health check annotations). + breaking_changes: + - Metrics are disabled by default (`--enable-metrics` now defaults to false); + you must explicitly enable if you scrape metrics. + - "Security defaults tightened: annotation validation enabled by default; `allow-cross-namespace-resources`\ + \ disabled by default; `strict-validate-path-type` enabled by default; default\ + \ `annotations-risk-level` lowered to High\u2014this can cause previously-accepted\ + \ Ingresses/annotations to be rejected." + - Global rate limit feature removed (config keys and related annotations removed); + remove any usage before upgrading. + - 3rd-party Lua plugin support removed (the `plugins` config option and `/etc/nginx/lua/plugins` + user plugin mechanism no longer works). + - PodSecurityPolicy resources removed from the Helm chart; clusters depending + on PSP must migrate to PSA/other controls. + - s390x image support dropped; cannot run controller on s390x nodes. + - Metric `ingress_upstream_latency_seconds` removed; dashboards/alerts must + be updated if they reference it. + - OpenTelemetry init container/image removed from the chart; if you relied on + it, update your values and validate OTel configuration. chart_version: 4.12.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 - version: 1.11.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -17995,31 +22036,47 @@ addons: \ and scaling objects after upgrade.\n- **Default backend:** topologySpreadConstraints\ \ support and related unit tests. If you run the default backend, confirm\ \ scheduling behavior matches expectations." - chart_updates: ['Chart: Remove `controller.enableWorkerSerialReloads`.', 'Chart: - Make `controller.config` templatable.', 'Chart: Make pod affinity templatable.', - 'Chart: Fix `IngressClass` annotations.', 'Chart: Make admission webhook patch - job RBAC configurable.', 'Chart: Accept user-defined annotations in IngressClass; - add IngressClass aliases.', 'Chart: Render `controller.ingressClassResource.parameters` - natively.', 'Chart: Align HPA & KEDA conditions; deploy PDB with KEDA.', - 'Default backend: add topologySpreadConstraints support and sort HPA metrics.'] - features: [NGINX bumped to 1.25.5 and HTTP/3 module added (new capability; requires - QUIC/UDP 443 exposure and client support)., 'New annotations for gRPC timeouts, - plus ConfigMap support for gRPC buffer size.', New annotation allowing custom - response headers to be added., GeoIP2 auto_reload configuration support., - 'Leader election improvements: TTL configurable and option/flag to disable - leader election.'] - breaking_changes: ['Do **not** use controller v1.11.0 with **OCSP stapling enabled** - due to a known serious issue; use a patched 1.11.x release containing the - fix (referenced PR #11594) instead.', Chart value `controller.enableWorkerSerialReloads` - was removed; upgrades will fail lint/templating if your values still reference - it., 'TLS hardening change: TLSv1 and TLSv1.1 were removed; clients requiring - those protocols will no longer connect.', Minimum Kubernetes version requirement - is stated as 1.21; clusters older than that are unsupported.] + chart_updates: + - 'Chart: Remove `controller.enableWorkerSerialReloads`.' + - 'Chart: Make `controller.config` templatable.' + - 'Chart: Make pod affinity templatable.' + - 'Chart: Fix `IngressClass` annotations.' + - 'Chart: Make admission webhook patch job RBAC configurable.' + - 'Chart: Accept user-defined annotations in IngressClass; add IngressClass + aliases.' + - 'Chart: Render `controller.ingressClassResource.parameters` natively.' + - 'Chart: Align HPA & KEDA conditions; deploy PDB with KEDA.' + - 'Default backend: add topologySpreadConstraints support and sort HPA metrics.' + features: + - NGINX bumped to 1.25.5 and HTTP/3 module added (new capability; requires QUIC/UDP + 443 exposure and client support). + - New annotations for gRPC timeouts, plus ConfigMap support for gRPC buffer + size. + - New annotation allowing custom response headers to be added. + - GeoIP2 auto_reload configuration support. + - 'Leader election improvements: TTL configurable and option/flag to disable + leader election.' + breaking_changes: + - 'Do **not** use controller v1.11.0 with **OCSP stapling enabled** due to a + known serious issue; use a patched 1.11.x release containing the fix (referenced + PR #11594) instead.' + - Chart value `controller.enableWorkerSerialReloads` was removed; upgrades will + fail lint/templating if your values still reference it. + - 'TLS hardening change: TLSv1 and TLSv1.1 were removed; clients requiring those + protocols will no longer connect.' + - Minimum Kubernetes version requirement is stated as 1.21; clusters older than + that are unsupported. chart_version: 4.11.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.11.0@sha256:a886e56d532d1388c77c8340261149d974370edca1093af4c97a96fb1467cb39', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.11.0@sha256:a886e56d532d1388c77c8340261149d974370edca1093af4c97a96fb1467cb39 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366 - version: 1.10.1 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -18036,85 +22093,117 @@ addons: \ confirm this doesn\u2019t conflict with any existing PDBs you manage.\n\ - No explicit required values changes were called out for 1.10.1 specifically;\ \ most 1.10.1 chart items are tests/docs/CI." - chart_updates: ['Chart: Render `controller.ingressClassResource.parameters` - natively.', 'Chart: Align HPA & KEDA conditions.', 'Chart: Deploy `PodDisruptionBudget` - with KEDA enabled.', 'Chart: Improve IngressClass documentation.', 'Chart: - Add unit tests for default backend & topology spread constraints; sort default - backend HPA metrics (no functional change expected).'] - features: ['Reintroduced/available **chroot controller image** in v1.10.1 (`controller-chroot:v1.10.1`), - addressing the 1.10.0 note that chroot was not supported.', Improved admission - controller logging to include `admissionTime` and `testedConfigurationSize` - for better troubleshooting.] - breaking_changes: ['From **v1.10.0** (still relevant when upgrading to 1.10.1): - chroot image was not supported in 1.10.0 (fixed in 1.10.1).', 'From **v1.10.0**: - Opentracing and Zipkin modules were removed; only OpenTelemetry is supported.', - 'From **v1.10.0**: PodSecurityPolicy support was dropped.', 'From **v1.10.0**: - Legacy GeoIP was dropped; only GeoIP2 is supported.'] + chart_updates: + - 'Chart: Render `controller.ingressClassResource.parameters` natively.' + - 'Chart: Align HPA & KEDA conditions.' + - 'Chart: Deploy `PodDisruptionBudget` with KEDA enabled.' + - 'Chart: Improve IngressClass documentation.' + - 'Chart: Add unit tests for default backend & topology spread constraints; + sort default backend HPA metrics (no functional change expected).' + features: + - Reintroduced/available **chroot controller image** in v1.10.1 (`controller-chroot:v1.10.1`), + addressing the 1.10.0 note that chroot was not supported. + - Improved admission controller logging to include `admissionTime` and `testedConfigurationSize` + for better troubleshooting. + breaking_changes: + - 'From **v1.10.0** (still relevant when upgrading to 1.10.1): chroot image + was not supported in 1.10.0 (fixed in 1.10.1).' + - 'From **v1.10.0**: Opentracing and Zipkin modules were removed; only OpenTelemetry + is supported.' + - 'From **v1.10.0**: PodSecurityPolicy support was dropped.' + - 'From **v1.10.0**: Legacy GeoIP was dropped; only GeoIP2 is supported.' chart_version: 4.10.1 - images: ['registry.k8s.io/ingress-nginx/controller:v1.10.1@sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.10.1@sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366 - version: 1.10.0 - kube: ['1.29', '1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['**Chart behavior change (metrics flag):** The Helm chart now - sets the controller argument `--enable-metrics` based on `controller.metrics.enabled` - (instead of always/never or requiring manual extraArgs). This came in via - PR #10959.', '**kube-webhook image tag fix:** Chart/release fixes the `kube-webhook-certgen` - image tag handling (PR #11033/#11034).', '**PrometheusRule manifest updated:** - `controller-prometheusrules.yaml` updated (PR #8902), which can change the - resulting PrometheusRule resources if you enable them.'] - features: ['**NGINX upgraded to 1.25:** Controller now ships with NGINX 1.25, - bringing the upstream NGINX changes/perf/security updates with it.', '**OCSP - responder improvements:** Proper support for a TLS-wrapped OCSP responder, - improving TLS/OCSP stapling edge cases.', '**Annotation completeness:** - Adds a missing `backend-protocol` annotation option, improving compatibility - with certain backend protocols/configs.', '**Dashboard/monitoring fixes:** - Grafana dashboard datasource/exported namespace variable fixes and updated - Prometheus rules improve observability out of the box.'] - breaking_changes: ['**No chroot image in 1.10.0:** The `controller-chroot` image - is not supported in this release (promised to return in a later minor patch).', - '**Tracing modules removed:** OpenTracing and Zipkin NGINX modules were dropped; - only OpenTelemetry is supported moving forward.', '**PodSecurityPolicy removed:** - PSP support is dropped; clusters relying on PSP manifests/values must migrate - to alternatives (e.g., PSA + RBAC).', '**Legacy GeoIP removed:** GeoIP (legacy) - support is dropped; only GeoIP2 is supported.'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '**Chart behavior change (metrics flag):** The Helm chart now sets the controller + argument `--enable-metrics` based on `controller.metrics.enabled` (instead + of always/never or requiring manual extraArgs). This came in via PR #10959.' + - '**kube-webhook image tag fix:** Chart/release fixes the `kube-webhook-certgen` + image tag handling (PR #11033/#11034).' + - '**PrometheusRule manifest updated:** `controller-prometheusrules.yaml` updated + (PR #8902), which can change the resulting PrometheusRule resources if you + enable them.' + features: + - '**NGINX upgraded to 1.25:** Controller now ships with NGINX 1.25, bringing + the upstream NGINX changes/perf/security updates with it.' + - '**OCSP responder improvements:** Proper support for a TLS-wrapped OCSP responder, + improving TLS/OCSP stapling edge cases.' + - '**Annotation completeness:** Adds a missing `backend-protocol` annotation + option, improving compatibility with certain backend protocols/configs.' + - '**Dashboard/monitoring fixes:** Grafana dashboard datasource/exported namespace + variable fixes and updated Prometheus rules improve observability out of the + box.' + breaking_changes: + - '**No chroot image in 1.10.0:** The `controller-chroot` image is not supported + in this release (promised to return in a later minor patch).' + - '**Tracing modules removed:** OpenTracing and Zipkin NGINX modules were dropped; + only OpenTelemetry is supported moving forward.' + - '**PodSecurityPolicy removed:** PSP support is dropped; clusters relying on + PSP manifests/values must migrate to alternatives (e.g., PSA + RBAC).' + - '**Legacy GeoIP removed:** GeoIP (legacy) support is dropped; only GeoIP2 + is supported.' chart_version: 4.10.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.10.0@sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.10.0@sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334 - version: 1.9.6 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Controller image changed from v1.9.0 to v1.9.6 (and corresponding - chroot image digest)., Admission webhook cert generator updated to a newer - release (v20231226-1a7112e06)., 'Annotation validation tightened: regex - validation added for the common-name annotation; SSL cipher list validation - expanded to include SECLEVEL and STRENGTH.', ModSecurity library version - updated to 3.0.11., "Dependency bump: runc 1.1.10 \u2192 1.1.11.", 'From - 1.9.0 baseline: user snippets are disabled by default; controller base image - no longer includes curl; annotation validation framework introduced. These - are the main behavior-impacting changes to be aware of when moving off 1.9.0.'] - features: ['Stricter and more complete validation for annotations (including - regex checks and SSL cipher list fields), reducing risk of invalid config - reaching NGINX.', 'Updated admission webhook cert generation tooling, improving - compatibility and maintenance.', Updated ModSecurity library version (3.0.11) - for security/stability fixes.] - breaking_changes: [User-provided NGINX snippets are disabled by default starting - in 1.9.0; any Ingress relying on snippet annotations will stop working unless - you explicitly re-enable snippets via controller configuration/values., - 'The controller image no longer includes curl (since 1.9.0); any custom scripts, - sidecars, or debug workflows that exec into the controller pod expecting - curl will fail.'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Controller image changed from v1.9.0 to v1.9.6 (and corresponding chroot image + digest). + - Admission webhook cert generator updated to a newer release (v20231226-1a7112e06). + - 'Annotation validation tightened: regex validation added for the common-name + annotation; SSL cipher list validation expanded to include SECLEVEL and STRENGTH.' + - ModSecurity library version updated to 3.0.11. + - "Dependency bump: runc 1.1.10 \u2192 1.1.11." + - 'From 1.9.0 baseline: user snippets are disabled by default; controller base + image no longer includes curl; annotation validation framework introduced. + These are the main behavior-impacting changes to be aware of when moving off + 1.9.0.' + features: + - Stricter and more complete validation for annotations (including regex checks + and SSL cipher list fields), reducing risk of invalid config reaching NGINX. + - Updated admission webhook cert generation tooling, improving compatibility + and maintenance. + - Updated ModSecurity library version (3.0.11) for security/stability fixes. + breaking_changes: + - User-provided NGINX snippets are disabled by default starting in 1.9.0; any + Ingress relying on snippet annotations will stop working unless you explicitly + re-enable snippets via controller configuration/values. + - The controller image no longer includes curl (since 1.9.0); any custom scripts, + sidecars, or debug workflows that exec into the controller pod expecting curl + will fail. chart_version: 4.9.1 - images: ['registry.k8s.io/ingress-nginx/controller:v1.9.6@sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231226-1a7112e06@sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.9.6@sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231226-1a7112e06@sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084 - version: 1.9.0 - kube: ['1.28', '1.27', '1.26', '1.25'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -18130,62 +22219,85 @@ addons: \ for Deployment/DaemonSet; if you set this, validate it renders as expected.\n\ - **KEDA interaction**: If you enable KEDA, the chart will ignore the Deployment\ \ template `replicas` field (replicas controlled by KEDA)." - chart_updates: ['Controller image updated from `registry.k8s.io/ingress-nginx/controller:v1.8.4` - to `v1.9.0` (and chroot variant accordingly).', Base container image changed - to remove `curl` (impacts any custom scripts/exec probes relying on curl - inside the controller container)., AJP support was deprecated/removed in - the 1.9.0 line (do not rely on AJP module)., 'OpenTelemetry libs updated - (OTel 1.11.0, gRPC updates) and Go bumped to 1.21.1 (mostly build/runtime - dependency changes).'] - features: ['User snippets are now **disabled by default**, improving security; - they must be explicitly enabled if you use snippet annotations.', Ingress - annotation validation was implemented; invalid annotations may now be rejected - or warned about instead of being silently accepted., "Optional auth access\ - \ logs support (can reduce log volume if you don\u2019t need auth subrequest\ - \ logs).", New controller flag to enable/disable `aio_write` (advanced NGINX - performance tuning)., 'Helm chart improvements: configurable `hostAliases`, - templated service annotations via `tpl`, and support for `topologySpreadConstraints` - in Deployment/DaemonSet.'] - breaking_changes: ['**User snippets disabled by default**: if you use `nginx.ingress.kubernetes.io/*-snippet` - annotations, behavior will change until you explicitly re-enable snippets - in config.', '**`curl` removed from the controller image**: any in-container - debugging, init scripts, or exec probes that call `curl` will fail unless - you add your own tooling.', '**AJP support removed**: if you relied on AJP, - you must migrate to HTTP/HTTPS (or another supported protocol) before upgrading.', - Annotation validation may cause previously-working but non-conformant annotations - to be rejected or ignored; test your Ingress manifests against the new validation - behavior.] + chart_updates: + - Controller image updated from `registry.k8s.io/ingress-nginx/controller:v1.8.4` + to `v1.9.0` (and chroot variant accordingly). + - Base container image changed to remove `curl` (impacts any custom scripts/exec + probes relying on curl inside the controller container). + - AJP support was deprecated/removed in the 1.9.0 line (do not rely on AJP module). + - OpenTelemetry libs updated (OTel 1.11.0, gRPC updates) and Go bumped to 1.21.1 + (mostly build/runtime dependency changes). + features: + - User snippets are now **disabled by default**, improving security; they must + be explicitly enabled if you use snippet annotations. + - Ingress annotation validation was implemented; invalid annotations may now + be rejected or warned about instead of being silently accepted. + - "Optional auth access logs support (can reduce log volume if you don\u2019\ + t need auth subrequest logs)." + - New controller flag to enable/disable `aio_write` (advanced NGINX performance + tuning). + - 'Helm chart improvements: configurable `hostAliases`, templated service annotations + via `tpl`, and support for `topologySpreadConstraints` in Deployment/DaemonSet.' + breaking_changes: + - '**User snippets disabled by default**: if you use `nginx.ingress.kubernetes.io/*-snippet` + annotations, behavior will change until you explicitly re-enable snippets + in config.' + - '**`curl` removed from the controller image**: any in-container debugging, + init scripts, or exec probes that call `curl` will fail unless you add your + own tooling.' + - '**AJP support removed**: if you relied on AJP, you must migrate to HTTP/HTTPS + (or another supported protocol) before upgrading.' + - Annotation validation may cause previously-working but non-conformant annotations + to be rejected or ignored; test your Ingress manifests against the new validation + behavior. chart_version: 4.8.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b - version: 1.8.4 - kube: ['1.27', '1.26', '1.25', '1.24'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Controller image updated from v1.7.1 to v1.8.4 (and chroot - variant), including intermediary 1.8.x patch releases.', Go toolchain updated - in the 1.8.x line (notably to Go 1.21.1)., Auth access logging made optional - (newer controller behavior/config surface)., ModSecurity internal processing - disabled in a way intended to improve handling of large Ingress objects., - OpenTelemetry init image promoted to distroless; image tagging/metadata process - updated., AJP module re-added as a dynamic module (affects those using AJP)., - 'Dependency bumps (e.g., golang.org/x/net) and assorted image bumps.'] - features: ["Optional auth access logs, allowing you to reduce log volume/cost\ - \ if you don\u2019t need per-request auth logging.", Improved behavior for - large Ingress resources by changing how ModSecurity is handled internally., - 'Distroless OpenTelemetry init image promotion, which can improve security - posture and reduce image surface area.', AJP support available again via - a dynamic module for environments that still rely on AJP upstreams.] - breaking_changes: ['No explicit breaking changes are called out in the provided - notes; however, expect behavioral differences due to ModSecurity handling - changes and auth log defaults if you relied on previous implicit behavior.'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Controller image updated from v1.7.1 to v1.8.4 (and chroot variant), including + intermediary 1.8.x patch releases. + - Go toolchain updated in the 1.8.x line (notably to Go 1.21.1). + - Auth access logging made optional (newer controller behavior/config surface). + - ModSecurity internal processing disabled in a way intended to improve handling + of large Ingress objects. + - OpenTelemetry init image promoted to distroless; image tagging/metadata process + updated. + - AJP module re-added as a dynamic module (affects those using AJP). + - Dependency bumps (e.g., golang.org/x/net) and assorted image bumps. + features: + - "Optional auth access logs, allowing you to reduce log volume/cost if you\ + \ don\u2019t need per-request auth logging." + - Improved behavior for large Ingress resources by changing how ModSecurity + is handled internally. + - Distroless OpenTelemetry init image promotion, which can improve security + posture and reduce image surface area. + - AJP support available again via a dynamic module for environments that still + rely on AJP upstreams. + breaking_changes: + - No explicit breaking changes are called out in the provided notes; however, + expect behavioral differences due to ModSecurity handling changes and auth + log defaults if you relied on previous implicit behavior. chart_version: 4.7.3 - images: ['registry.k8s.io/ingress-nginx/controller:v1.8.4@sha256:8d8ddf32b83ca3e74bd5f66369fa60d85353e18ff55fa7691b321aa4716f5ba9', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.8.4@sha256:8d8ddf32b83ca3e74bd5f66369fa60d85353e18ff55fa7691b321aa4716f5ba9 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 - version: 1.7.1 - kube: ['1.27', '1.26', '1.25', '1.24'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -18202,26 +22314,36 @@ addons: \ notes, but you should diff your current `values.yaml` against the target\ \ chart\u2019s `values.yaml` for new defaults around metrics, admission, and\ \ service configuration._" - chart_updates: ['Add support for custom port configuration for the controller - internal service (PR #9846).', 'Adjust default HPA configuration to include - explicit resource type to avoid issues with Terraform Helm usage (PR #9803).', - 'FastCGI ConfigMap is expected to be in the same namespace as the ingress - controller (PR #9863).', Docs/README updates and formatting fixes (multiple - PRs).] - features: ['Support a new `--container` flag for the controller, improving flexibility - in container/runtime-related scenarios.', "Helm chart can now customize\ - \ ports on the controller\u2019s internal Service, enabling non-default\ - \ port mappings when needed.", HPA defaults were made more explicit to improve - compatibility with Terraform-managed Helm deployments.] - breaking_changes: ["InfluxDB support was deprecated and removed; if you were\ - \ exporting metrics to InfluxDB via built-in support, you\u2019ll need an\ - \ alternative integration.", The deprecated `secure-upstream` annotation - was removed; any Ingresses using it must be updated to supported annotations/configuration.] + chart_updates: + - 'Add support for custom port configuration for the controller internal service + (PR #9846).' + - 'Adjust default HPA configuration to include explicit resource type to avoid + issues with Terraform Helm usage (PR #9803).' + - 'FastCGI ConfigMap is expected to be in the same namespace as the ingress + controller (PR #9863).' + - Docs/README updates and formatting fixes (multiple PRs). + features: + - Support a new `--container` flag for the controller, improving flexibility + in container/runtime-related scenarios. + - "Helm chart can now customize ports on the controller\u2019s internal Service,\ + \ enabling non-default port mappings when needed." + - HPA defaults were made more explicit to improve compatibility with Terraform-managed + Helm deployments. + breaking_changes: + - "InfluxDB support was deprecated and removed; if you were exporting metrics\ + \ to InfluxDB via built-in support, you\u2019ll need an alternative integration." + - The deprecated `secure-upstream` annotation was removed; any Ingresses using + it must be updated to supported annotations/configuration. chart_version: 4.6.1 - images: ['registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f - version: 1.6.4 - kube: ['1.26', '1.25', '1.24', '1.23'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -18241,36 +22363,48 @@ addons: \ became configurable.\n - There was work around pathType validation toggles;\ \ check whether the chart exposes a value to disable/enable strict validation\ \ in your version.\n" - chart_updates: ['Controller image update to `registry.k8s.io/ingress-nginx/controller:v1.6.4` - (and chroot variant) from `v1.5.1`.', CI/release pipeline and chart linting - were added/adjusted (no runtime impact but indicates chart packaging changes)., - Grafana dashboard templates were adjusted to remove hardcoded namespaces/datasources - (may affect how you import/use dashboards)., HPA API version was bumped - to `autoscaling/v2` (cluster must support it; Kubernetes 1.23+ generally - OK)., RBAC was tightened by removing some ConfigMap-related permissions - (may matter if you had custom workflows expecting those permissions).] - features: [Support for Kubernetes topology-aware hints (can improve client-side - load distribution when using services that honor hints)., New Prometheus - metric for orphaned Ingress objects (`orphan_ingress`) to help detect stale/unused - Ingress resources., ConfigMap option exposed to disable gzip (`gzip-disable`) - for easier response compression control., New `ipdenylist` annotation to - deny traffic from specified IP ranges at the Ingress level., Ability to - disable creation of sync events (reduces event noise in large clusters)., - Stream module gained `buildResolvers` (helps with DNS resolution behavior - for TCP/UDP stream configs)., Profiler address became configurable (helps - with debugging/performance profiling when needed).] - breaking_changes: ['If you are on an older Kubernetes version, HPA switching - to `autoscaling/v2` can break installs/updates (verify your cluster supports - it).', 'Stricter/changed behavior around Ingress `pathType` validation was - introduced and then partially reverted/toggled; if you relied on invalid/missing - `pathType` or regex path edge-cases, re-test your Ingress rules after upgrade.', - RBAC reduction (removal of some ConfigMap permissions) can break custom automation - that expected the controller service account to have broader access.] + chart_updates: + - Controller image update to `registry.k8s.io/ingress-nginx/controller:v1.6.4` + (and chroot variant) from `v1.5.1`. + - CI/release pipeline and chart linting were added/adjusted (no runtime impact + but indicates chart packaging changes). + - Grafana dashboard templates were adjusted to remove hardcoded namespaces/datasources + (may affect how you import/use dashboards). + - HPA API version was bumped to `autoscaling/v2` (cluster must support it; Kubernetes + 1.23+ generally OK). + - RBAC was tightened by removing some ConfigMap-related permissions (may matter + if you had custom workflows expecting those permissions). + features: + - Support for Kubernetes topology-aware hints (can improve client-side load + distribution when using services that honor hints). + - New Prometheus metric for orphaned Ingress objects (`orphan_ingress`) to help + detect stale/unused Ingress resources. + - ConfigMap option exposed to disable gzip (`gzip-disable`) for easier response + compression control. + - New `ipdenylist` annotation to deny traffic from specified IP ranges at the + Ingress level. + - Ability to disable creation of sync events (reduces event noise in large clusters). + - Stream module gained `buildResolvers` (helps with DNS resolution behavior + for TCP/UDP stream configs). + - Profiler address became configurable (helps with debugging/performance profiling + when needed). + breaking_changes: + - If you are on an older Kubernetes version, HPA switching to `autoscaling/v2` + can break installs/updates (verify your cluster supports it). + - Stricter/changed behavior around Ingress `pathType` validation was introduced + and then partially reverted/toggled; if you relied on invalid/missing `pathType` + or regex path edge-cases, re-test your Ingress rules after upgrade. + - RBAC reduction (removal of some ConfigMap permissions) can break custom automation + that expected the controller service account to have broader access. chart_version: 4.5.2 - images: ['registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f - version: 1.5.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -18287,72 +22421,95 @@ addons: \ can now set a `securityContext` for admission-webhook components via Helm\ \ values (PR #9186). This matters for hardened clusters/PSA where you need\ \ explicit settings.\n" - chart_updates: [Controller switched to using **EndpointSlices** (introduced - in v1.4.0); verify your cluster has the EndpointSlice API enabled (default - in modern Kubernetes) and that any RBAC/network policies accommodate it., - '**Prometheus metric names changed** (v1.4.0): new/updated histogram & counter - names, some deprecated/removed metrics. Update dashboards/alerts/scrape - queries accordingly.', 'Controller image registry is **registry.k8s.io** - (noted around v1.4.0 timeframe); ensure image allowlists, proxies, and mirroring - are updated.', 'Upgrades in dependencies/runtime: **NGINX 1.21.6** and **Go - 1.19.2** by v1.5.1.', 'Bugfix: **Service name length** issue fixed (v1.5.1, - PR #9245).', 'Security: includes fixes for **CVE-2022-32149**, **CVE-2022-27664**, - **CVE-2022-1996** (v1.5.1).'] - features: [EndpointSlice support (instead of Endpoints) to align with modern - Kubernetes service discovery and scalability (v1.4.0)., New controller timing - metrics split into request/connect/header/response duration histograms to - improve latency visibility (v1.4.0)., Helm chart can now disable liveness/readiness - probes for the controller (v1.5.1)., Helm chart can now set a securityContext - for admission-webhook resources to support restricted/hardened clusters - (v1.5.1).] - breaking_changes: [Prometheus metrics rename/removal in v1.4.0 can break existing - Grafana dashboards and alert rules; you must update metric names and types - (some summaries removed/deprecated)., "Kubernetes version support drops\ - \ older clusters: 1.20\u20131.21 deprecated in v1.4.0 and explicitly marked\ - \ as no longer supported by the chart by v1.5.1; upgrading on 1.21 may fail\ - \ or be unsupported."] + chart_updates: + - Controller switched to using **EndpointSlices** (introduced in v1.4.0); verify + your cluster has the EndpointSlice API enabled (default in modern Kubernetes) + and that any RBAC/network policies accommodate it. + - '**Prometheus metric names changed** (v1.4.0): new/updated histogram & counter + names, some deprecated/removed metrics. Update dashboards/alerts/scrape queries + accordingly.' + - Controller image registry is **registry.k8s.io** (noted around v1.4.0 timeframe); + ensure image allowlists, proxies, and mirroring are updated. + - 'Upgrades in dependencies/runtime: **NGINX 1.21.6** and **Go 1.19.2** by v1.5.1.' + - 'Bugfix: **Service name length** issue fixed (v1.5.1, PR #9245).' + - 'Security: includes fixes for **CVE-2022-32149**, **CVE-2022-27664**, **CVE-2022-1996** + (v1.5.1).' + features: + - EndpointSlice support (instead of Endpoints) to align with modern Kubernetes + service discovery and scalability (v1.4.0). + - New controller timing metrics split into request/connect/header/response duration + histograms to improve latency visibility (v1.4.0). + - Helm chart can now disable liveness/readiness probes for the controller (v1.5.1). + - Helm chart can now set a securityContext for admission-webhook resources to + support restricted/hardened clusters (v1.5.1). + breaking_changes: + - Prometheus metrics rename/removal in v1.4.0 can break existing Grafana dashboards + and alert rules; you must update metric names and types (some summaries removed/deprecated). + - "Kubernetes version support drops older clusters: 1.20\u20131.21 deprecated\ + \ in v1.4.0 and explicitly marked as no longer supported by the chart by v1.5.1;\ + \ upgrading on 1.21 may fail or be unsupported." chart_version: 4.4.2 - images: ['registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f - version: 1.4.0 - kube: ['1.25', '1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Controller now uses EndpointSlices instead of Endpoints to discover - backends., Leader election in 1.3.1 is Lease-only (no ConfigMaps); 1.3.0 - was the transition release., 'Prometheus metrics have been renamed/reshaped; - several histograms added/updated, some summaries/histograms deprecated/removed.', - "Kubernetes version support updated: 1.20\u20131.21 deprecated; 1.25 supported;\ - \ supported set called out as 1.23\u20131.25.", Images moved/standardized - to registry.k8s.io (note broader k8s.gcr.io -> registry.k8s.io migration - notice)., Go toolchain bumped (1.19 in 1.3.1; 1.19.1 in 1.4.0); base image - updates (Alpine 3.16.2 in 1.3.1)., New annotation added for sticky cookie - domain., PSP-related job patch logic avoided on Kubernetes 1.25+., Metrics - port name can be parameterized (relevant if you scrape by port name).] - features: ['Backend discovery uses EndpointSlices, improving scalability on - clusters with many endpoints.', New/updated Prometheus histograms for request/connect/header/response - timings and request/response sizes., New annotation to set the sticky session - cookie domain.] - breaking_changes: ['Prometheus metric names changed; some metrics were deprecated/removed - (e.g., ingress_upstream_header_seconds summary removed), so dashboards/alerts - and scrape rules may break until updated.', "Clusters on Kubernetes 1.20\u2013\ - 1.21 are now deprecated for this controller line; plan to run on 1.23+ (and\ - \ 1.25 supported) before/with the upgrade.", 'Leader election behavior changed - in 1.3.1 to Lease-only; if you ever skipped 1.3.0 during the earlier migration - window, validate no legacy ConfigMap lock assumptions remain.'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Controller now uses EndpointSlices instead of Endpoints to discover backends. + - Leader election in 1.3.1 is Lease-only (no ConfigMaps); 1.3.0 was the transition + release. + - Prometheus metrics have been renamed/reshaped; several histograms added/updated, + some summaries/histograms deprecated/removed. + - "Kubernetes version support updated: 1.20\u20131.21 deprecated; 1.25 supported;\ + \ supported set called out as 1.23\u20131.25." + - Images moved/standardized to registry.k8s.io (note broader k8s.gcr.io -> registry.k8s.io + migration notice). + - Go toolchain bumped (1.19 in 1.3.1; 1.19.1 in 1.4.0); base image updates (Alpine + 3.16.2 in 1.3.1). + - New annotation added for sticky cookie domain. + - PSP-related job patch logic avoided on Kubernetes 1.25+. + - Metrics port name can be parameterized (relevant if you scrape by port name). + features: + - Backend discovery uses EndpointSlices, improving scalability on clusters with + many endpoints. + - New/updated Prometheus histograms for request/connect/header/response timings + and request/response sizes. + - New annotation to set the sticky session cookie domain. + breaking_changes: + - Prometheus metric names changed; some metrics were deprecated/removed (e.g., + ingress_upstream_header_seconds summary removed), so dashboards/alerts and + scrape rules may break until updated. + - "Clusters on Kubernetes 1.20\u20131.21 are now deprecated for this controller\ + \ line; plan to run on 1.23+ (and 1.25 supported) before/with the upgrade." + - Leader election behavior changed in 1.3.1 to Lease-only; if you ever skipped + 1.3.0 during the earlier migration window, validate no legacy ConfigMap lock + assumptions remain. chart_version: 4.3.0 - images: ['registry.k8s.io/ingress-nginx/controller:v1.4.0@sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.4.0@sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f - version: 1.3.1 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: null chart_version: 4.2.5 - images: ['registry.k8s.io/ingress-nginx/controller:v1.3.1@sha256:54f7fe2c6c5a9db9a0ebf1131797109bb7a4d91f56b9b362bde2abd237dd1974', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.3.0@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47'] + images: + - registry.k8s.io/ingress-nginx/controller:v1.3.1@sha256:54f7fe2c6c5a9db9a0ebf1131797109bb7a4d91f56b9b362bde2abd237dd1974 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.3.0@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47 name: ingress-nginx - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/istio/plural/icons/istio.png?raw=true git_url: https://github.com/istio/istio @@ -18362,320 +22519,453 @@ addons: eolApiSlug: istio versions: - version: 1.30.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are mostly metadata (assets, dates, links) - for Istio 1.30.0 vs 1.29.0; no functional change list is included in the - text shared. As a result, specific new features cannot be extracted from - the provided notes.'] - breaking_changes: [No breaking changes are listed in the provided release note - text; you need the 'Announcing 1.30' page content or detailed changelog - to identify any. Treat this as 'unknown' until validated from the official - release notes/migration guide.] + features: + - Release notes provided are mostly metadata (assets, dates, links) for Istio + 1.30.0 vs 1.29.0; no functional change list is included in the text shared. + As a result, specific new features cannot be extracted from the provided notes. + breaking_changes: + - No breaking changes are listed in the provided release note text; you need + the 'Announcing 1.30' page content or detailed changelog to identify any. + Treat this as 'unknown' until validated from the official release notes/migration + guide. chart_version: 1.30.0 - images: ['registry.istio.io/release/pilot:1.30.0'] + images: + - registry.istio.io/release/pilot:1.30.0 eolAt: '2026-12-31' - version: 1.29.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['No Helm chart changelog was provided in the notes shared (only - upstream Istio application release metadata and asset lists), so no chart - template/value changes can be identified from this input.'] - features: [No concrete 1.29.0 feature items were included in the provided notes - (only links to the full release notes). Review the linked 1.29.0 announcement - page for user-facing features and improvements before upgrading.] - breaking_changes: ['No breaking changes were included in the provided notes. - You must review the linked 1.29.0 release notes and any ''Upgrade Notes'' - section to identify removals, behavior changes, or config deprecations that - could affect your cluster.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart changelog was provided in the notes shared (only upstream Istio + application release metadata and asset lists), so no chart template/value + changes can be identified from this input. + features: + - No concrete 1.29.0 feature items were included in the provided notes (only + links to the full release notes). Review the linked 1.29.0 announcement page + for user-facing features and improvements before upgrading. + breaking_changes: + - No breaking changes were included in the provided notes. You must review the + linked 1.29.0 release notes and any 'Upgrade Notes' section to identify removals, + behavior changes, or config deprecations that could affect your cluster. chart_version: 1.29.0 - images: ['docker.io/istio/pilot:1.29.0'] + images: + - docker.io/istio/pilot:1.29.0 eolAt: '2026-10-31' - version: 1.28.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [New Istio release 1.28.0 published (see official release notes link - provided)., 'Updated istioctl and platform bundles are available for all - supported OS/architectures (linux/amd64, linux/arm64, linux/armv7, macOS, - Windows).'] - breaking_changes: [No breaking changes were included in the provided notes; - review the official 1.28.0 announcement for any upgrade-impacting changes - not captured here.] + features: + - New Istio release 1.28.0 published (see official release notes link provided). + - Updated istioctl and platform bundles are available for all supported OS/architectures + (linux/amd64, linux/arm64, linux/armv7, macOS, Windows). + breaking_changes: + - No breaking changes were included in the provided notes; review the official + 1.28.0 announcement for any upgrade-impacting changes not captured here. chart_version: 1.28.0 - images: ['docker.io/istio/pilot:1.28.0'] + images: + - docker.io/istio/pilot:1.28.0 eolAt: '2026-07-01' - version: 1.27.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes links moved from 1.26.x to 1.27.x (new minor release), - with updated istioctl/istio artifacts for multiple platforms.', Updated - Istio and istioctl binaries/images to version 1.27.0 (new tarballs/zips - and SPDX files published).] - breaking_changes: [No breaking changes were included in the provided notes; - verify the official 1.27 upgrade notes for deprecations/removals before - upgrading.] + features: + - Release notes links moved from 1.26.x to 1.27.x (new minor release), with + updated istioctl/istio artifacts for multiple platforms. + - Updated Istio and istioctl binaries/images to version 1.27.0 (new tarballs/zips + and SPDX files published). + breaking_changes: + - No breaking changes were included in the provided notes; verify the official + 1.27 upgrade notes for deprecations/removals before upgrading. chart_version: 1.27.0 - images: ['docker.io/istio/pilot:1.27.0'] + images: + - docker.io/istio/pilot:1.27.0 eolAt: '2026-04-07' - version: 1.26.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Upgrade target is Istio 1.26.0 (published 2025-05-08); new istioctl/istio - binaries and artifacts are available for multiple platforms., No functional - changes are described in the provided notes; only release metadata and artifact - listings are included.] - breaking_changes: ['No breaking changes are listed in the provided release notes - snippet; you should review the official Istio 1.26.x announcement/changelog - for deprecations, API changes, and upgrade notes before proceeding.'] + features: + - Upgrade target is Istio 1.26.0 (published 2025-05-08); new istioctl/istio + binaries and artifacts are available for multiple platforms. + - No functional changes are described in the provided notes; only release metadata + and artifact listings are included. + breaking_changes: + - No breaking changes are listed in the provided release notes snippet; you + should review the official Istio 1.26.x announcement/changelog for deprecations, + API changes, and upgrade notes before proceeding. chart_version: 1.26.0 - images: ['docker.io/istio/pilot:1.26.0'] + images: + - docker.io/istio/pilot:1.26.0 eolAt: '2025-12-22' - version: 1.25.0 - kube: ['1.32', '1.31', '1.30', '1.29'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No actionable feature details were included in the provided notes - beyond links and artifact lists; refer to the official 1.25 release notes - page for the actual feature list before upgrading.] - breaking_changes: [No breaking-change details were included in the provided - notes beyond links and artifact lists; review the official 1.25 release - notes and upgrade notes for any behavior/config/API changes before proceeding.] + features: + - No actionable feature details were included in the provided notes beyond links + and artifact lists; refer to the official 1.25 release notes page for the + actual feature list before upgrading. + breaking_changes: + - No breaking-change details were included in the provided notes beyond links + and artifact lists; review the official 1.25 release notes and upgrade notes + for any behavior/config/API changes before proceeding. chart_version: 1.25.0 - images: ['docker.io/istio/pilot:1.25.0'] + images: + - docker.io/istio/pilot:1.25.0 eolAt: '2025-09-30' - version: 1.24.0 - kube: ['1.31', '1.30', '1.29', '1.28'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are just release metadata/assets links; no - actual 1.24.0 vs 1.23.0 feature list was included, so specific new features - cannot be summarized from the supplied text.'] - breaking_changes: ['No breaking-change details were included in the supplied - notes (only release metadata and artifact lists), so breaking changes cannot - be identified from this input.'] + features: + - Release notes provided are just release metadata/assets links; no actual 1.24.0 + vs 1.23.0 feature list was included, so specific new features cannot be summarized + from the supplied text. + breaking_changes: + - No breaking-change details were included in the supplied notes (only release + metadata and artifact lists), so breaking changes cannot be identified from + this input. chart_version: 1.24.0 - images: ['docker.io/istio/pilot:1.24.0'] + images: + - docker.io/istio/pilot:1.24.0 eolAt: '2025-06-24' - version: 1.23.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [1.23.0 is a new Istio minor release compared to 1.22.0; use the matching - 1.23.0 artifacts/istioctl and upgrade control plane + data plane in a coordinated - rollout.] - breaking_changes: [No specific breaking changes were provided in the pasted - release notes (only metadata and asset lists). Review the official 1.23.0 - release notes link for deprecations/behavior changes before upgrading.] + features: + - 1.23.0 is a new Istio minor release compared to 1.22.0; use the matching 1.23.0 + artifacts/istioctl and upgrade control plane + data plane in a coordinated + rollout. + breaking_changes: + - No specific breaking changes were provided in the pasted release notes (only + metadata and asset lists). Review the official 1.23.0 release notes link for + deprecations/behavior changes before upgrading. chart_version: 1.23.0 - images: ['docker.io/istio/pilot:1.23.0'] + images: + - docker.io/istio/pilot:1.23.0 eolAt: '2025-04-16' - version: 1.22.0 - kube: ['1.30', '1.29', 1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - 1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release note excerpt provided contains primarily metadata (dates, - links, artifacts) for Istio 1.21.0 and 1.22.0; no functional changes, new - features, or upgrade-impacting behavior changes are listed in the text you - pasted.', Both versions publish new istioctl and istio distribution artifacts - for multiple OS/arch combinations; your upgrade should use the matching - 1.22.0 istioctl to install/validate 1.22 control plane changes.] - breaking_changes: [No breaking changes are described in the provided text; to - assess real breaking/behavior changes you must review the linked Istio 1.22 - release notes page (and especially the 'Upgrade Notes' / 'Deprecations' - sections).] + features: + - Release note excerpt provided contains primarily metadata (dates, links, artifacts) + for Istio 1.21.0 and 1.22.0; no functional changes, new features, or upgrade-impacting + behavior changes are listed in the text you pasted. + - Both versions publish new istioctl and istio distribution artifacts for multiple + OS/arch combinations; your upgrade should use the matching 1.22.0 istioctl + to install/validate 1.22 control plane changes. + breaking_changes: + - No breaking changes are described in the provided text; to assess real breaking/behavior + changes you must review the linked Istio 1.22 release notes page (and especially + the 'Upgrade Notes' / 'Deprecations' sections). chart_version: 1.22.0 - images: ['docker.io/istio/pilot:1.22.0'] + images: + - docker.io/istio/pilot:1.22.0 eolAt: '2025-01-22' - version: 1.21.0 - kube: ['1.29', 1.28', '1.27', '1.26'] + kube: + - '1.29' + - 1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided only include metadata and artifact lists - for 1.20.0 and 1.21.0, without the actual change log content; no concrete - feature deltas can be extracted from the text shared.'] - breaking_changes: [No breaking changes can be determined from the provided release - note excerpts because they do not include the detailed changelog/upgrade - notes.] + features: + - Release notes provided only include metadata and artifact lists for 1.20.0 + and 1.21.0, without the actual change log content; no concrete feature deltas + can be extracted from the text shared. + breaking_changes: + - No breaking changes can be determined from the provided release note excerpts + because they do not include the detailed changelog/upgrade notes. chart_version: 1.21.0 - images: ['docker.io/istio/pilot:1.21.0'] + images: + - docker.io/istio/pilot:1.21.0 eolAt: '2024-09-27' - version: 1.20.0 - kube: ['1.28', '1.27', '1.26', '1.25'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided include artifact listings and links but do - not include the actual 1.20 feature list; review the official 1.20 announcement - for specifics (telemetry, ambient, gateway, security, and UX improvements - are typical areas).'] - breaking_changes: [No breaking changes were included in the provided excerpts; - you must check the 1.19 and 1.20 upgrade notes/Deprecations pages before - upgrading from 1.18 to 1.20.] + features: + - Release notes provided include artifact listings and links but do not include + the actual 1.20 feature list; review the official 1.20 announcement for specifics + (telemetry, ambient, gateway, security, and UX improvements are typical areas). + breaking_changes: + - No breaking changes were included in the provided excerpts; you must check + the 1.19 and 1.20 upgrade notes/Deprecations pages before upgrading from 1.18 + to 1.20. chart_version: 1.20.0 - images: ['docker.io/istio/pilot:1.20.0'] + images: + - docker.io/istio/pilot:1.20.0 eolAt: '2024-06-25' - version: 1.18.0 - kube: ['1.27', '1.26', '1.25', '1.24'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided here mostly list artifacts and metadata; - no concrete feature list for 1.18.0 vs 1.17.0 is included in the pasted - content. See the linked Istio 1.18 announcement/release notes for the actual - new features and improvements (traffic management, security, telemetry, - platform support).'] - breaking_changes: [No breaking-change details are included in the pasted content; - breaking changes (if any) must be taken from the Istio 1.18 release notes - / upgrade notes page linked in the announcement.] + features: + - Release notes provided here mostly list artifacts and metadata; no concrete + feature list for 1.18.0 vs 1.17.0 is included in the pasted content. See the + linked Istio 1.18 announcement/release notes for the actual new features and + improvements (traffic management, security, telemetry, platform support). + breaking_changes: + - No breaking-change details are included in the pasted content; breaking changes + (if any) must be taken from the Istio 1.18 release notes / upgrade notes page + linked in the announcement. chart_version: 1.18.0 - images: ['docker.io/istio/pilot:1.18.0'] + images: + - docker.io/istio/pilot:1.18.0 eolAt: '2024-01-04' - version: 1.17.0 - kube: ['1.26', '1.25', '1.24', '1.23'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['This note set you provided is mostly metadata (artifact links, file - sizes, download counts) for 1.16.0 and 1.17.0; it does not include the actual - 1.17 feature list.', 'From the official 1.17 announcement page (linked), - you should extract the specific new features/fixes relevant to your cluster - (ambient/sidecar behavior, gateway changes, telemetry, security, etc.).'] - breaking_changes: [No breaking changes can be reliably identified from the pasted - content because it doesn't include the 'upgrade notes'/deprecations section - from the 1.17 release notes., 'Check the 1.17 release notes for removals/deprecations - and any required API/version bumps (Kubernetes version support, Envoy, gateway - APIs) before upgrading.'] + features: + - This note set you provided is mostly metadata (artifact links, file sizes, + download counts) for 1.16.0 and 1.17.0; it does not include the actual 1.17 + feature list. + - From the official 1.17 announcement page (linked), you should extract the + specific new features/fixes relevant to your cluster (ambient/sidecar behavior, + gateway changes, telemetry, security, etc.). + breaking_changes: + - No breaking changes can be reliably identified from the pasted content because + it doesn't include the 'upgrade notes'/deprecations section from the 1.17 + release notes. + - Check the 1.17 release notes for removals/deprecations and any required API/version + bumps (Kubernetes version support, Envoy, gateway APIs) before upgrading. chart_version: 1.17.0 - images: ['docker.io/istio/pilot:1.17.0'] + images: + - docker.io/istio/pilot:1.17.0 eolAt: '2023-10-27' - version: 1.16.0 - kube: ['1.25', '1.24', '1.23', '1.22'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Istio 1.16.0 is a new minor release over 1.14.0; expect updated - control plane and sidecar images, plus fixes and enhancements across traffic - management, security, and observability (details not included in provided - notes).'] - breaking_changes: ['The provided release snippets do not include upgrade notes, - deprecations, or breaking changes; you must review the official 1.15.x and - 1.16.x upgrade notes before proceeding to catch any incompatible API/behavior - changes.'] + features: + - Istio 1.16.0 is a new minor release over 1.14.0; expect updated control plane + and sidecar images, plus fixes and enhancements across traffic management, + security, and observability (details not included in provided notes). + breaking_changes: + - The provided release snippets do not include upgrade notes, deprecations, + or breaking changes; you must review the official 1.15.x and 1.16.x upgrade + notes before proceeding to catch any incompatible API/behavior changes. chart_version: 1.16.0 - images: ['docker.io/istio/pilot:1.16.0'] + images: + - docker.io/istio/pilot:1.16.0 eolAt: '2023-07-25' - version: 1.14.0 - kube: ['1.24', '1.23', '1.22', '1.21'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are metadata (dates, assets, links) for Istio - 1.14.0 vs 1.13.0; no functional changes are listed in the excerpt.', 'Upgrade - involves moving Istio control plane and istioctl binaries to 1.14.0 artifacts - for your platform (amd64/arm64/armv7, etc.).'] - breaking_changes: [No breaking changes can be determined from the provided notes - because they do not include feature/behavior/deprecation details. Review - the linked Istio 1.14.0 announcement and full release notes for breaking - changes and upgrade notes before proceeding.] + features: + - Release notes provided are metadata (dates, assets, links) for Istio 1.14.0 + vs 1.13.0; no functional changes are listed in the excerpt. + - Upgrade involves moving Istio control plane and istioctl binaries to 1.14.0 + artifacts for your platform (amd64/arm64/armv7, etc.). + breaking_changes: + - No breaking changes can be determined from the provided notes because they + do not include feature/behavior/deprecation details. Review the linked Istio + 1.14.0 announcement and full release notes for breaking changes and upgrade + notes before proceeding. chart_version: 1.14.0 - images: ['docker.io/istio/pilot:1.14.0'] + images: + - docker.io/istio/pilot:1.14.0 eolAt: '2022-12-27' - version: 1.13.0 - kube: ['1.23', '1.22', '1.21', '1.20'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Istio 1.13.0 is the target version for the upgrade from 1.12.0; - the notes provided here only include release metadata and artifact lists, - not functional changes.', 'New build artifacts are published for Istio 1.13.0 - across linux/osx/windows and amd64/arm64/armv7, including separate istioctl - bundles.'] - breaking_changes: ['No breaking changes were included in the provided release - notes excerpt; consult the official Istio 1.13.0 announcement/changelog - and the 1.13 upgrade notes for any removals, deprecations, or behavior changes.'] + features: + - Istio 1.13.0 is the target version for the upgrade from 1.12.0; the notes + provided here only include release metadata and artifact lists, not functional + changes. + - New build artifacts are published for Istio 1.13.0 across linux/osx/windows + and amd64/arm64/armv7, including separate istioctl bundles. + breaking_changes: + - No breaking changes were included in the provided release notes excerpt; consult + the official Istio 1.13.0 announcement/changelog and the 1.13 upgrade notes + for any removals, deprecations, or behavior changes. chart_version: 1.13.0 - images: ['docker.io/istio/pilot:1.13.0'] + images: + - docker.io/istio/pilot:1.13.0 eolAt: '2022-10-12' - version: 1.12.0 - kube: ['1.22', '1.21', '1.20', '1.19'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 1.12.0 - images: ['docker.io/istio/pilot:1.12.0'] + images: + - docker.io/istio/pilot:1.12.0 eolAt: '2022-07-12' - version: 1.11.0 - kube: ['1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null eolAt: '2022-03-25' - version: 1.9.0 - kube: ['1.20', '1.19', '1.18', '1.17'] + kube: + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null eolAt: '2021-10-08' - version: 1.8.0 - kube: ['1.19', '1.18', '1.17', '1.16'] + kube: + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null eolAt: '2021-05-12' - version: 1.7.0 - kube: ['1.18', '1.17', '1.16'] + kube: + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null eolAt: '2021-02-25' - version: 1.1.0 - kube: ['1.21', '1.20', '1.19', '1.18'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null @@ -18687,187 +22977,455 @@ addons: eolApiSlug: jaeger versions: - version: 1.62.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', - '1.21', '1.20', '1.19'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.61.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', - '1.21', '1.20', '1.19'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.60.0 - kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', - '1.21', '1.20', '1.19'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.59.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.57.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.56.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.55.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.54.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.53.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 3.4.1 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.53.0', 'jaegertracing/jaeger-cassandra-schema:1.53.0', - 'jaegertracing/jaeger-collector:1.53.0', 'jaegertracing/jaeger-query:1.53.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.53.0 + - jaegertracing/jaeger-cassandra-schema:1.53.0 + - jaegertracing/jaeger-collector:1.53.0 + - jaegertracing/jaeger-query:1.53.0 - version: 1.52.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.51.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 0.73.2 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.51.0', 'jaegertracing/jaeger-cassandra-schema:1.51.0', - 'jaegertracing/jaeger-collector:1.51.0', 'jaegertracing/jaeger-query:1.51.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.51.0 + - jaegertracing/jaeger-cassandra-schema:1.51.0 + - jaegertracing/jaeger-collector:1.51.0 + - jaegertracing/jaeger-query:1.51.0 - version: 1.50.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.49.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.48.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.47.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.46.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.45.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 0.71.18 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.45.0', 'jaegertracing/jaeger-cassandra-schema:1.45.0', - 'jaegertracing/jaeger-collector:1.45.0', 'jaegertracing/jaeger-query:1.45.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.45.0 + - jaegertracing/jaeger-cassandra-schema:1.45.0 + - jaegertracing/jaeger-collector:1.45.0 + - jaegertracing/jaeger-query:1.45.0 - version: 1.44.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.43.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.42.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 0.70.2 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.42.0', 'jaegertracing/jaeger-cassandra-schema:1.42.0', - 'jaegertracing/jaeger-collector:1.42.0', 'jaegertracing/jaeger-query:1.42.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.42.0 + - jaegertracing/jaeger-cassandra-schema:1.42.0 + - jaegertracing/jaeger-collector:1.42.0 + - jaegertracing/jaeger-query:1.42.0 - version: 1.41.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.40.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.39.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 0.68.2 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.39.0', 'jaegertracing/jaeger-cassandra-schema:1.39.0', - 'jaegertracing/jaeger-collector:1.39.0', 'jaegertracing/jaeger-query:1.39.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.39.0 + - jaegertracing/jaeger-cassandra-schema:1.39.0 + - jaegertracing/jaeger-collector:1.39.0 + - jaegertracing/jaeger-query:1.39.0 - version: 1.38.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.37.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Introduces a new remote-storage service to support remote storage - backends via a dedicated service endpoint., UI dependency is bumped by pinning - the Jaeger UI to version 1.26.0 (from 1.25.0 in 1.36.0).] + features: + - Introduces a new remote-storage service to support remote storage backends + via a dedicated service endpoint. + - UI dependency is bumped by pinning the Jaeger UI to version 1.26.0 (from 1.25.0 + in 1.36.0). breaking_changes: [] chart_version: 0.65.1 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.37.0', 'jaegertracing/jaeger-cassandra-schema:1.37.0', - 'jaegertracing/jaeger-collector:1.37.0', 'jaegertracing/jaeger-query:1.37.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.37.0 + - jaegertracing/jaeger-cassandra-schema:1.37.0 + - jaegertracing/jaeger-collector:1.37.0 + - jaegertracing/jaeger-query:1.37.0 - version: 1.36.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 0.57.1 - images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.36.0', 'jaegertracing/jaeger-cassandra-schema:1.36.0', - 'jaegertracing/jaeger-collector:1.36.0', 'jaegertracing/jaeger-query:1.36.0'] + images: + - cassandra:3.11.6 + - jaegertracing/jaeger-agent:1.36.0 + - jaegertracing/jaeger-cassandra-schema:1.36.0 + - jaegertracing/jaeger-collector:1.36.0 + - jaegertracing/jaeger-query:1.36.0 - version: 1.35.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.34.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 1.33.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null @@ -18879,78 +23437,118 @@ addons: helm_values: settings.clusterName=example versions: - version: 1.13.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['(From the notes provided: v1.13.0) Improved handling of IP unavailability - by working at the subnet level (ICE subnets) instead of only Availability - Zones, and added logic to skip EC2 API calls for zonally-shifted AZs.', - (v1.13.0) More flexible IAM instance profile creation by allowing a custom - IAM path for instance profiles., '(v1.13.0) New configuration knobs to control - refresh intervals for AMIs and subnets, letting operators tune AWS API churn - vs freshness.', '(v1.13.0) Expanded EC2NodeClass capabilities, including - nested virtualization support and new connection-tracking-related fields.', - (v1.9.0) Added ICE filtering for MaxFleetCountExceeded errors and added support - for a tenancy label to influence/describe node tenancy., (v1.9.0) Added - Windows Server 2025 (WS2025) support for Karpenter-managed nodes.] - breaking_changes: ["No explicit breaking changes were shown in the provided\ - \ excerpts for v1.9.0 or v1.13.0; however upgrading across multiple minor\ - \ versions (1.9 \u2192 1.13) typically implies CRD/schema and controller\ - \ behavior changes\u2014confirm by reviewing intermediate versions\u2019\ - \ upgrade guides and CRD diffs before applying in production."] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - '(From the notes provided: v1.13.0) Improved handling of IP unavailability + by working at the subnet level (ICE subnets) instead of only Availability + Zones, and added logic to skip EC2 API calls for zonally-shifted AZs.' + - (v1.13.0) More flexible IAM instance profile creation by allowing a custom + IAM path for instance profiles. + - (v1.13.0) New configuration knobs to control refresh intervals for AMIs and + subnets, letting operators tune AWS API churn vs freshness. + - (v1.13.0) Expanded EC2NodeClass capabilities, including nested virtualization + support and new connection-tracking-related fields. + - (v1.9.0) Added ICE filtering for MaxFleetCountExceeded errors and added support + for a tenancy label to influence/describe node tenancy. + - (v1.9.0) Added Windows Server 2025 (WS2025) support for Karpenter-managed + nodes. + breaking_changes: + - "No explicit breaking changes were shown in the provided excerpts for v1.9.0\ + \ or v1.13.0; however upgrading across multiple minor versions (1.9 \u2192\ + \ 1.13) typically implies CRD/schema and controller behavior changes\u2014\ + confirm by reviewing intermediate versions\u2019 upgrade guides and CRD diffs\ + \ before applying in production." chart_version: 1.13.0 - images: ['public.ecr.aws/karpenter/controller:1.13.0@sha256:ea731b0cd813add8b2947a76bfe861c38069d85922b01d0c1647d1466279b7fe'] + images: + - public.ecr.aws/karpenter/controller:1.13.0@sha256:ea731b0cd813add8b2947a76bfe861c38069d85922b01d0c1647d1466279b7fe - version: 1.9.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Controller IAM policy was split into multiple policies; review - any automation that installs/patches the controller policy and ensure you - apply the new policy documents before/with the upgrade., 'Max supported - Kubernetes version bumped to 1.35; if you run 1.35, ensure you are on v1.9.0+ - and validate AMI/test matrix changes accordingly.', 'Monitoring: ServiceMonitor - gained a `sampleLimit` option; if you manage Prometheus Operator manifests, - consider whether you need to set/override this value.'] - features: [Adds ICE filtering for the `MaxFleetCountExceeded` condition to improve - capacity selection behavior under fleet limits., Adds support for labeling - tenancy in AWS and improves related validation handling., Adds Windows Server - 2025 (WS2025) support., Makes the controller policy helper script POSIX - compliant (quality-of-life for install/upgrade automation).] - breaking_changes: [Controller IAM policies were split; upgrades may fail or - the controller may be under-permissioned until the new set of policies is - applied/reconciled. Treat this as an upgrade prerequisite and verify permissions - before rolling out.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Controller IAM policy was split into multiple policies; review any automation + that installs/patches the controller policy and ensure you apply the new policy + documents before/with the upgrade. + - Max supported Kubernetes version bumped to 1.35; if you run 1.35, ensure you + are on v1.9.0+ and validate AMI/test matrix changes accordingly. + - 'Monitoring: ServiceMonitor gained a `sampleLimit` option; if you manage Prometheus + Operator manifests, consider whether you need to set/override this value.' + features: + - Adds ICE filtering for the `MaxFleetCountExceeded` condition to improve capacity + selection behavior under fleet limits. + - Adds support for labeling tenancy in AWS and improves related validation handling. + - Adds Windows Server 2025 (WS2025) support. + - Makes the controller policy helper script POSIX compliant (quality-of-life + for install/upgrade automation). + breaking_changes: + - Controller IAM policies were split; upgrades may fail or the controller may + be under-permissioned until the new set of policies is applied/reconciled. + Treat this as an upgrade prerequisite and verify permissions before rolling + out. chart_version: 1.9.0 - images: ['public.ecr.aws/karpenter/controller:1.9.0@sha256:30a506c64fbb1d8026cbfd9a1d662be3ab6e33a7999290a104085d78b49a69d7'] + images: + - public.ecr.aws/karpenter/controller:1.9.0@sha256:30a506c64fbb1d8026cbfd9a1d662be3ab6e33a7999290a104085d78b49a69d7 - version: 1.8.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Helm chart updated to reflect new CLI options (noted in v1.8.0\ - \ chores: \u201CUpdate helm chart for new CLI options\u201D)."] - features: ['Delayed registration support for AWS KWOK (v1.6.0), improving KWOK-based - testing/virtual node flows.', Capacity Block support (v1.6.0) for provisioning - into EC2 Capacity Blocks., 'Temporarily ICE an AZ when its subnets run out - of IPs (v1.6.0), reducing thrash when IP capacity is exhausted.', Additional - Bottlerocket log settings support (v1.6.0)., Auto-relaxing minimum values - support (v1.6.0) to reduce configuration friction around minimum constraints., - 'Ability to set `spec.IpPrefixCount` to pre-warm IP prefixes (v1.8.0), helping - reduce pod IP allocation latency on new nodes.', 'Support `InstanceMatchCriteria` - in `CapacityReservationSelectorTerms` (v1.8.0), improving targeting of Capacity - Reservations.', 'Bottlerocket change: use default ephemeral storage bind - command (v1.8.0).'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Helm chart updated to reflect new CLI options (noted in v1.8.0 chores: \u201C\ + Update helm chart for new CLI options\u201D)." + features: + - Delayed registration support for AWS KWOK (v1.6.0), improving KWOK-based testing/virtual + node flows. + - Capacity Block support (v1.6.0) for provisioning into EC2 Capacity Blocks. + - Temporarily ICE an AZ when its subnets run out of IPs (v1.6.0), reducing thrash + when IP capacity is exhausted. + - Additional Bottlerocket log settings support (v1.6.0). + - Auto-relaxing minimum values support (v1.6.0) to reduce configuration friction + around minimum constraints. + - Ability to set `spec.IpPrefixCount` to pre-warm IP prefixes (v1.8.0), helping + reduce pod IP allocation latency on new nodes. + - Support `InstanceMatchCriteria` in `CapacityReservationSelectorTerms` (v1.8.0), + improving targeting of Capacity Reservations. + - 'Bottlerocket change: use default ephemeral storage bind command (v1.8.0).' breaking_changes: [] chart_version: 1.8.0 - images: ['public.ecr.aws/karpenter/controller:1.8.0@sha256:f913075cdd31cfcdfaa9726ca7a0b264832fc42e8a48eb573a2a0f454b38b112'] + images: + - public.ecr.aws/karpenter/controller:1.8.0@sha256:f913075cdd31cfcdfaa9726ca7a0b264832fc42e8a48eb573a2a0f454b38b112 - version: 1.6.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -18966,29 +23564,39 @@ addons: \ removed in chart**: the chart **removed `runAsNonRoot`** to support more\ \ restricted pod security profiles. If you relied on `runAsNonRoot: true`,\ \ you may need to explicitly set your own security context via values.\n" - chart_updates: [Improved default security context in the Helm chart., Chart - now validates configuration and fails installation if `settings.clusterName` - is missing., ServiceMonitor template extended to support `relabelings` and - `metricRelabelings`., Chart securityContext defaults adjusted (including - removal of `runAsNonRoot`).] - features: ['Support for AWS KWOK, including delayed registration support for - simulated nodes.', Capacity Block support (useful for reserving/using pre-purchased - EC2 capacity blocks)., "Automatically \u201CICE\u201D (temporarily exclude)\ - \ AZs when subnets in that AZ run out of available IPs, improving resilience\ - \ during IP exhaustion events.", 'Additional Bottlerocket configuration - options, including more log settings and soft eviction support.', '`volumeInitializationRate` - support for EBS `blockDeviceMappings`, allowing control of EBS initialization - performance.', "Support for automatically relaxing minimum values in certain\ - \ scheduling/validation paths (reduces unnecessary failures when strict\ - \ mins can\u2019t be met)."] - breaking_changes: [Kubernetes **1.25 support is dropped**. Clusters on 1.25 - must upgrade Kubernetes before upgrading Karpenter provider to v1.6.0., - Helm chart now **requires `settings.clusterName`**; upgrades/installs will - fail if it is not provided.] + chart_updates: + - Improved default security context in the Helm chart. + - Chart now validates configuration and fails installation if `settings.clusterName` + is missing. + - ServiceMonitor template extended to support `relabelings` and `metricRelabelings`. + - Chart securityContext defaults adjusted (including removal of `runAsNonRoot`). + features: + - Support for AWS KWOK, including delayed registration support for simulated + nodes. + - Capacity Block support (useful for reserving/using pre-purchased EC2 capacity + blocks). + - "Automatically \u201CICE\u201D (temporarily exclude) AZs when subnets in that\ + \ AZ run out of available IPs, improving resilience during IP exhaustion events." + - Additional Bottlerocket configuration options, including more log settings + and soft eviction support. + - '`volumeInitializationRate` support for EBS `blockDeviceMappings`, allowing + control of EBS initialization performance.' + - "Support for automatically relaxing minimum values in certain scheduling/validation\ + \ paths (reduces unnecessary failures when strict mins can\u2019t be met)." + breaking_changes: + - Kubernetes **1.25 support is dropped**. Clusters on 1.25 must upgrade Kubernetes + before upgrading Karpenter provider to v1.6.0. + - Helm chart now **requires `settings.clusterName`**; upgrades/installs will + fail if it is not provided. chart_version: 1.6.0 - images: ['public.ecr.aws/karpenter/controller:1.6.0@sha256:37c761a3a0b485fd34db1390317ef6149141f532c5a699c528b98fb8f9cc722a'] + images: + - public.ecr.aws/karpenter/controller:1.6.0@sha256:37c761a3a0b485fd34db1390317ef6149141f532c5a699c528b98fb8f9cc722a - version: 1.5.0 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -19004,55 +23612,74 @@ addons: If you previously relied on running as root or looser permissions, verify pod security settings/PSA/PSP compatibility and override `securityContext`/`podSecurityContext` only if needed.' - chart_updates: [Improved/tightened default controller pod security context., - Chart validates presence of `settings.clusterName` and fails installation - if missing., ServiceMonitor template updated to support `relabelings` and - `metricRelabelings` fields (Prometheus Operator users).] - features: [Stricter/safer Helm chart defaults (security context) and better - chart validation (requires `settings.clusterName`)., 'Bottlerocket support - improvements: soft eviction support and a new `single-process-oom-kill` - setting, plus additional kubelet configuration test coverage.', 'New NodeClass - storage option: `volumeInitializationRate` on EBS `blockDeviceMappings`, - enabling more control over EBS volume initialization performance.'] - breaking_changes: [Kubernetes 1.25 support was dropped; clusters running 1.25 - must be upgraded before moving to these versions., Helm chart installation/upgrade - can fail if `settings.clusterName` is not set; this is an intentional enforcement - change.] + chart_updates: + - Improved/tightened default controller pod security context. + - Chart validates presence of `settings.clusterName` and fails installation + if missing. + - ServiceMonitor template updated to support `relabelings` and `metricRelabelings` + fields (Prometheus Operator users). + features: + - Stricter/safer Helm chart defaults (security context) and better chart validation + (requires `settings.clusterName`). + - 'Bottlerocket support improvements: soft eviction support and a new `single-process-oom-kill` + setting, plus additional kubelet configuration test coverage.' + - 'New NodeClass storage option: `volumeInitializationRate` on EBS `blockDeviceMappings`, + enabling more control over EBS volume initialization performance.' + breaking_changes: + - Kubernetes 1.25 support was dropped; clusters running 1.25 must be upgraded + before moving to these versions. + - Helm chart installation/upgrade can fail if `settings.clusterName` is not + set; this is an intentional enforcement change. chart_version: 1.5.0 - images: ['public.ecr.aws/karpenter/controller:1.5.0@sha256:339aef3f5ecdf6f94d1c7cc9d0e1d359c281b4f9b842877bdbf2acd3fa360521'] + images: + - public.ecr.aws/karpenter/controller:1.5.0@sha256:339aef3f5ecdf6f94d1c7cc9d0e1d359c281b4f9b842877bdbf2acd3fa360521 - version: 1.2.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Supports IAM role paths (useful if your org creates roles like /team/role-name - instead of flat names)., CRDs can now be installed with optional custom - annotations., Adds support for a Node Monitoring Agent feature area (node - health/repair related integrations).] + features: + - Supports IAM role paths (useful if your org creates roles like /team/role-name + instead of flat names). + - CRDs can now be installed with optional custom annotations. + - Adds support for a Node Monitoring Agent feature area (node health/repair + related integrations). breaking_changes: [] chart_version: 1.2.0 - images: ['public.ecr.aws/karpenter/controller:1.2.0@sha256:24b8fe57f02b70fc4ab3cd6d5aa0d73a6f3d0c62ca5d23d7ffc8853eac01e324'] + images: + - public.ecr.aws/karpenter/controller:1.2.0@sha256:24b8fe57f02b70fc4ab3cd6d5aa0d73a6f3d0c62ca5d23d7ffc8853eac01e324 - version: 1.0.5 - kube: ['1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['v0.37.0 introduces a readiness condition on the EC2NodeClass, - requiring a CRD upgrade; follow the upstream upgrade guide.', 'v1.0.5 is - a patch release primarily with a bug fix: migration controllers are enabled - when webhooks are enabled.'] - features: ['v0.37.0: Ability to select instances by EBS Maximum Bandwidth.', - 'v0.37.0: Adds nodepool label to the karpenter_interruption_actions_performed - metric.', 'v0.37.0: Adds extra fields to the Bottlerocket Kubernetes configuration.'] - breaking_changes: ['v0.37.0: EC2NodeClass gains a readiness condition, which - requires upgrading CRDs as part of the upgrade.'] + kube: + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - v0.37.0 introduces a readiness condition on the EC2NodeClass, requiring a + CRD upgrade; follow the upstream upgrade guide. + - 'v1.0.5 is a patch release primarily with a bug fix: migration controllers + are enabled when webhooks are enabled.' + features: + - 'v0.37.0: Ability to select instances by EBS Maximum Bandwidth.' + - 'v0.37.0: Adds nodepool label to the karpenter_interruption_actions_performed + metric.' + - 'v0.37.0: Adds extra fields to the Bottlerocket Kubernetes configuration.' + breaking_changes: + - 'v0.37.0: EC2NodeClass gains a readiness condition, which requires upgrading + CRDs as part of the upgrade.' chart_version: 1.0.5 - images: ['public.ecr.aws/karpenter/controller:1.0.5@sha256:f2df98735b232b143d37f0c6819a6cae2be4740e3c8b38297bceb365cf3f668b'] + images: + - public.ecr.aws/karpenter/controller:1.0.5@sha256:f2df98735b232b143d37f0c6819a6cae2be4740e3c8b38297bceb365cf3f668b - version: 0.37.0 - kube: ['1.30'] + kube: + - '1.30' requirements: [] incompatibilities: [] summary: @@ -19074,67 +23701,93 @@ addons: \ chart** for your target controller.\n\n> You didn\u2019t include the intermediate\ \ v0.35.x/v0.36.x Helm changelog text, so double-check Helm values diffs for\ \ those versions as well when you run the upgrade." - chart_updates: ['v0.37.0: Adds a readiness condition to `EC2NodeClass` (CRD - update required).', 'v0.37.0: Chart bug fix for ServiceMonitor indentation - (Prometheus Operator users should validate rendered manifests).', 'v0.37.0: - Chart change to avoid duplicating AH config in the rendered release (verify - related values/templating in your environment).', 'v0.34.0: Release includes - fixes related to Helm chart generation issues present in v0.33.0 (mostly - historical but emphasizes using the correct chart/version).'] - features: ['`build_info` Prometheus metric added (version/sha/golang_version - labels) to help with observability and troubleshooting.', Support for mounted - instance-store ephemeral storage (useful for workloads needing local ephemeral - disks)., Ability to select instance types by **EBS maximum bandwidth** (more - precise performance-based scheduling)., Interruption action metric now includes - a **nodepool label** (better attribution of interruption handling)., Additional - Bottlerocket Kubernetes configuration fields supported (more flexibility - for Bottlerocket nodes).] - breaking_changes: [v0.37.0 requires a **CRD upgrade** because `EC2NodeClass` - gains a **readiness condition**; upgrading the controller without updating - CRDs can break reconciliation or leave resources in an unexpected state., - 'Release notes mention a **BREAKING CHANGE: Refactor NodeClass controller** - (internal behavior around NodeClass reconciliation may change; validate - NodeClass/NodePool lifecycle in a staging cluster and watch logs/events - after upgrade).'] + chart_updates: + - 'v0.37.0: Adds a readiness condition to `EC2NodeClass` (CRD update required).' + - 'v0.37.0: Chart bug fix for ServiceMonitor indentation (Prometheus Operator + users should validate rendered manifests).' + - 'v0.37.0: Chart change to avoid duplicating AH config in the rendered release + (verify related values/templating in your environment).' + - 'v0.34.0: Release includes fixes related to Helm chart generation issues present + in v0.33.0 (mostly historical but emphasizes using the correct chart/version).' + features: + - '`build_info` Prometheus metric added (version/sha/golang_version labels) + to help with observability and troubleshooting.' + - Support for mounted instance-store ephemeral storage (useful for workloads + needing local ephemeral disks). + - Ability to select instance types by **EBS maximum bandwidth** (more precise + performance-based scheduling). + - Interruption action metric now includes a **nodepool label** (better attribution + of interruption handling). + - Additional Bottlerocket Kubernetes configuration fields supported (more flexibility + for Bottlerocket nodes). + breaking_changes: + - v0.37.0 requires a **CRD upgrade** because `EC2NodeClass` gains a **readiness + condition**; upgrading the controller without updating CRDs can break reconciliation + or leave resources in an unexpected state. + - 'Release notes mention a **BREAKING CHANGE: Refactor NodeClass controller** + (internal behavior around NodeClass reconciliation may change; validate NodeClass/NodePool + lifecycle in a staging cluster and watch logs/events after upgrade).' chart_version: 0.37.0 - images: ['public.ecr.aws/karpenter/controller:0.37.0@sha256:157f478f5db1fe999f5e2d27badcc742bf51cc470508b3cebe78224d0947674f'] + images: + - public.ecr.aws/karpenter/controller:0.37.0@sha256:157f478f5db1fe999f5e2d27badcc742bf51cc470508b3cebe78224d0947674f - version: 0.34.0 - kube: ['1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Introduced container-level default `securityContext` (previously - pod-level), which is a potential breaking change for how the controller - pod runs/PSA compliance is handled.', Helm chart generation fixes were made - after v0.33.0 (chart packaging/build pipeline reliability improvements)., - 'RBAC tightened: removed `create node` permission from the controller ClusterRole; - additional scoping around launch template access and list calls tagged with - `EC2NodeClass`.'] - features: [Mounted instance-store (ephemeral) storage is now supported for nodes - that have instance-store volumes., 'A new `build_info` Prometheus metric - is added that exposes version, git SHA, and Go version labels for easier - observability and debugging.'] - breaking_changes: ['Default `securityContext` moved from the Pod spec to the - container spec, which can affect pod security admission/override behavior - and may require updating custom manifests/Helm values if you were relying - on the old placement.'] + kube: + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Introduced container-level default `securityContext` (previously pod-level), + which is a potential breaking change for how the controller pod runs/PSA compliance + is handled. + - Helm chart generation fixes were made after v0.33.0 (chart packaging/build + pipeline reliability improvements). + - 'RBAC tightened: removed `create node` permission from the controller ClusterRole; + additional scoping around launch template access and list calls tagged with + `EC2NodeClass`.' + features: + - Mounted instance-store (ephemeral) storage is now supported for nodes that + have instance-store volumes. + - A new `build_info` Prometheus metric is added that exposes version, git SHA, + and Go version labels for easier observability and debugging. + breaking_changes: + - Default `securityContext` moved from the Pod spec to the container spec, which + can affect pod security admission/override behavior and may require updating + custom manifests/Helm values if you were relying on the old placement. chart_version: 0.34.0 images: [] - version: 0.31.0 - kube: ['1.28'] + kube: + - '1.28' requirements: [] incompatibilities: [] summary: null chart_version: 0.31.0 images: [] - version: 0.28.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 0.25.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null @@ -19146,96 +23799,150 @@ addons: eolApiSlug: keda versions: - version: 2.20.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 2.20.0 - version: 2.19.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 2.19.0 - version: 2.18.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 2.18.0 eolAt: '2026-06-01' - version: 2.17.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null chart_version: 2.17.0 eolAt: '2026-02-02' - version: 2.16.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null chart_version: 2.16.0 eolAt: '2025-10-08' - version: 2.15.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: null chart_version: 2.15.0 eolAt: '2025-04-07' - version: 2.14.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 2.14.2 eolAt: '2024-11-07' - version: 2.13.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 2.13.1 eolAt: '2024-08-01' - version: 2.12.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: null chart_version: 2.12.0 eolAt: '2024-04-25' - version: 2.11.0 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null chart_version: 2.11.0 eolAt: '2024-01-18' - version: 2.10.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 2.10.1 eolAt: '2023-09-28' - version: 2.9.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 2.9.0 eolAt: '2023-06-22' - version: 2.8.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null chart_version: 2.8.1 eolAt: '2023-03-09' - version: 2.7.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null @@ -19250,46 +23957,94 @@ addons: chart_changelog_url: https://raw.githubusercontent.com/prometheus-community/helm-charts/refs/heads/main/charts/kube-prometheus-stack/UPGRADE.md versions: - version: 90.0.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Adds secret-based auth support for control-plane ServiceMonitors - (new capability in kube-prometheus-stack templates/values)., Grafana subchart - was updated to v13.2.1 in 89.2.2 (already in your starting version).] - features: ['Secret-based authentication can now be configured for the control-plane - ServiceMonitors, enabling scraping secured endpoints using credentials stored - in Kubernetes Secrets.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Adds secret-based auth support for control-plane ServiceMonitors (new capability + in kube-prometheus-stack templates/values). + - Grafana subchart was updated to v13.2.1 in 89.2.2 (already in your starting + version). + features: + - Secret-based authentication can now be configured for the control-plane ServiceMonitors, + enabling scraping secured endpoints using credentials stored in Kubernetes + Secrets. breaking_changes: [] chart_version: 90.0.0 - images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', - 'quay.io/kiwigrid/k8s-sidecar:2.11.2', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.1-distroless + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 + - quay.io/kiwigrid/k8s-sidecar:2.11.2 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 89.2.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Grafana dependency updated to v13.2.1 in kube-prometheus-stack - 89.2.2., kube-prometheus-stack 89.1.0 includes non-major dependency updates - (unspecified components).] - features: [Updated bundled Grafana Helm chart/dependency to v13.2.1 (likely - includes bugfixes/minor improvements from Grafana chart)., Refreshed several - non-major dependencies in 89.1.0 (patch/minor bumps).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Grafana dependency updated to v13.2.1 in kube-prometheus-stack 89.2.2. + - kube-prometheus-stack 89.1.0 includes non-major dependency updates (unspecified + components). + features: + - Updated bundled Grafana Helm chart/dependency to v13.2.1 (likely includes + bugfixes/minor improvements from Grafana chart). + - Refreshed several non-major dependencies in 89.1.0 (patch/minor bumps). breaking_changes: [] chart_version: 89.2.2 - images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', - 'quay.io/kiwigrid/k8s-sidecar:2.11.2', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.1-distroless + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 + - quay.io/kiwigrid/k8s-sidecar:2.11.2 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 89.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19302,79 +24057,151 @@ addons: the timeout fields you intend to set). ' - chart_updates: ['89.1.0: Bumps kube-prometheus-stack chart dependencies with - non-major updates (Renovate). No other chart-level changes mentioned in - the provided notes.', '88.6.0: Adds support for configuring HTTPRoute timeouts - (Gateway API HTTPRoute).'] - features: [HTTPRoute timeout support (useful if exposing components via Gateway - API and you need request/response timeout tuning).] + chart_updates: + - '89.1.0: Bumps kube-prometheus-stack chart dependencies with non-major updates + (Renovate). No other chart-level changes mentioned in the provided notes.' + - '88.6.0: Adds support for configuring HTTPRoute timeouts (Gateway API HTTPRoute).' + features: + - HTTPRoute timeout support (useful if exposing components via Gateway API and + you need request/response timeout tuning). breaking_changes: [] chart_version: 89.1.0 - images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', - 'quay.io/kiwigrid/k8s-sidecar:2.10.3', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.1-distroless + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 + - quay.io/kiwigrid/k8s-sidecar:2.10.3 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 88.6.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Adds support for configuring HTTPRoute timeout in kube-prometheus-stack - (Gateway API HTTPRoute) via chart values/templates.] - features: ['HTTPRoute timeout support: you can now set timeouts on Gateway API - HTTPRoute resources managed/rendered by the chart, improving control over - request/response handling for routed traffic (e.g., to Grafana/Prometheus - endpoints behind a Gateway).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Adds support for configuring HTTPRoute timeout in kube-prometheus-stack (Gateway + API HTTPRoute) via chart values/templates. + features: + - 'HTTPRoute timeout support: you can now set timeouts on Gateway API HTTPRoute + resources managed/rendered by the chart, improving control over request/response + handling for routed traffic (e.g., to Grafana/Prometheus endpoints behind + a Gateway).' breaking_changes: [] chart_version: 88.6.0 - images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.7', - 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.7 + - quay.io/kiwigrid/k8s-sidecar:2.10.1 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 88.5.4 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped kube-state-metrics subchart/release to **v8.4.0** (as - of kube-prometheus-stack 88.5.0)., Bumped Grafana subchart/release to **v12.11.2** - (as of kube-prometheus-stack 88.5.4).] - features: [kube-state-metrics dependency update to v8.4.0 (may include new/changed - metrics depending on your KSM configuration)., Grafana dependency update - to v12.11.2 (brings Grafana upstream fixes/changes).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped kube-state-metrics subchart/release to **v8.4.0** (as of kube-prometheus-stack + 88.5.0). + - Bumped Grafana subchart/release to **v12.11.2** (as of kube-prometheus-stack + 88.5.4). + features: + - kube-state-metrics dependency update to v8.4.0 (may include new/changed metrics + depending on your KSM configuration). + - Grafana dependency update to v12.11.2 (brings Grafana upstream fixes/changes). breaking_changes: [] chart_version: 88.5.4 - images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.7', - 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.7 + - quay.io/kiwigrid/k8s-sidecar:2.10.1 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 88.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Supports TLS-aware `externalUrl` generation/handling for the - stack (per chart change in PR #7121).', 'Bumps the bundled `kube-state-metrics` - Helm dependency release to v8.4.0 (PR #7199).'] - features: ['Improved handling of `externalUrl` so it can work correctly when - TLS is involved (e.g., producing/accepting an https external URL in common - TLS-terminated setups).', 'Updated kube-state-metrics subchart to v8.4.0, - which may bring new/updated metrics and fixes from kube-state-metrics.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Supports TLS-aware `externalUrl` generation/handling for the stack (per chart + change in PR #7121).' + - 'Bumps the bundled `kube-state-metrics` Helm dependency release to v8.4.0 + (PR #7199).' + features: + - Improved handling of `externalUrl` so it can work correctly when TLS is involved + (e.g., producing/accepting an https external URL in common TLS-terminated + setups). + - Updated kube-state-metrics subchart to v8.4.0, which may bring new/updated + metrics and fixes from kube-state-metrics. breaking_changes: [] chart_version: 88.5.0 - images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', - 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] + images: + - docker.io/grafana/grafana:13.2.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.1 + - quay.io/prometheus-operator/prometheus-operator:v0.93.1 + - quay.io/prometheus/alertmanager:v0.34.0 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.14.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 - version: 88.3.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19384,269 +24211,526 @@ addons: by the chart. ' - chart_updates: ['`externalUrl` handling was updated to support TLS configuration - (PR #7121).'] - features: ['`externalUrl` can now be configured to support TLS (e.g., HTTPS-related - settings) for exposed component URLs.'] + chart_updates: + - '`externalUrl` handling was updated to support TLS configuration (PR #7121).' + features: + - '`externalUrl` can now be configured to support TLS (e.g., HTTPS-related settings) + for exposed component URLs.' breaking_changes: [] chart_version: 88.3.0 - images: ['docker.io/grafana/grafana:13.1.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.1 + - quay.io/prometheus-operator/prometheus-operator:v0.93.0 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.2-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 88.2.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps the kube-state-metrics subchart dependency from v8.1.3 - (in 88.1.3) to v8.2.0 (in 88.2.0).] - features: [Includes kube-state-metrics v8.2.0 via subchart update.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps the kube-state-metrics subchart dependency from v8.1.3 (in 88.1.3) to + v8.2.0 (in 88.2.0). + features: + - Includes kube-state-metrics v8.2.0 via subchart update. breaking_changes: [] chart_version: 88.2.0 - images: ['docker.io/grafana/grafana:13.1.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.1 + - quay.io/prometheus-operator/prometheus-operator:v0.93.0 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.2-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 88.1.3 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped the kube-state-metrics subchart/dependency to v8.1.3 - (via renovate)., 88.0.1 contained only routine non-major dependency updates; - no functional chart changes called out beyond dependency bumps.] - features: [Updated bundled kube-state-metrics chart to v8.1.3 (may include incremental - fixes/metrics changes from kube-state-metrics upstream).] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped the kube-state-metrics subchart/dependency to v8.1.3 (via renovate). + - 88.0.1 contained only routine non-major dependency updates; no functional + chart changes called out beyond dependency bumps. + features: + - Updated bundled kube-state-metrics chart to v8.1.3 (may include incremental + fixes/metrics changes from kube-state-metrics upstream). breaking_changes: [] chart_version: 88.1.3 - images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.0 + - quay.io/prometheus-operator/prometheus-operator:v0.93.0 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.2-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 88.0.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['88.0.1: Bumped kube-prometheus-stack chart dependencies with - non-major updates (details in PR #7153).', '87.21.0: Updated bundled Grafana - Helm release to v12.10.0 (PR #7139).', '87.21.0: CI-only change updating - docker/login-action to v4.5.2 (PR #7138); no runtime impact.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '88.0.1: Bumped kube-prometheus-stack chart dependencies with non-major updates + (details in PR #7153).' + - '87.21.0: Updated bundled Grafana Helm release to v12.10.0 (PR #7139).' + - '87.21.0: CI-only change updating docker/login-action to v4.5.2 (PR #7138); + no runtime impact.' features: [] breaking_changes: [] chart_version: 88.0.1 - images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.0 + - quay.io/prometheus-operator/prometheus-operator:v0.93.0 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.2-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.21.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['CI-only change: updated `docker/login-action` used in the chart - repo workflows to v4.5.2 (no runtime impact).', Updated the Grafana subchart - dependency to `grafana` Helm chart v12.10.0 (affects the Grafana component - deployed by kube-prometheus-stack if enabled).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'CI-only change: updated `docker/login-action` used in the chart repo workflows + to v4.5.2 (no runtime impact).' + - Updated the Grafana subchart dependency to `grafana` Helm chart v12.10.0 (affects + the Grafana component deployed by kube-prometheus-stack if enabled). features: [] breaking_changes: [] chart_version: 87.21.0 - images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.10.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.20.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps kube-prometheus-stack chart dependencies with non-major - (patch/minor) updates (via renovate). No functional chart behavior changes - are called out in the release notes beyond dependency refresh.] - features: [Dependency refresh for the kube-prometheus-stack chart (non-major - updates).] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps kube-prometheus-stack chart dependencies with non-major (patch/minor) + updates (via renovate). No functional chart behavior changes are called out + in the release notes beyond dependency refresh. + features: + - Dependency refresh for the kube-prometheus-stack chart (non-major updates). breaking_changes: [] chart_version: 87.20.0 - images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', - 'quay.io/kiwigrid/k8s-sidecar:2.9.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 + - quay.io/kiwigrid/k8s-sidecar:2.9.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Grafana subchart/container version updated to **v12.8.0** (via - chart dependency update)., Added scraping of **kube-scheduler resource metrics** - (new/updated ServiceMonitor/metrics config for kube-scheduler).] - features: ['kube-prometheus-stack now scrapes kube-scheduler *resource* metrics, - improving visibility into scheduler performance and resource usage.', 'Grafana - is bumped to v12.8.0, bringing the latest Grafana fixes/features included - by that version.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Grafana subchart/container version updated to **v12.8.0** (via chart dependency + update). + - Added scraping of **kube-scheduler resource metrics** (new/updated ServiceMonitor/metrics + config for kube-scheduler). + features: + - kube-prometheus-stack now scrapes kube-scheduler *resource* metrics, improving + visibility into scheduler performance and resource usage. + - Grafana is bumped to v12.8.0, bringing the latest Grafana fixes/features included + by that version. breaking_changes: [] chart_version: 87.19.0 - images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.17.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Adds scraping of kube-scheduler resource metrics (new/updated - ServiceMonitor/metrics config for kube-scheduler).] - features: ['Kube-prometheus-stack now scrapes kube-scheduler resource metrics, - improving visibility into scheduler performance and resource usage.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Adds scraping of kube-scheduler resource metrics (new/updated ServiceMonitor/metrics + config for kube-scheduler). + features: + - Kube-prometheus-stack now scrapes kube-scheduler resource metrics, improving + visibility into scheduler performance and resource usage. breaking_changes: [] chart_version: 87.17.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.16.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps kube-state-metrics chart dependency to v7.8.1 (in 87.15.1)., - Bumps prometheus-node-exporter chart dependency to v4.56.1 (in 87.16.1).] - features: ['Updated embedded dependencies: kube-state-metrics to v7.8.1 and - prometheus-node-exporter to v4.56.1.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps kube-state-metrics chart dependency to v7.8.1 (in 87.15.1). + - Bumps prometheus-node-exporter chart dependency to v4.56.1 (in 87.16.1). + features: + - 'Updated embedded dependencies: kube-state-metrics to v7.8.1 and prometheus-node-exporter + to v4.56.1.' breaking_changes: [] chart_version: 87.16.1 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.15.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Bumped the bundled/managed kube-state-metrics Helm dependency - from v7.8.0 to v7.8.1 (via prometheus-community/helm-charts PR #7102).'] - features: ['Includes kube-state-metrics v7.8.1, which contains minor fixes/updates - compared to v7.8.0.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Bumped the bundled/managed kube-state-metrics Helm dependency from v7.8.0 + to v7.8.1 (via prometheus-community/helm-charts PR #7102).' + features: + - Includes kube-state-metrics v7.8.1, which contains minor fixes/updates compared + to v7.8.0. breaking_changes: [] chart_version: 87.15.1 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.0-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.12.0-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.14.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['PrometheusRule: etcd alert/runbook annotations updated (runbook_url).', - 'Dependency update: kube-state-metrics chart/release bumped to v7.8.0.'] - features: [Updated bundled kube-state-metrics dependency to v7.8.0 (may include - new metrics/labels/fixes from that component).] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'PrometheusRule: etcd alert/runbook annotations updated (runbook_url).' + - 'Dependency update: kube-state-metrics chart/release bumped to v7.8.0.' + features: + - Updated bundled kube-state-metrics dependency to v7.8.0 (may include new metrics/labels/fixes + from that component). breaking_changes: [] chart_version: 87.14.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.13.1-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.12.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Bumped Alertmanager image tag to `quay.io/prometheus/alertmanager:v0.33.1` - (as of kube-prometheus-stack 87.10.1).', Updated the etcd `PrometheusRule` - annotation `runbook_url` (as of kube-prometheus-stack 87.12.1).] - features: [Updated/standardized etcd alert runbook URL annotation in PrometheusRule - manifests.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped Alertmanager image tag to `quay.io/prometheus/alertmanager:v0.33.1` + (as of kube-prometheus-stack 87.10.1). + - Updated the etcd `PrometheusRule` annotation `runbook_url` (as of kube-prometheus-stack + 87.12.1). + features: + - Updated/standardized etcd alert runbook URL annotation in PrometheusRule manifests. breaking_changes: [] chart_version: 87.12.1 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.13.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.10.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['CI maintenance: docker/login-action bumped to v4.4.0.', Dependency - non-major updates in kube-prometheus-stack chart (details not listed in - provided notes)., Alertmanager image tag updated to quay.io/prometheus/alertmanager - v0.33.1.] - features: [Bumps bundled Alertmanager container image to v0.33.1.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'CI maintenance: docker/login-action bumped to v4.4.0.' + - Dependency non-major updates in kube-prometheus-stack chart (details not listed + in provided notes). + - Alertmanager image tag updated to quay.io/prometheus/alertmanager v0.33.1. + features: + - Bumps bundled Alertmanager container image to v0.33.1. breaking_changes: [] chart_version: 87.10.1 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.13.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.6.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['CI pipeline maintenance: updated `docker/login-action` to v4.4.0 - (no runtime impact).', Chart dependencies received non-major updates via - Renovate (may bump subchart patch/minor versions).] - features: [No user-facing features called out; this release is primarily dependency/CI - maintenance.] - breaking_changes: [No breaking changes mentioned in the provided notes.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'CI pipeline maintenance: updated `docker/login-action` to v4.4.0 (no runtime + impact).' + - Chart dependencies received non-major updates via Renovate (may bump subchart + patch/minor versions). + features: + - No user-facing features called out; this release is primarily dependency/CI + maintenance. + breaking_changes: + - No breaking changes mentioned in the provided notes. chart_version: 87.6.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.1 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.13.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Containers and initContainers are now rendered with `tpl`, - allowing templating inside those values.', 'Prometheus container image tag - updated to `quay.io/prometheus/prometheus:v3.13.0`.'] - features: ['Chart now supports Helm templating (`tpl`) within `containers`/`initContainers` - blocks, enabling dynamic values (e.g., names, env vars) from `.Values`.'] - breaking_changes: ['If you previously had literal strings containing `{{ ... - }}` in `containers`/`initContainers`, they may now be evaluated as templates; - escape them or adjust values to avoid unintended rendering.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Containers and initContainers are now rendered with `tpl`, allowing templating + inside those values. + - Prometheus container image tag updated to `quay.io/prometheus/prometheus:v3.13.0`. + features: + - Chart now supports Helm templating (`tpl`) within `containers`/`initContainers` + blocks, enabling dynamic values (e.g., names, env vars) from `.Values`. + breaking_changes: + - If you previously had literal strings containing `{{ ... }}` in `containers`/`initContainers`, + they may now be evaluated as templates; escape them or adjust values to avoid + unintended rendering. chart_version: 87.5.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.1 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.13.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.3.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19657,161 +24741,303 @@ addons: and `initContainers` fields using `tpl`, meaning strings in those sections may now be evaluated as Helm templates. Re-check any custom values you set under these fields for unintended template rendering or escaping needs.' - chart_updates: ['Templates updated to render `containers` and `initContainers` - using Helm `tpl` (PR #7040).', '87.2.1 included routine non-major dependency - updates via Renovate (PR #7035).'] - features: ['You can now use templating in values that populate `containers` - and `initContainers`, enabling dynamic references to other values, release - name/namespace, etc. when defining extra containers.'] - breaking_changes: ['Potential breaking/behavioral change: values under `containers`/`initContainers` - that previously were treated as literal strings may now be interpreted as - Helm templates via `tpl`, which can change rendered manifests or fail rendering - if the content contains `{{ ... }}` unintentionally.'] + chart_updates: + - 'Templates updated to render `containers` and `initContainers` using Helm + `tpl` (PR #7040).' + - '87.2.1 included routine non-major dependency updates via Renovate (PR #7035).' + features: + - You can now use templating in values that populate `containers` and `initContainers`, + enabling dynamic references to other values, release name/namespace, etc. + when defining extra containers. + breaking_changes: + - 'Potential breaking/behavioral change: values under `containers`/`initContainers` + that previously were treated as literal strings may now be interpreted as + Helm templates via `tpl`, which can change rendered manifests or fail rendering + if the content contains `{{ ... }}` unintentionally.' chart_version: 87.3.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.0 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.2.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Adds an "agent" skill to support/promote automated Prometheus - Operator version bumps., Updates kube-prometheus-stack chart dependencies - with non-major (patch/minor) bumps (performed in both 87.1.0 and 87.2.1).] - features: ["Routine chart maintenance: adds support metadata/automation (\u201C\ - agent skill\u201D) around Prometheus Operator bumps.", Dependency refreshes - for subcharts/components (non-major updates).] + chart_updates: + - Adds an "agent" skill to support/promote automated Prometheus Operator version + bumps. + - Updates kube-prometheus-stack chart dependencies with non-major (patch/minor) + bumps (performed in both 87.1.0 and 87.2.1). + features: + - "Routine chart maintenance: adds support metadata/automation (\u201Cagent\ + \ skill\u201D) around Prometheus Operator bumps." + - Dependency refreshes for subcharts/components (non-major updates). breaking_changes: [] chart_version: 87.2.1 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.0 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.1.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Adds an ''agent skill'' to help automate/streamline Prometheus - Operator version bumps (per PR #7013).', 'Updates kube-prometheus-stack - chart dependencies with non-major (patch/minor) updates (per PR #7020).'] - features: [Improved support for handling Prometheus Operator version bumps via - a newly added 'agent skill' in the chart tooling/workflow.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Adds an ''agent skill'' to help automate/streamline Prometheus Operator version + bumps (per PR #7013).' + - 'Updates kube-prometheus-stack chart dependencies with non-major (patch/minor) + updates (per PR #7020).' + features: + - Improved support for handling Prometheus Operator version bumps via a newly + added 'agent skill' in the chart tooling/workflow. breaking_changes: [] chart_version: 87.1.0 - images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.1.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.8.0 + - quay.io/prometheus-operator/prometheus-operator:v0.92.0 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 87.0.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Both 86.3.2 and 87.0.1 are chart-only releases that primarily - bump kube-prometheus-stack chart dependencies via Renovate (non-major updates)., - No explicit template/CRD/value changes are called out in the provided notes; - treat this as a low-risk patch-level chart maintenance change despite the - version jump crossing a major boundary in the chart number.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Both 86.3.2 and 87.0.1 are chart-only releases that primarily bump kube-prometheus-stack + chart dependencies via Renovate (non-major updates). + - No explicit template/CRD/value changes are called out in the provided notes; + treat this as a low-risk patch-level chart maintenance change despite the + version jump crossing a major boundary in the chart number. features: [] breaking_changes: [] chart_version: 87.0.1 - images: ['docker.io/grafana/grafana:13.0.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.7.4', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.0.2 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.7.4 + - quay.io/prometheus-operator/prometheus-operator:v0.92.0 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 86.3.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Both 86.2.0 and 86.3.2 releases only mention \u201CUpdate kube-prometheus-stack\ - \ dependency non-major updates\u201D, indicating dependency patch/minor\ - \ bumps within the chart; no explicit template/CRD/value changes are called\ - \ out in the provided notes."] - features: [No new user-facing features are described in the provided release - notes; changes appear limited to dependency non-major updates.] - breaking_changes: ["No breaking changes are mentioned in the provided release\ - \ notes; however, dependency bumps can still introduce behavioral changes\u2014\ - verify component image/app versions after the upgrade."] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Both 86.2.0 and 86.3.2 releases only mention \u201CUpdate kube-prometheus-stack\ + \ dependency non-major updates\u201D, indicating dependency patch/minor bumps\ + \ within the chart; no explicit template/CRD/value changes are called out\ + \ in the provided notes." + features: + - No new user-facing features are described in the provided release notes; changes + appear limited to dependency non-major updates. + breaking_changes: + - "No breaking changes are mentioned in the provided release notes; however,\ + \ dependency bumps can still introduce behavioral changes\u2014verify component\ + \ image/app versions after the upgrade." chart_version: 86.3.2 - images: ['docker.io/grafana/grafana:13.0.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', - 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] + images: + - docker.io/grafana/grafana:13.0.2 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.91.0 + - quay.io/prometheus/alertmanager:v0.33.0 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - version: 86.2.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped kube-prometheus-stack chart dependencies with non-major - updates (Renovate automation). No explicit template/value changes called - out in the provided release notes.] - features: [Dependency refresh (non-major) for the kube-prometheus-stack chart - and/or its subcharts/components; expect minor fixes and small improvements - coming from upstream dependencies.] - breaking_changes: [None mentioned in the provided 86.2.0/86.1.0 release notes; - still review subchart/component release notes for hidden breaking changes.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped kube-prometheus-stack chart dependencies with non-major updates (Renovate + automation). No explicit template/value changes called out in the provided + release notes. + features: + - Dependency refresh (non-major) for the kube-prometheus-stack chart and/or + its subcharts/components; expect minor fixes and small improvements coming + from upstream dependencies. + breaking_changes: + - None mentioned in the provided 86.2.0/86.1.0 release notes; still review subchart/component + release notes for hidden breaking changes. chart_version: 86.2.0 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', - 'quay.io/prometheus/alertmanager:v0.32.2', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.91.0 + - quay.io/prometheus/alertmanager:v0.32.2 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 - version: 86.1.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps kube-prometheus-stack dependency set to latest non-major - versions (Renovate-driven). No explicit values changes called out in the - release notes; expect only patch/minor dependency updates within the chart., - (Context from prior release in range) 86.0.0 bumped the prometheus-operator - dependency to v0.91.0; 86.1.0 builds on that with non-major dependency refreshes.] - features: ['Routine dependency refresh (non-major) which may include minor fixes/updates - in subcharts (e.g., Grafana, Prometheus, exporters) without introducing - new top-level features called out.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps kube-prometheus-stack dependency set to latest non-major versions (Renovate-driven). + No explicit values changes called out in the release notes; expect only patch/minor + dependency updates within the chart. + - (Context from prior release in range) 86.0.0 bumped the prometheus-operator + dependency to v0.91.0; 86.1.0 builds on that with non-major dependency refreshes. + features: + - Routine dependency refresh (non-major) which may include minor fixes/updates + in subcharts (e.g., Grafana, Prometheus, exporters) without introducing new + top-level features called out. breaking_changes: [] chart_version: 86.1.0 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.91.0 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.12.0-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 - version: 86.0.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped embedded/managed Prometheus Operator (prometheus-operator) - to v0.91.0 (via chart dependency/version update).] - features: [Uses Prometheus Operator v0.91.0 (may include upstream Operator fixes - and enhancements).] - breaking_changes: [Potential breaking changes may come from Prometheus Operator - v0.91.0; review Operator v0.91.0 release notes and CRD compatibility before - upgrading.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped embedded/managed Prometheus Operator (prometheus-operator) to v0.91.0 + (via chart dependency/version update). + features: + - Uses Prometheus Operator v0.91.0 (may include upstream Operator fixes and + enhancements). + breaking_changes: + - Potential breaking changes may come from Prometheus Operator v0.91.0; review + Operator v0.91.0 release notes and CRD compatibility before upgrading. chart_version: 86.0.0 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.91.0 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 - version: 85.4.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19822,125 +25048,243 @@ addons: PromQL-related options; if you manage the Prometheus Operator admission webhook via chart values, review the new options and decide whether to set them explicitly (otherwise defaults apply).' - chart_updates: ['Added admission webhook PromQL options (PR #6945).', 'Minor - documentation/comment grammar fix in 85.3.3 (PR #6940).'] - features: [Support for configuring PromQL-related options on the Prometheus - Operator admission webhook (new chart values/options).] + chart_updates: + - 'Added admission webhook PromQL options (PR #6945).' + - 'Minor documentation/comment grammar fix in 85.3.3 (PR #6940).' + features: + - Support for configuring PromQL-related options on the Prometheus Operator + admission webhook (new chart values/options). breaking_changes: [] chart_version: 85.4.0 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 - version: 85.3.3 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Fix comment grammar (no functional change)., Update kubernetes-mixin - digest to 1a2f5ad (brings updated dashboards/alerts/rules from kubernetes-mixin).] - features: [Updated Kubernetes monitoring mixin content (dashboards/recording - rules/alerts) via new kubernetes-mixin digest.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Fix comment grammar (no functional change). + - Update kubernetes-mixin digest to 1a2f5ad (brings updated dashboards/alerts/rules + from kubernetes-mixin). + features: + - Updated Kubernetes monitoring mixin content (dashboards/recording rules/alerts) + via new kubernetes-mixin digest. breaking_changes: [] chart_version: 85.3.3 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 - version: 85.2.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Updated the kubernetes-mixin (kubernetes-monitoring/kubernetes-mixin) - digest to `1a2f5ad` (rule/dashboards mixin refresh).] - features: ['Refreshed bundled Kubernetes mixin content (dashboards/rules/alerts) - to the kubernetes-mixin digest `1a2f5ad`, which may adjust metrics, labels, - and alerts to match upstream.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Updated the kubernetes-mixin (kubernetes-monitoring/kubernetes-mixin) digest + to `1a2f5ad` (rule/dashboards mixin refresh). + features: + - Refreshed bundled Kubernetes mixin content (dashboards/rules/alerts) to the + kubernetes-mixin digest `1a2f5ad`, which may adjust metrics, labels, and alerts + to match upstream. breaking_changes: [] chart_version: 85.2.0 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 85.1.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Grafana subchart/container release updated to **v12.3.3** (via - renovate) in kube-prometheus-stack **85.1.1**., 'Fix/cleanup: avoid duplicate - **Thanos image** key in values/templates in kube-prometheus-stack **85.0.1** - (prevents conflicting image settings).', 'Misc/CI only: .codespellrc ignore - list updated (no runtime impact).'] - features: [Grafana version bump to v12.3.3 (brings upstream Grafana fixes and - improvements; behavior changes depend on Grafana release notes).] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Grafana subchart/container release updated to **v12.3.3** (via renovate) in + kube-prometheus-stack **85.1.1**. + - 'Fix/cleanup: avoid duplicate **Thanos image** key in values/templates in + kube-prometheus-stack **85.0.1** (prevents conflicting image settings).' + - 'Misc/CI only: .codespellrc ignore list updated (no runtime impact).' + features: + - Grafana version bump to v12.3.3 (brings upstream Grafana fixes and improvements; + behavior changes depend on Grafana release notes). breaking_changes: [] chart_version: 85.1.1 - images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1-security-01 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.3 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 85.0.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Fix: avoid duplicate `Thanos` image key in rendered manifests - (85.0.1).', 'Maintenance: update `.codespellrc` in CI (no runtime impact).', - '84.5.0: dependency non-major updates via Renovate (internal dependency bumps).'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Fix: avoid duplicate `Thanos` image key in rendered manifests (85.0.1).' + - 'Maintenance: update `.codespellrc` in CI (no runtime impact).' + - '84.5.0: dependency non-major updates via Renovate (internal dependency bumps).' features: [] breaking_changes: [] chart_version: 85.0.1 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', - 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.1 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1-distroless + - quay.io/prometheus/prometheus:v3.11.3-distroless + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 84.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps kube-prometheus-stack chart dependencies with non-major - updates (Renovate-driven)., Previous patch (84.4.0) updated the Grafana - subchart to v12.3.0; 84.5.0 follows with additional dependency patch/minor - bumps.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps kube-prometheus-stack chart dependencies with non-major updates (Renovate-driven). + - Previous patch (84.4.0) updated the Grafana subchart to v12.3.0; 84.5.0 follows + with additional dependency patch/minor bumps. features: [] breaking_changes: [] chart_version: 84.5.0 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.1 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.1 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 84.4.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped the Grafana subchart (Helm release) to **Grafana v12.3.0**.] - features: [Grafana dependency updated to v12.3.0 as part of the kube-prometheus-stack - chart release.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped the Grafana subchart (Helm release) to **Grafana v12.3.0**. + features: + - Grafana dependency updated to v12.3.0 as part of the kube-prometheus-stack + chart release. breaking_changes: [] chart_version: 84.4.0 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.1 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 84.3.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19950,25 +25294,43 @@ addons: \ setting this explicitly to avoid label mismatches.\n- **84.3.0:** No explicit\ \ Helm values changes called out in the provided notes; it is described as\ \ \u201Cdependency non-major updates\u201D." - chart_updates: ['84.1.0: Added support for `kubeApiServer.jobNameOverride` (chart - template change for the kube-apiserver scrape config).', '84.3.0: Bumped - kube-prometheus-stack chart dependencies with non-major updates (per Renovate - PR #6871).'] - features: ['Ability to override the kube-apiserver Prometheus job name via `kubeApiServer.jobNameOverride`, - which can help align job labels with existing alerting/dashboards or avoid - collisions.'] - breaking_changes: ["No breaking changes were indicated in the provided release\ - \ notes for 84.1.0 \u2192 84.3.0. However, dependency bumps (even non-major)\ - \ can still cause minor behavioral changes; validate alerts/dashboards and\ - \ scrape targets in a staging environment."] + chart_updates: + - '84.1.0: Added support for `kubeApiServer.jobNameOverride` (chart template + change for the kube-apiserver scrape config).' + - '84.3.0: Bumped kube-prometheus-stack chart dependencies with non-major updates + (per Renovate PR #6871).' + features: + - Ability to override the kube-apiserver Prometheus job name via `kubeApiServer.jobNameOverride`, + which can help align job labels with existing alerting/dashboards or avoid + collisions. + breaking_changes: + - "No breaking changes were indicated in the provided release notes for 84.1.0\ + \ \u2192 84.3.0. However, dependency bumps (even non-major) can still cause\ + \ minor behavioral changes; validate alerts/dashboards and scrape targets\ + \ in a staging environment." chart_version: 84.3.0 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.7.1 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 84.1.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -19977,20 +25339,36 @@ addons: - **Optional**: a new value/field was added for the API server scrape config: `kubeApiServer.jobNameOverride` (name inferred from the PR title). Use it only if you need to control the generated Prometheus job name for kube-apiserver.' - chart_updates: [Adds support for overriding the Prometheus scrape job name for - kube-apiserver via a new `jobNameOverride` setting.] - features: [New option to override the kube-apiserver scrape job name (useful - when you need the job label to match existing dashboards/alerts or to avoid - collisions).] + chart_updates: + - Adds support for overriding the Prometheus scrape job name for kube-apiserver + via a new `jobNameOverride` setting. + features: + - New option to override the kube-apiserver scrape job name (useful when you + need the job label to match existing dashboards/alerts or to avoid collisions). breaking_changes: [] chart_version: 84.1.0 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 84.0.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20001,40 +25379,74 @@ addons: schema before upgrading. ' - chart_updates: [Updated the bundled Grafana Helm dependency to **Grafana chart - v12**.] - features: ['Grafana is now deployed via the Grafana Helm chart v12, bringing - whatever new defaults/fixes that chart version includes.'] - breaking_changes: [Potential breaking changes may come from the **Grafana Helm - chart major version bump (v12)**; existing `values.yaml` overrides for Grafana - may no longer be valid or may change behavior. Validate your Grafana configuration - and run a dry-run/templating diff before applying.] + chart_updates: + - Updated the bundled Grafana Helm dependency to **Grafana chart v12**. + features: + - Grafana is now deployed via the Grafana Helm chart v12, bringing whatever + new defaults/fixes that chart version includes. + breaking_changes: + - Potential breaking changes may come from the **Grafana Helm chart major version + bump (v12)**; existing `values.yaml` overrides for Grafana may no longer be + valid or may change behavior. Validate your Grafana configuration and run + a dry-run/templating diff before applying. chart_version: 84.0.0 - images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:13.0.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 83.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Updated bundled kubernetes-mixin content to digest `afc9733` - (Prometheus rules, alerts, recording rules, and Grafana dashboards derived - from the mixin).'] - features: ['Refreshes the upstream kubernetes-mixin bundle, which may add/adjust - dashboards and Prometheus rules shipped with the chart.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Updated bundled kubernetes-mixin content to digest `afc9733` (Prometheus rules, + alerts, recording rules, and Grafana dashboards derived from the mixin). + features: + - Refreshes the upstream kubernetes-mixin bundle, which may add/adjust dashboards + and Prometheus rules shipped with the chart. breaking_changes: [] chart_version: 83.7.0 - images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.4.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 83.6.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20046,19 +25458,36 @@ addons: - If you enabled/used Alertmanager `sessionPersistence` introduced in `83.5.0`, ensure your values still match your ingress/service setup after upgrading (no new notes for `83.6.0`).' - chart_updates: ['Bumped the embedded `kube-prometheus` (prometheus-operator/kube-prometheus) - content digest to `ac9a509` (chart content refresh: manifests/dashboards/rules).'] - features: [Updated the bundled kube-prometheus assets (manifests/rules/dashboards) - to the upstream digest `ac9a509`.] + chart_updates: + - 'Bumped the embedded `kube-prometheus` (prometheus-operator/kube-prometheus) + content digest to `ac9a509` (chart content refresh: manifests/dashboards/rules).' + features: + - Updated the bundled kube-prometheus assets (manifests/rules/dashboards) to + the upstream digest `ac9a509`. breaking_changes: [] chart_version: 83.6.0 - images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.4.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 83.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20069,319 +25498,622 @@ addons: Service/ingress layer, review the new `alertmanager.sessionPersistence` (or similarly named) values introduced by the chart and enable/configure it to match your ingress/load balancer behavior.' - chart_updates: ['Added support for Alertmanager session persistence (stickiness) - in the chart (PR #6847).'] - features: ['Alertmanager can now be configured with session persistence, which - helps keep client sessions pinned to the same backend when behind a load - balancer/ingress.'] + chart_updates: + - 'Added support for Alertmanager session persistence (stickiness) in the chart + (PR #6847).' + features: + - Alertmanager can now be configured with session persistence, which helps keep + client sessions pinned to the same backend when behind a load balancer/ingress. breaking_changes: [] chart_version: 83.5.0 - images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.4.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 83.4.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Prometheus image tag updated: `quay.io/prometheus/prometheus` - -> `v3.11.2` (in kube-prometheus-stack chart 83.4.1).', (Context from start - version) 82.18.0 updated the `prometheus-node-exporter` subchart to `v4.53.0`.] - features: ['Prometheus upgraded to v3.11.2 via image tag bump, which may include - upstream Prometheus fixes/improvements.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Prometheus image tag updated: `quay.io/prometheus/prometheus` -> `v3.11.2` + (in kube-prometheus-stack chart 83.4.1).' + - (Context from start version) 82.18.0 updated the `prometheus-node-exporter` + subchart to `v4.53.0`. + features: + - Prometheus upgraded to v3.11.2 via image tag bump, which may include upstream + Prometheus fixes/improvements. breaking_changes: [] chart_version: 83.4.1 - images: ['docker.io/grafana/grafana:12.4.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', - 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', - 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', - 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.4.2 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 + - quay.io/kiwigrid/k8s-sidecar:2.6.0 + - quay.io/prometheus-operator/prometheus-operator:v0.90.1 + - quay.io/prometheus/alertmanager:v0.32.0 + - quay.io/prometheus/node-exporter:v1.11.1 + - quay.io/prometheus/prometheus:v3.11.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 82.18.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Prometheus Operator dependency bumped to v0.89.0 (chart 82.0.0)., - prometheus-node-exporter subchart updated to v4.53.0 (chart 82.18.0).] - features: ['Upgrades Prometheus Operator to 0.89.0, bringing its upstream fixes - and improvements into the stack.', 'Updates node-exporter chart to 4.53.0, - which may include new metrics/flags and bugfixes from that chart release.'] - breaking_changes: [No explicit breaking changes are mentioned in the provided - release notes; verify Prometheus Operator 0.89.0 and node-exporter 4.53.0 - upstream changelogs for any deprecations that could affect existing CRs/flags/values.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Prometheus Operator dependency bumped to v0.89.0 (chart 82.0.0). + - prometheus-node-exporter subchart updated to v4.53.0 (chart 82.18.0). + features: + - Upgrades Prometheus Operator to 0.89.0, bringing its upstream fixes and improvements + into the stack. + - Updates node-exporter chart to 4.53.0, which may include new metrics/flags + and bugfixes from that chart release. + breaking_changes: + - No explicit breaking changes are mentioned in the provided release notes; + verify Prometheus Operator 0.89.0 and node-exporter 4.53.0 upstream changelogs + for any deprecations that could affect existing CRs/flags/values. chart_version: 82.18.0 - images: ['docker.io/grafana/grafana:12.4.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', - 'quay.io/kiwigrid/k8s-sidecar:2.5.4', 'quay.io/prometheus-operator/prometheus-operator:v0.89.0', - 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.11.0', - 'quay.io/prometheus/prometheus:v3.11.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.4.2 + - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 + - quay.io/kiwigrid/k8s-sidecar:2.5.4 + - quay.io/prometheus-operator/prometheus-operator:v0.89.0 + - quay.io/prometheus/alertmanager:v0.31.1 + - quay.io/prometheus/node-exporter:v1.11.0 + - quay.io/prometheus/prometheus:v3.11.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 82.0.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps Prometheus Operator to **v0.89.0** (via chart 82.0.0)., - "Between 81.6.1 and 82.0.0 there are intermediate patch releases (81.6.2\u2026\ - 81.6.9) referenced by the compare link; review the full diff if you need\ - \ to account for any additional chart-level changes beyond the operator\ - \ bump."] - features: ['Updated Prometheus Operator to 0.89.0, which may include new CRD - fields/behavior and bug fixes from the operator project.'] - breaking_changes: ['Potential breaking changes may be introduced indirectly - by the Prometheus Operator 0.89.0 bump (e.g., CRD schema/validation changes). - Validate CRDs and reconcile behavior in a staging cluster before upgrading - in production.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps Prometheus Operator to **v0.89.0** (via chart 82.0.0). + - "Between 81.6.1 and 82.0.0 there are intermediate patch releases (81.6.2\u2026\ + 81.6.9) referenced by the compare link; review the full diff if you need to\ + \ account for any additional chart-level changes beyond the operator bump." + features: + - Updated Prometheus Operator to 0.89.0, which may include new CRD fields/behavior + and bug fixes from the operator project. + breaking_changes: + - Potential breaking changes may be introduced indirectly by the Prometheus + Operator 0.89.0 bump (e.g., CRD schema/validation changes). Validate CRDs + and reconcile behavior in a staging cluster before upgrading in production. chart_version: 82.0.0 - images: ['docker.io/grafana/grafana:12.3.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.7', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.89.0', - 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.3.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.7 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.89.0 + - quay.io/prometheus/alertmanager:v0.31.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.6.9 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Fix admission webhook DNS name rendering (affects how the webhook - Service/endpoint DNS name is templated/rendered)., Bump bundled Grafana - Helm release to v11.1.5., 81.6.1 includes various non-major dependency updates - via Renovate (unspecified individual components).] - features: [No new user-facing features noted; changes are primarily bugfix + - dependency updates., Grafana chart/app version update to v11.1.5 is included - in 81.6.9.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Fix admission webhook DNS name rendering (affects how the webhook Service/endpoint + DNS name is templated/rendered). + - Bump bundled Grafana Helm release to v11.1.5. + - 81.6.1 includes various non-major dependency updates via Renovate (unspecified + individual components). + features: + - No new user-facing features noted; changes are primarily bugfix + dependency + updates. + - Grafana chart/app version update to v11.1.5 is included in 81.6.9. breaking_changes: [] chart_version: 81.6.9 - images: ['docker.io/grafana/grafana:12.3.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.7', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', - 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/grafana/grafana:12.3.3 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.7 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.88.1 + - quay.io/prometheus/alertmanager:v0.31.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.6.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Dependency non-major updates only (Renovate/autoclosed PRs);\ - \ chart package size changed slightly (853 KB \u2192 850 KB)."] + chart_updates: + - "Dependency non-major updates only (Renovate/autoclosed PRs); chart package\ + \ size changed slightly (853 KB \u2192 850 KB)." features: [] breaking_changes: [] chart_version: 81.6.1 - images: ['docker.io/bats/bats:1.13.0', 'docker.io/grafana/grafana:12.3.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.6', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', - 'quay.io/prometheus/alertmanager:v0.31.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/bats/bats:1.13.0 + - docker.io/grafana/grafana:12.3.2 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.6 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.88.1 + - quay.io/prometheus/alertmanager:v0.31.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['81.4.2: Patch job now handles `IgnoreOnInstallOnly` `failurePolicy` - correctly (fix in admission/patching logic).', '81.5.0: Bumps kube-prometheus-stack - chart dependencies with non-major updates (Renovate).'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '81.4.2: Patch job now handles `IgnoreOnInstallOnly` `failurePolicy` correctly + (fix in admission/patching logic).' + - '81.5.0: Bumps kube-prometheus-stack chart dependencies with non-major updates + (Renovate).' features: [] breaking_changes: [] chart_version: 81.5.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', - 'quay.io/prometheus/alertmanager:v0.31.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.88.1 + - quay.io/prometheus/alertmanager:v0.31.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.4.2 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Patch/upgrade job now handles `IgnoreOnInstallOnly` `failurePolicy` - correctly when patching resources (fix for install/upgrade edge cases)., - 81.3.0 included non-major dependency bumps via Renovate (exact sub-chart/component - versions not listed in the provided notes).] - features: ['Improved robustness of the patch job when encountering `failurePolicy: - IgnoreOnInstallOnly`, reducing upgrade/install failures in some clusters.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Patch/upgrade job now handles `IgnoreOnInstallOnly` `failurePolicy` correctly + when patching resources (fix for install/upgrade edge cases). + - 81.3.0 included non-major dependency bumps via Renovate (exact sub-chart/component + versions not listed in the provided notes). + features: + - 'Improved robustness of the patch job when encountering `failurePolicy: IgnoreOnInstallOnly`, + reducing upgrade/install failures in some clusters.' breaking_changes: [] chart_version: 81.4.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', - 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.88.1 + - quay.io/prometheus/alertmanager:v0.30.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.3.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped kube-prometheus-stack chart dependencies with non-major - updates (Renovate). No chart template/values changes called out in the provided - notes.] - features: ['Maintenance release: refreshes subchart/dependency versions with - non-major updates; no user-facing features were highlighted in the provided - release notes.'] - breaking_changes: ["None mentioned in the provided release notes; treat as low-risk,\ - \ but dependency bumps can still introduce behavior changes\u2014validate\ - \ in staging."] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped kube-prometheus-stack chart dependencies with non-major updates (Renovate). + No chart template/values changes called out in the provided notes. + features: + - 'Maintenance release: refreshes subchart/dependency versions with non-major + updates; no user-facing features were highlighted in the provided release + notes.' + breaking_changes: + - "None mentioned in the provided release notes; treat as low-risk, but dependency\ + \ bumps can still introduce behavior changes\u2014validate in staging." chart_version: 81.3.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', - 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.5.0 + - quay.io/prometheus-operator/prometheus-operator:v0.88.1 + - quay.io/prometheus/alertmanager:v0.30.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 81.2.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Both 80.14.4 and 81.2.0 releases are Renovate-driven dependency - bumps only; no functional chart template changes are called out in the release - notes provided., '80.14.4: CI dependency update (helm/helm to v4.0.5) plus - non-major kube-prometheus-stack dependency updates.', '81.2.0: non-major - kube-prometheus-stack dependency updates.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Both 80.14.4 and 81.2.0 releases are Renovate-driven dependency bumps only; + no functional chart template changes are called out in the release notes provided. + - '80.14.4: CI dependency update (helm/helm to v4.0.5) plus non-major kube-prometheus-stack + dependency updates.' + - '81.2.0: non-major kube-prometheus-stack dependency updates.' features: [] breaking_changes: [] chart_version: 81.2.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.2.1', 'quay.io/prometheus-operator/prometheus-operator:v0.88.0', - 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.2.1 + - quay.io/prometheus-operator/prometheus-operator:v0.88.0 + - quay.io/prometheus/alertmanager:v0.30.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 - version: 80.14.4 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['80.10.0: Updated etcd-io/etcd image digest to 65b1be4 (dependency - bump via Renovate).', '80.14.4: CI dependency bump helm/helm to v4.0.5.', - '80.14.4: Non-major dependency updates for kube-prometheus-stack chart (Renovate).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '80.10.0: Updated etcd-io/etcd image digest to 65b1be4 (dependency bump via + Renovate).' + - '80.14.4: CI dependency bump helm/helm to v4.0.5.' + - '80.14.4: Non-major dependency updates for kube-prometheus-stack chart (Renovate).' features: [] breaking_changes: [] chart_version: 80.14.4 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.2.1', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.2.1 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.1 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.9.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.10.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Updated etcd image digest to `65b1be4` (chart maintenance/renovate-driven - change)., Updated kube-prometheus-stack chart dependencies (non-major updates) - via Renovate.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Updated etcd image digest to `65b1be4` (chart maintenance/renovate-driven + change). + - Updated kube-prometheus-stack chart dependencies (non-major updates) via Renovate. features: [] breaking_changes: [] chart_version: 80.10.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.9.2 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Grafana Operator YAML dashboards: add `folderRef` and `folderUID` - fields (80.8.0).', Dependency bumps / non-major dependency updates via Renovate - (80.9.2).] - features: ['Grafana Operator dashboard manifests now support `folderRef`/`folderUID`, - enabling dashboards to be organized into specific Grafana folders when using - the Grafana Operator.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Grafana Operator YAML dashboards: add `folderRef` and `folderUID` fields + (80.8.0).' + - Dependency bumps / non-major dependency updates via Renovate (80.9.2). + features: + - Grafana Operator dashboard manifests now support `folderRef`/`folderUID`, + enabling dashboards to be organized into specific Grafana folders when using + the Grafana Operator. breaking_changes: [] chart_version: 80.9.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.1 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.8.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Grafana Operator YAML dashboards now include `folderRef` and - `folderUID` fields (PR #6428).', "No other chart template/value changes\ - \ are mentioned in the 80.7.0\u219280.8.0 release notes; 80.7.0 was primarily\ - \ CI/dependency non-major updates."] - features: ['Grafana Operator dashboard resources can now set/retain the target - folder via `folderRef`/`folderUID`, improving organization and reducing - reliance on default folder placement.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Grafana Operator YAML dashboards now include `folderRef` and `folderUID` + fields (PR #6428).' + - "No other chart template/value changes are mentioned in the 80.7.0\u219280.8.0\ + \ release notes; 80.7.0 was primarily CI/dependency non-major updates." + features: + - Grafana Operator dashboard resources can now set/retain the target folder + via `folderRef`/`folderUID`, improving organization and reducing reliance + on default folder placement. breaking_changes: [] chart_version: 80.8.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.7.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Dependency updates only (non-major) for kube-prometheus-stack - in 80.7.0 (PR #6437).', 'CI-only change: super-linter action bumped to v8.3.2 - (PR #6436); no runtime impact.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Dependency updates only (non-major) for kube-prometheus-stack in 80.7.0 (PR + #6437).' + - 'CI-only change: super-linter action bumped to v8.3.2 (PR #6436); no runtime + impact.' features: [] breaking_changes: [] chart_version: 80.7.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.6.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Chart release 80.6.0 only includes non-major dependency updates - via Renovate (PR #6426).'] - features: [No user-facing features called out in the release notes; this is - a dependency refresh.] - breaking_changes: [No breaking changes mentioned in the provided release notes.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Chart release 80.6.0 only includes non-major dependency updates via Renovate + (PR #6426).' + features: + - No user-facing features called out in the release notes; this is a dependency + refresh. + breaking_changes: + - No breaking changes mentioned in the provided release notes. chart_version: 80.6.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Bumps the kube-prometheus-stack chart\u2019s dependencies with\ - \ non-major updates (Renovate PR #6425). No chart template/logic changes\ - \ called out in the release notes beyond dependency updates."] - features: [No new end-user features are mentioned in the 80.5.0 chart release - notes; this appears to be a dependency refresh.] - breaking_changes: [No breaking changes are mentioned in the 80.5.0 chart release - notes.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Bumps the kube-prometheus-stack chart\u2019s dependencies with non-major\ + \ updates (Renovate PR #6425). No chart template/logic changes called out\ + \ in the release notes beyond dependency updates." + features: + - No new end-user features are mentioned in the 80.5.0 chart release notes; + this appears to be a dependency refresh. + breaking_changes: + - No breaking changes are mentioned in the 80.5.0 chart release notes. chart_version: 80.5.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.4.2 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20391,22 +26123,40 @@ addons: \ Prometheus Operator is **v0.87.0** in 80.x and CRDs must be upgraded (either\ \ via `crds.upgradeJob.enabled` or manual `kubectl apply --server-side` of\ \ the CRDs)." - chart_updates: ['**80.4.1**: Allow unsetting the Prometheus service reloader - port (chart template change).', '**80.4.2**: Dependency non-major updates - for kube-prometheus-stack (renovate-driven).', "**80.4.2**: CI-only change\ - \ (super-linter action bump) \u2014 no runtime impact."] - features: ["Prometheus Service: you can now unset/omit the config-reloader port\ - \ on the Prometheus Service (useful if you don\u2019t want that port exposed/allocated)."] - breaking_changes: ["None mentioned for 80.4.1 \u2192 80.4.2; this is a patch-level\ - \ release with CI and dependency non-major updates."] + chart_updates: + - '**80.4.1**: Allow unsetting the Prometheus service reloader port (chart template + change).' + - '**80.4.2**: Dependency non-major updates for kube-prometheus-stack (renovate-driven).' + - "**80.4.2**: CI-only change (super-linter action bump) \u2014 no runtime impact." + features: + - "Prometheus Service: you can now unset/omit the config-reloader port on the\ + \ Prometheus Service (useful if you don\u2019t want that port exposed/allocated)." + breaking_changes: + - "None mentioned for 80.4.1 \u2192 80.4.2; this is a patch-level release with\ + \ CI and dependency non-major updates." chart_version: 80.4.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.30.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.4.1 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20428,25 +26178,44 @@ addons: kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml\n\ kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml\n\ ```\n" - chart_updates: [80.x line uses Prometheus Operator v0.87.0 (drives the CRD update - requirement)., '80.2.0: kube-state-metrics Helm subchart updated to major - version v7 (review if you override kube-state-metrics values heavily).', - '80.4.1: allows unsetting the **prometheus service reloader port** (minor - chart behavior/templating change).'] - features: [kube-state-metrics subchart bumped to v7 (potentially newer kube-state-metrics - behavior and defaults)., "Option to unset the reloader port on the Prometheus\ - \ Service (helps when you don\u2019t want that port exposed/created)."] - breaking_changes: ["No breaking changes were explicitly listed for 80.2.0\u2013\ - 80.4.1 in the provided notes. The main operational risk is **CRD mismatch**\ - \ if you upgrade the operator to v0.87.0 without upgrading the CRDs first."] + chart_updates: + - 80.x line uses Prometheus Operator v0.87.0 (drives the CRD update requirement). + - '80.2.0: kube-state-metrics Helm subchart updated to major version v7 (review + if you override kube-state-metrics values heavily).' + - '80.4.1: allows unsetting the **prometheus service reloader port** (minor + chart behavior/templating change).' + features: + - kube-state-metrics subchart bumped to v7 (potentially newer kube-state-metrics + behavior and defaults). + - "Option to unset the reloader port on the Prometheus Service (helps when you\ + \ don\u2019t want that port exposed/created)." + breaking_changes: + - "No breaking changes were explicitly listed for 80.2.0\u201380.4.1 in the\ + \ provided notes. The main operational risk is **CRD mismatch** if you upgrade\ + \ the operator to v0.87.0 without upgrading the CRDs first." chart_version: 80.4.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', - 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', - 'quay.io/prometheus/alertmanager:v0.29.0', 'quay.io/prometheus/node-exporter:v1.10.2', - 'quay.io/prometheus/prometheus:v3.8.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.1 + - quay.io/prometheus/alertmanager:v0.29.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 80.2.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20468,162 +26237,316 @@ addons: \ kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml\n\ \ ```\n\n- **No other values changes are called out in the provided 79.x\ \ \u2192 80.x upgrade notes.**\n" - chart_updates: [Prometheus Operator bumped to **v0.87.0** in the 80.x line (from - the 79.x line)., 'Subchart dependency update in 80.2.0: **kube-state-metrics - Helm release bumped to v7**.'] - features: [Optional **CRD upgrade job** (`crds.upgradeJob.enabled`) remains - available as an alternative to manually applying CRDs during upgrades., - Updated bundled components via dependency bumps (notably kube-state-metrics - chart v7 in 80.2.0).] - breaking_changes: ['**CRD version change with Prometheus Operator v0.87.0**: - you must upgrade the `monitoring.coreos.com` CRDs before upgrading the chart, - otherwise the operator may not start or reconcile resources correctly.', - "Potential behavior changes from **kube-state-metrics chart v7** (dependency\ - \ bump); if you have custom kube-state-metrics values, review that subchart\u2019\ - s changelog for any renamed/removed settings."] + chart_updates: + - Prometheus Operator bumped to **v0.87.0** in the 80.x line (from the 79.x + line). + - 'Subchart dependency update in 80.2.0: **kube-state-metrics Helm release bumped + to v7**.' + features: + - Optional **CRD upgrade job** (`crds.upgradeJob.enabled`) remains available + as an alternative to manually applying CRDs during upgrades. + - Updated bundled components via dependency bumps (notably kube-state-metrics + chart v7 in 80.2.0). + breaking_changes: + - '**CRD version change with Prometheus Operator v0.87.0**: you must upgrade + the `monitoring.coreos.com` CRDs before upgrading the chart, otherwise the + operator may not start or reconcile resources correctly.' + - "Potential behavior changes from **kube-state-metrics chart v7** (dependency\ + \ bump); if you have custom kube-state-metrics values, review that subchart\u2019\ + s changelog for any renamed/removed settings." chart_version: 80.2.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:2.1.2', - 'quay.io/prometheus-operator/prometheus-operator:v0.87.0', 'quay.io/prometheus/alertmanager:v0.29.0', - 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.8.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.87.0 + - quay.io/prometheus/alertmanager:v0.29.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 79.12.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['kube-prometheus-stack: updated etcd image digest to `cf5a571` - (PR #6381).', 'kube-prometheus-stack 79.8.2: bumped `prometheus-node-exporter` - chart dependency to `v4.49.2` (PR #6358).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'kube-prometheus-stack: updated etcd image digest to `cf5a571` (PR #6381).' + - 'kube-prometheus-stack 79.8.2: bumped `prometheus-node-exporter` chart dependency + to `v4.49.2` (PR #6358).' features: [] breaking_changes: [] chart_version: 79.12.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:2.1.2', - 'quay.io/prometheus-operator/prometheus-operator:v0.86.2', 'quay.io/prometheus/alertmanager:v0.29.0', - 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.8.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - quay.io/kiwigrid/k8s-sidecar:2.1.2 + - quay.io/prometheus-operator/prometheus-operator:v0.86.2 + - quay.io/prometheus/alertmanager:v0.29.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.8.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 79.8.2 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null chart_version: 79.8.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', - 'quay.io/prometheus-operator/prometheus-operator:v0.86.2', 'quay.io/prometheus/alertmanager:v0.29.0', - 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.7.3', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.3.0 + - quay.io/kiwigrid/k8s-sidecar:1.30.10 + - quay.io/prometheus-operator/prometheus-operator:v0.86.2 + - quay.io/prometheus/alertmanager:v0.29.0 + - quay.io/prometheus/node-exporter:v1.10.2 + - quay.io/prometheus/prometheus:v3.7.3 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 79.5.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 78.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No chart-specific changes are called out in the provided release\ - \ notes for either endpoint version; both releases are described only as\ - \ \u201CUpdate kube-prometheus-stack dependency non-major updates\u201D.", - Plan for routine dependency bumps across subcharts/images/dashboards/rules; - validate rendered manifests diff and run a canary upgrade in a non-prod - cluster.] - features: [No explicit new features are listed in the provided notes; changes - appear to be dependency non-major updates only.] - breaking_changes: [No breaking changes are mentioned in the provided notes; - treat as low-risk but still verify CRDs and component compatibility after - dependency bumps.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No chart-specific changes are called out in the provided release notes for\ + \ either endpoint version; both releases are described only as \u201CUpdate\ + \ kube-prometheus-stack dependency non-major updates\u201D." + - Plan for routine dependency bumps across subcharts/images/dashboards/rules; + validate rendered manifests diff and run a canary upgrade in a non-prod cluster. + features: + - No explicit new features are listed in the provided notes; changes appear + to be dependency non-major updates only. + breaking_changes: + - No breaking changes are mentioned in the provided notes; treat as low-risk + but still verify CRDs and component compatibility after dependency bumps. chart_version: 78.5.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', - 'quay.io/prometheus-operator/prometheus-operator:v0.86.1', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.7.2', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.2.0 + - quay.io/kiwigrid/k8s-sidecar:1.30.10 + - quay.io/prometheus-operator/prometheus-operator:v0.86.1 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.7.2 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 77.14.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Both 76.5.1 and 77.14.0 release notes only mention \u201CUpdate\ - \ kube-prometheus-stack dependency non-major updates\u201D via Renovate;\ - \ no explicit chart template/resource changes are called out in the provided\ - \ notes."] - features: [No new user-facing features are described in the provided release - notes; changes are limited to non-major dependency updates.] - breaking_changes: [No breaking changes are mentioned in the provided release - notes.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Both 76.5.1 and 77.14.0 release notes only mention \u201CUpdate kube-prometheus-stack\ + \ dependency non-major updates\u201D via Renovate; no explicit chart template/resource\ + \ changes are called out in the provided notes." + features: + - No new user-facing features are described in the provided release notes; changes + are limited to non-major dependency updates. + breaking_changes: + - No breaking changes are mentioned in the provided release notes. chart_version: 77.14.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', - 'quay.io/prometheus-operator/prometheus-operator:v0.85.0', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.6.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.1.1 + - quay.io/kiwigrid/k8s-sidecar:1.30.10 + - quay.io/prometheus-operator/prometheus-operator:v0.85.0 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.6.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 - version: 76.5.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['75.18.1: Fixes the `prometheus.additionalScrapeConfigs` example - in chart documentation/templates (no functional behavior change unless you - were copying the broken example).', "76.5.1: Updates kube-prometheus-stack\ - \ chart dependencies with non-major version bumps (via Renovate). This can\ - \ change the rendered manifests due to upstream chart changes even if this\ - \ chart\u2019s own values schema is unchanged."] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '75.18.1: Fixes the `prometheus.additionalScrapeConfigs` example in chart + documentation/templates (no functional behavior change unless you were copying + the broken example).' + - "76.5.1: Updates kube-prometheus-stack chart dependencies with non-major version\ + \ bumps (via Renovate). This can change the rendered manifests due to upstream\ + \ chart changes even if this chart\u2019s own values schema is unchanged." features: [] breaking_changes: [] chart_version: 76.5.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.3', - 'quay.io/prometheus-operator/prometheus-operator:v0.84.1', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.5.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.1.0 + - quay.io/kiwigrid/k8s-sidecar:1.30.3 + - quay.io/prometheus-operator/prometheus-operator:v0.84.1 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.5.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 75.18.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['74.2.2: Bumps etcd image digest; CI/Chart.yaml bump behavior - change; dependency non-major updates via renovate.', '75.18.1: Fixes the - Prometheus `additionalScrapeConfigs` example in the chart. (Release notes - only mention this change.)'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '74.2.2: Bumps etcd image digest; CI/Chart.yaml bump behavior change; dependency + non-major updates via renovate.' + - '75.18.1: Fixes the Prometheus `additionalScrapeConfigs` example in the chart. + (Release notes only mention this change.)' features: [] breaking_changes: [] chart_version: 75.18.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.3', - 'quay.io/prometheus-operator/prometheus-operator:v0.83.0', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.5.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.1.0 + - quay.io/kiwigrid/k8s-sidecar:1.30.3 + - quay.io/prometheus-operator/prometheus-operator:v0.83.0 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.5.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 74.2.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Chart includes maintenance-level updates: updated etcd image - digest; refreshed kube-prometheus-stack dependency versions (non-major updates); - CI/packaging change to bump Chart.yaml when only subdirectories change.', - 'From 73.2.3: changed default behavior to ignore EROFS (read-only filesystem) - errors by default (likely affects node-exporter/collector error handling).'] - features: [Improved robustness by ignoring EROFS errors by default (reduces - noisy scrape/collector errors on read-only filesystems).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Chart includes maintenance-level updates: updated etcd image digest; refreshed + kube-prometheus-stack dependency versions (non-major updates); CI/packaging + change to bump Chart.yaml when only subdirectories change.' + - 'From 73.2.3: changed default behavior to ignore EROFS (read-only filesystem) + errors by default (likely affects node-exporter/collector error handling).' + features: + - Improved robustness by ignoring EROFS errors by default (reduces noisy scrape/collector + errors on read-only filesystems). breaking_changes: [] chart_version: 74.2.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.83.0', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.4.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.0.1 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.83.0 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.4.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 73.2.3 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -20634,23 +26557,48 @@ addons: \ filesystem collector tweak**: Chart now **ignores `erofs` by default** (73.2.3).\ \ If you previously relied on `erofs` metrics, you may need to override the\ \ node-exporter filesystem ignore/mount filtering values to re-include it.\n" - chart_updates: [Added ability to specify `matchConditions` for admission webhooks - objects., Adjusted node-exporter defaults to ignore `erofs` filesystem type - by default (bugfix/defaults change).] - features: ['Configurable `matchConditions` for admission webhooks, enabling - more precise selection of which API requests the webhook should evaluate.'] - breaking_changes: ['Potential behavior change: node-exporter will no longer - report filesystem metrics for `erofs` by default; environments using EROFS - (e.g., some container/image setups) may see those metrics disappear unless - you override the ignore settings.'] + chart_updates: + - Added ability to specify `matchConditions` for admission webhooks objects. + - Adjusted node-exporter defaults to ignore `erofs` filesystem type by default + (bugfix/defaults change). + features: + - Configurable `matchConditions` for admission webhooks, enabling more precise + selection of which API requests the webhook should evaluate. + breaking_changes: + - 'Potential behavior change: node-exporter will no longer report filesystem + metrics for `erofs` by default; environments using EROFS (e.g., some container/image + setups) may see those metrics disappear unless you override the ignore settings.' chart_version: 73.2.3 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.82.2', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.4.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.0.1 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.82.2 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.4.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 72.9.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -20659,186 +26607,399 @@ addons: \ the chart\u2019s admission webhooks, review/extend your values to include\ \ this field where needed.\n\n_No other Helm values changes are called out\ \ in the provided notes._" - chart_updates: ['Chart **72.9.1**: adds support for configuring `matchConditions` - on admission webhook objects.', 'Chart **71.2.0**: CI tooling change (GitHub - action version bump) and routine non-major dependency updates (no functional - chart behavior called out).'] - features: ['Ability to set `matchConditions` for admission webhooks, allowing - more granular control over when the webhook is invoked.'] + chart_updates: + - 'Chart **72.9.1**: adds support for configuring `matchConditions` on admission + webhook objects.' + - 'Chart **71.2.0**: CI tooling change (GitHub action version bump) and routine + non-major dependency updates (no functional chart behavior called out).' + features: + - Ability to set `matchConditions` for admission webhooks, allowing more granular + control over when the webhook is invoked. breaking_changes: [] - chart_version: 72.9.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.0-security-01', - 'quay.io/kiwigrid/k8s-sidecar:1.30.0', 'quay.io/prometheus-operator/prometheus-operator:v0.82.2', - 'quay.io/prometheus/alertmanager:v0.28.1', 'quay.io/prometheus/node-exporter:v1.9.1', - 'quay.io/prometheus/prometheus:v3.4.1', 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - - version: 71.2.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["The 70.10.0 \u2192 71.2.0 chart bump is primarily dependency\ - \ refreshes (non\u2011major) and CI workflow updates; no functional chart\ - \ template changes are called out in the provided release snippets."] - features: [No user-facing features are described in the provided 70.10.0 and - 71.2.0 release notes; changes are dependency/automation related.] - breaking_changes: [No breaking changes are mentioned in the provided release - notes.] + chart_version: 72.9.1 + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:12.0.0-security-01 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.82.2 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.4.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + - version: 71.2.0 + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "The 70.10.0 \u2192 71.2.0 chart bump is primarily dependency refreshes (non\u2011\ + major) and CI workflow updates; no functional chart template changes are called\ + \ out in the provided release snippets." + features: + - No user-facing features are described in the provided 70.10.0 and 71.2.0 release + notes; changes are dependency/automation related. + breaking_changes: + - No breaking changes are mentioned in the provided release notes. chart_version: 71.2.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.6.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.82.0', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.3.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.6.1 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.82.0 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.3.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 70.10.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [No chart template/value changes called out in the provided release - notes for this version jump., 70.10.0 notes indicate CI maintenance (actions/setup-python - bump) and routine dependency non-major updates via Renovate., 69.8.2 notes - indicate an Alertmanager image/version bump to 0.28.1.] - features: [Alertmanager version updated to 0.28.1 (from the 69.8.2 notes in - your snippets)., Ongoing dependency refreshes in 70.10.0 (non-major) which - may include patch/minor updates of subcharts/images.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No chart template/value changes called out in the provided release notes for + this version jump. + - 70.10.0 notes indicate CI maintenance (actions/setup-python bump) and routine + dependency non-major updates via Renovate. + - 69.8.2 notes indicate an Alertmanager image/version bump to 0.28.1. + features: + - Alertmanager version updated to 0.28.1 (from the 69.8.2 notes in your snippets). + - Ongoing dependency refreshes in 70.10.0 (non-major) which may include patch/minor + updates of subcharts/images. breaking_changes: [] chart_version: 70.10.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.6.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.81.0', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.3.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.6.1 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.81.0 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.1 + - quay.io/prometheus/prometheus:v3.3.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 69.8.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Regenerated kube-prometheus mixins as part of the chart content - (dashboards/rules) to fix the mixin update script and ensure generated artifacts - are up to date (68.5.0)., Bumped bundled Alertmanager version to v0.28.1 - (69.8.2).] - features: [Alertmanager updated to v0.28.1 as shipped with the chart (may include - upstream bugfixes and minor improvements from Alertmanager).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Regenerated kube-prometheus mixins as part of the chart content (dashboards/rules) + to fix the mixin update script and ensure generated artifacts are up to date + (68.5.0). + - Bumped bundled Alertmanager version to v0.28.1 (69.8.2). + features: + - Alertmanager updated to v0.28.1 as shipped with the chart (may include upstream + bugfixes and minor improvements from Alertmanager). breaking_changes: [] chart_version: 69.8.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.5.2', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.80.1', 'quay.io/prometheus/alertmanager:v0.28.1', - 'quay.io/prometheus/node-exporter:v1.9.0', 'quay.io/prometheus/prometheus:v3.2.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.5.2 + - quay.io/kiwigrid/k8s-sidecar:1.30.0 + - quay.io/prometheus-operator/prometheus-operator:v0.80.1 + - quay.io/prometheus/alertmanager:v0.28.1 + - quay.io/prometheus/node-exporter:v1.9.0 + - quay.io/prometheus/prometheus:v3.2.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 68.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['68.5.0: Fix the mixin update/regeneration script and regenerate - mixins (dashboards/rules artifacts).', '67.11.0: Add a configurable kubelet - scrape flag (new chart option affecting kubelet scraping configuration).'] - features: [New kubelet scrape flag option added (lets you control how/if kubelet - is scraped).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '68.5.0: Fix the mixin update/regeneration script and regenerate mixins (dashboards/rules + artifacts).' + - '67.11.0: Add a configurable kubelet scrape flag (new chart option affecting + kubelet scraping configuration).' + features: + - New kubelet scrape flag option added (lets you control how/if kubelet is scraped). breaking_changes: [] chart_version: 68.5.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.79.2', 'quay.io/prometheus/alertmanager:v0.28.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v3.1.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.4.1 + - quay.io/kiwigrid/k8s-sidecar:1.28.0 + - quay.io/prometheus-operator/prometheus-operator:v0.79.2 + - quay.io/prometheus/alertmanager:v0.28.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v3.1.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 - version: 67.11.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['66.7.1: Chore/maintenance change to the kubelet ServiceMonitor - (PR #5061) to improve it (e.g., scraping/labels/endpoints behavior may be - adjusted).', '67.11.0: Add a configurable kubelet scrape flag (PR #5136), - enabling/disabling kubelet scraping via values without needing to patch - templates.'] - features: [New kubelet scrape flag/option so you can explicitly enable or disable - kubelet scraping from the chart values.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '66.7.1: Chore/maintenance change to the kubelet ServiceMonitor (PR #5061) + to improve it (e.g., scraping/labels/endpoints behavior may be adjusted).' + - '67.11.0: Add a configurable kubelet scrape flag (PR #5136), enabling/disabling + kubelet scraping via values without needing to patch templates.' + features: + - New kubelet scrape flag/option so you can explicitly enable or disable kubelet + scraping from the chart values. breaking_changes: [] chart_version: 67.11.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.79.2', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v3.1.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.4.0 + - quay.io/kiwigrid/k8s-sidecar:1.28.0 + - quay.io/prometheus-operator/prometheus-operator:v0.79.2 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v3.1.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 - version: 66.7.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['65.8.1: Adds more information to the selector fields for `additionalPodMonitors` - and `additionalServiceMonitors` (PR #4974).', '66.7.1: Chore/change to improve - the kubelet `ServiceMonitor` (PR #5061).'] - features: ['Richer selector metadata/fields for `additionalPodMonitors` and - `additionalServiceMonitors`, which can make targeting and debugging custom - monitors clearer.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '65.8.1: Adds more information to the selector fields for `additionalPodMonitors` + and `additionalServiceMonitors` (PR #4974).' + - '66.7.1: Chore/change to improve the kubelet `ServiceMonitor` (PR #5061).' + features: + - Richer selector metadata/fields for `additionalPodMonitors` and `additionalServiceMonitors`, + which can make targeting and debugging custom monitors clearer. breaking_changes: [] chart_version: 66.7.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', - 'quay.io/prometheus-operator/prometheus-operator:v0.79.0', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.55.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.4.0 + - quay.io/kiwigrid/k8s-sidecar:1.28.0 + - quay.io/prometheus-operator/prometheus-operator:v0.79.0 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v2.55.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 - version: 65.8.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['64.0.0: Reverted the change "Add downward compat for Prom CRD" - (#4883). This affects how Prometheus CRD compatibility logic is handled - in the chart/templates.', '65.8.1: Improved selector information for `additionalPodMonitors` - and `additionalServiceMonitors` (#4974), making selectors more explicit/verbose - in rendered resources.'] - features: ['More detailed/explicit selector fields for `additionalPodMonitors` - and `additionalServiceMonitors`, which can make monitor selection behavior - easier to understand and troubleshoot.'] - breaking_changes: ['Potential behavioral change around Prometheus CRD "downward - compatibility" due to the revert in 64.0.0; if you relied on the previously-added - compatibility behavior, verify CRD versions/fields against your cluster - and Prometheus Operator expectations before upgrading.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '64.0.0: Reverted the change "Add downward compat for Prom CRD" (#4883). This + affects how Prometheus CRD compatibility logic is handled in the chart/templates.' + - '65.8.1: Improved selector information for `additionalPodMonitors` and `additionalServiceMonitors` + (#4974), making selectors more explicit/verbose in rendered resources.' + features: + - More detailed/explicit selector fields for `additionalPodMonitors` and `additionalServiceMonitors`, + which can make monitor selection behavior easier to understand and troubleshoot. + breaking_changes: + - Potential behavioral change around Prometheus CRD "downward compatibility" + due to the revert in 64.0.0; if you relied on the previously-added compatibility + behavior, verify CRD versions/fields against your cluster and Prometheus Operator + expectations before upgrading. chart_version: 65.8.1 images: [] - version: 64.0.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Reverted the prior change that added \u201Cdownward compatibility\u201D\ - \ for Prometheus CRDs (PR #4883 reverting PR #4818). This means the chart\ - \ is no longer attempting to accommodate older/newer Prometheus Operator\ - \ CRD schemas automatically; you must ensure your cluster CRDs match the\ - \ operator/chart expectations before/when upgrading."] - features: ['(From 63.1.0) Added support for configuring `alertmanager.cluster.label` - via the chart, enabling better labeling/identification of Alertmanager clusters - in HA setups.'] - breaking_changes: ['Potential CRD compatibility impact due to reverting the - Prometheus CRD downward-compatibility logic; if you relied on that behavior - for smoother upgrades/downgrades across CRD versions, you may need to manage - CRD upgrades explicitly and validate Prometheus Operator/CRD versions during - this chart upgrade.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Reverted the prior change that added \u201Cdownward compatibility\u201D for\ + \ Prometheus CRDs (PR #4883 reverting PR #4818). This means the chart is no\ + \ longer attempting to accommodate older/newer Prometheus Operator CRD schemas\ + \ automatically; you must ensure your cluster CRDs match the operator/chart\ + \ expectations before/when upgrading." + features: + - (From 63.1.0) Added support for configuring `alertmanager.cluster.label` via + the chart, enabling better labeling/identification of Alertmanager clusters + in HA setups. + breaking_changes: + - Potential CRD compatibility impact due to reverting the Prometheus CRD downward-compatibility + logic; if you relied on that behavior for smoother upgrades/downgrades across + CRD versions, you may need to manage CRD upgrades explicitly and validate + Prometheus Operator/CRD versions during this chart upgrade. chart_version: 64.0.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.1', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', - 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.2.1 + - quay.io/kiwigrid/k8s-sidecar:1.27.4 + - quay.io/prometheus-operator/prometheus-operator:v0.76.1 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v2.54.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 - version: 63.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -20851,22 +27012,47 @@ addons: \ an Alertmanager `cluster.label` (exact key not shown in the provided notes;\ \ confirm against the chart\u2019s `values.yaml` or PR #4877 if you plan to\ \ use it)." - chart_updates: ['62.7.0: Added the ability to set ServiceAccount annotations - for the Prometheus Operator (PR #4820).', '63.1.0: Added support for Alertmanager - `cluster.label` (PR #4877).'] - features: [Ability to add annotations to the Prometheus Operator ServiceAccount - (useful for workload identity/IAM bindings)., Support for configuring an - Alertmanager `cluster.label` to label cluster identity in Alertmanager setups.] + chart_updates: + - '62.7.0: Added the ability to set ServiceAccount annotations for the Prometheus + Operator (PR #4820).' + - '63.1.0: Added support for Alertmanager `cluster.label` (PR #4877).' + features: + - Ability to add annotations to the Prometheus Operator ServiceAccount (useful + for workload identity/IAM bindings). + - Support for configuring an Alertmanager `cluster.label` to label cluster identity + in Alertmanager setups. breaking_changes: [] chart_version: 63.1.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', - 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.2.0 + - quay.io/kiwigrid/k8s-sidecar:1.27.4 + - quay.io/prometheus-operator/prometheus-operator:v0.76.1 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v2.54.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 - version: 62.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -20877,42 +27063,92 @@ addons: \ 61.9.0 notes mention bumping Grafana chart dependencies to `8.4.*`. If your\ \ cluster pins/overrides Grafana chart versions, re-check that your overrides\ \ still apply cleanly after upgrading." - chart_updates: ['Added ability to set ServiceAccount annotations for the Prometheus - Operator (PR #4820).', Grafana chart dependency bumped to 8.4.* (noted in - 61.9.0).] - features: ['Can configure annotations on the Prometheus Operator ServiceAccount - (useful for IAM roles for service accounts, workload identity, custom auditing - labels, etc.).'] + chart_updates: + - 'Added ability to set ServiceAccount annotations for the Prometheus Operator + (PR #4820).' + - Grafana chart dependency bumped to 8.4.* (noted in 61.9.0). + features: + - Can configure annotations on the Prometheus Operator ServiceAccount (useful + for IAM roles for service accounts, workload identity, custom auditing labels, + etc.). breaking_changes: [] chart_version: 62.7.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', - 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.2.0 + - quay.io/kiwigrid/k8s-sidecar:1.27.4 + - quay.io/prometheus-operator/prometheus-operator:v0.76.1 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v2.54.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 - version: 61.9.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Grafana dependency chart bumped to the 8.4.* series (as pulled - in by kube-prometheus-stack chart)., Grafana subchart/templates updated - to support dual-stack clusters (IPv4/IPv6) in Grafana-related resources.] - features: [Grafana components now support dual-stack Kubernetes clusters (IPv4/IPv6) - via updated chart handling., 'Grafana dependency updated to 8.4.*, bringing - in upstream fixes and improvements from the Grafana Helm chart.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Grafana dependency chart bumped to the 8.4.* series (as pulled in by kube-prometheus-stack + chart). + - Grafana subchart/templates updated to support dual-stack clusters (IPv4/IPv6) + in Grafana-related resources. + features: + - Grafana components now support dual-stack Kubernetes clusters (IPv4/IPv6) + via updated chart handling. + - Grafana dependency updated to 8.4.*, bringing in upstream fixes and improvements + from the Grafana Helm chart. breaking_changes: [] chart_version: 61.9.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.1.3', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', - 'quay.io/prometheus-operator/prometheus-operator:v0.75.2', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.1.3 + - quay.io/kiwigrid/k8s-sidecar:1.27.4 + - quay.io/prometheus-operator/prometheus-operator:v0.75.2 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.2 + - quay.io/prometheus/prometheus:v2.54.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 - version: 60.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -20926,78 +27162,173 @@ addons: (IPv4/IPv6) clusters** in Grafana-related configuration (PR #4638). If you run dual-stack, validate/adjust Grafana service/network settings accordingly; otherwise no values change is typically required.' - chart_updates: [Prometheus Operator integration updated to expose a PVC claim - retention configuration option (adds corresponding chart templating/values - wiring)., Grafana templates updated to better support dual-stack Kubernetes - clusters.] - features: [Ability to configure PVC claim retention behavior through Prometheus - Operator settings (more control over whether PVCs are retained or deleted - on resource removal)., Improved Grafana support for dual-stack Kubernetes - clusters (better compatibility in IPv4/IPv6 environments).] + chart_updates: + - Prometheus Operator integration updated to expose a PVC claim retention configuration + option (adds corresponding chart templating/values wiring). + - Grafana templates updated to better support dual-stack Kubernetes clusters. + features: + - Ability to configure PVC claim retention behavior through Prometheus Operator + settings (more control over whether PVCs are retained or deleted on resource + removal). + - Improved Grafana support for dual-stack Kubernetes clusters (better compatibility + in IPv4/IPv6 environments). breaking_changes: [] chart_version: 60.5.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.0.0', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', - 'quay.io/prometheus-operator/prometheus-operator:v0.74.0', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.1', 'quay.io/prometheus/prometheus:v2.53.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:11.0.0 + - quay.io/kiwigrid/k8s-sidecar:1.26.1 + - quay.io/prometheus-operator/prometheus-operator:v0.74.0 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.1 + - quay.io/prometheus/prometheus:v2.53.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 - version: 59.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Adds support for setting the Prometheus Operator PVC claim retention - field via chart values (new option exposed by the chart)., Fixes chart templating - so `alertmanager.alertmanagerSpec.version` is set correctly from values.] - features: ['Prometheus Operator: chart now exposes a PVC claim retention setting - so you can control how Prometheus persistent volume claims are retained - during scale-down/deletion scenarios.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Adds support for setting the Prometheus Operator PVC claim retention field + via chart values (new option exposed by the chart). + - Fixes chart templating so `alertmanager.alertmanagerSpec.version` is set correctly + from values. + features: + - 'Prometheus Operator: chart now exposes a PVC claim retention setting so you + can control how Prometheus persistent volume claims are retained during scale-down/deletion + scenarios.' breaking_changes: [] chart_version: 59.1.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', - 'quay.io/prometheus-operator/prometheus-operator:v0.74.0', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.0', 'quay.io/prometheus/prometheus:v2.52.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.4.1 + - quay.io/kiwigrid/k8s-sidecar:1.26.1 + - quay.io/prometheus-operator/prometheus-operator:v0.74.0 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.0 + - quay.io/prometheus/prometheus:v2.52.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 - version: 58.7.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['57.2.1: Fixes an issue when using kube-state-metrics 2.11.0 - (chart change to restore compatibility).', '58.7.2: Fixes Alertmanager version - wiring by correctly setting `alertManagerSpec.version`.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - '57.2.1: Fixes an issue when using kube-state-metrics 2.11.0 (chart change + to restore compatibility).' + - '58.7.2: Fixes Alertmanager version wiring by correctly setting `alertManagerSpec.version`.' features: [] breaking_changes: [] chart_version: 58.7.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', - 'quay.io/prometheus-operator/prometheus-operator:v0.73.2', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.8.0', 'quay.io/prometheus/prometheus:v2.52.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.4.1 + - quay.io/kiwigrid/k8s-sidecar:1.26.1 + - quay.io/prometheus-operator/prometheus-operator:v0.73.2 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.8.0 + - quay.io/prometheus/prometheus:v2.52.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 - version: 57.2.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Fix issue with kube-state-metrics 2.11.0 (PR #4419).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Fix issue with kube-state-metrics 2.11.0 (PR #4419).' features: [] breaking_changes: [] chart_version: 57.2.1 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', - 'quay.io/prometheus-operator/prometheus-operator:v0.72.0', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.51.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.4.0 + - quay.io/kiwigrid/k8s-sidecar:1.26.1 + - quay.io/prometheus-operator/prometheus-operator:v0.72.0 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.7.0 + - quay.io/prometheus/prometheus:v2.51.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 - version: 56.21.4 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -21010,49 +27341,102 @@ addons: bumps. ' - chart_updates: ['55.11.0: Bumped the Grafana subchart to the 7.2.x series.', - '56.21.4: Fixed the CoreDNS Grafana dashboard variables (removed circular - label filtering; refresh values on time range change).'] - features: [Grafana dependency updated to 7.2.x (via the kube-prometheus-stack - chart)., 'Improved CoreDNS Grafana dashboard behavior: variables no longer - have circular label filtering and refresh when the time range changes.'] + chart_updates: + - '55.11.0: Bumped the Grafana subchart to the 7.2.x series.' + - '56.21.4: Fixed the CoreDNS Grafana dashboard variables (removed circular + label filtering; refresh values on time range change).' + features: + - Grafana dependency updated to 7.2.x (via the kube-prometheus-stack chart). + - 'Improved CoreDNS Grafana dashboard behavior: variables no longer have circular + label filtering and refresh when the time range changes.' breaking_changes: [] chart_version: 56.21.4 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.3.3', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', - 'quay.io/prometheus-operator/prometheus-operator:v0.71.2', 'quay.io/prometheus/alertmanager:v0.27.0', - 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.50.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.3.3 + - quay.io/kiwigrid/k8s-sidecar:1.25.2 + - quay.io/prometheus-operator/prometheus-operator:v0.71.2 + - quay.io/prometheus/alertmanager:v0.27.0 + - quay.io/prometheus/node-exporter:v1.7.0 + - quay.io/prometheus/prometheus:v2.50.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 - version: 55.11.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped the Grafana subchart dependency to the 7.2.x series (kube-prometheus-stack - 55.11.0).] - features: [Grafana subchart updated to 7.2.x (new Grafana chart defaults/features - may apply).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped the Grafana subchart dependency to the 7.2.x series (kube-prometheus-stack + 55.11.0). + features: + - Grafana subchart updated to 7.2.x (new Grafana chart defaults/features may + apply). breaking_changes: [] chart_version: 55.11.0 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.2.3', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', - 'quay.io/prometheus-operator/prometheus-operator:v0.70.0', 'quay.io/prometheus/alertmanager:v0.26.0', - 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.48.1', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.2.3 + - quay.io/kiwigrid/k8s-sidecar:1.25.2 + - quay.io/prometheus-operator/prometheus-operator:v0.70.0 + - quay.io/prometheus/alertmanager:v0.26.0 + - quay.io/prometheus/node-exporter:v1.7.0 + - quay.io/prometheus/prometheus:v2.48.1 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 - version: 54.2.2 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 54.2.2 - images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.1.5', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', - 'quay.io/prometheus-operator/prometheus-operator:v0.69.1', 'quay.io/prometheus/alertmanager:v0.26.0', - 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.48.0', - 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', - 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] + images: + - docker.io/bats/bats:v1.4.1 + - docker.io/grafana/grafana:10.1.5 + - quay.io/kiwigrid/k8s-sidecar:1.25.2 + - quay.io/prometheus-operator/prometheus-operator:v0.69.1 + - quay.io/prometheus/alertmanager:v0.26.0 + - quay.io/prometheus/node-exporter:v1.7.0 + - quay.io/prometheus/prometheus:v2.48.0 + - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 name: kube-prometheus-stack - icon: https://avatars.githubusercontent.com/u/68448710?s=48&v=4 git_url: https://github.com/kyverno/kyverno @@ -21061,7 +27445,11 @@ addons: eolApiSlug: kyverno versions: - version: 1.16.0 - kube: ['1.34', '1.33', '1.32', '1.31'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -21085,33 +27473,46 @@ addons: if you had workarounds for scoping issues, re-check your values overrides. ' - chart_updates: ['Introduced a standalone CRDs subchart/package for Kyverno CRDs, - changing how CRDs may be installed/managed during upgrades.', 'Helm hooks - were cleaned up and hook names shortened (less clutter, but may affect scripts - that referenced them).', Helm chart gained configurable podAnnotations for - Kyverno test pods., Migration job template updated to include new policy - types., Fixed/adjusted helm templating to make a value global (scoping fix).] - features: ['New namespaced policy types were introduced: NamespacedValidatingPolicy, - NamespacedImageValidatingPolicy, and NamespacedDeletingPolicy (useful for - delegating policy ownership to namespaces).', CEL policy API surface expanded - with v1beta1 versions for ValidatingPolicy/ImageValidatingPolicy/MutatingPolicy/GeneratingPolicy/DeletingPolicy - and fine-grained CEL exceptions support., 'Webhooks can now be built using - matchLabels defined in policy, and CEL policy performance metrics were added - for observability.', 'Kyverno can bind to a hostIP when running in hostNetwork - mode, improving flexibility for networking constraints.'] - breaking_changes: ['Deprecated webhook was removed; if you relied on it (or - had network policies/allowlists targeting it), you must update to the supported - webhook endpoints/configuration.', UpdateRequest v1beta1 is now unserved; - any clients/manifests still using that version must be updated to a served - version before/with the upgrade.] + chart_updates: + - Introduced a standalone CRDs subchart/package for Kyverno CRDs, changing how + CRDs may be installed/managed during upgrades. + - Helm hooks were cleaned up and hook names shortened (less clutter, but may + affect scripts that referenced them). + - Helm chart gained configurable podAnnotations for Kyverno test pods. + - Migration job template updated to include new policy types. + - Fixed/adjusted helm templating to make a value global (scoping fix). + features: + - 'New namespaced policy types were introduced: NamespacedValidatingPolicy, + NamespacedImageValidatingPolicy, and NamespacedDeletingPolicy (useful for + delegating policy ownership to namespaces).' + - CEL policy API surface expanded with v1beta1 versions for ValidatingPolicy/ImageValidatingPolicy/MutatingPolicy/GeneratingPolicy/DeletingPolicy + and fine-grained CEL exceptions support. + - Webhooks can now be built using matchLabels defined in policy, and CEL policy + performance metrics were added for observability. + - Kyverno can bind to a hostIP when running in hostNetwork mode, improving flexibility + for networking constraints. + breaking_changes: + - Deprecated webhook was removed; if you relied on it (or had network policies/allowlists + targeting it), you must update to the supported webhook endpoints/configuration. + - UpdateRequest v1beta1 is now unserved; any clients/manifests still using that + version must be updated to a served version before/with the upgrade. chart_version: 3.6.0 - images: ['curlimages/curl:8.10.1', 'reg.kyverno.io/kyverno/background-controller:v1.16.0', - 'reg.kyverno.io/kyverno/cleanup-controller:v1.16.0', 'reg.kyverno.io/kyverno/kyverno-cli:v1.16.0', - 'reg.kyverno.io/kyverno/kyverno:v1.16.0', 'reg.kyverno.io/kyverno/kyvernopre:v1.16.0', - 'reg.kyverno.io/kyverno/reports-controller:v1.16.0', 'registry.k8s.io/kubectl:v1.32.7'] + images: + - curlimages/curl:8.10.1 + - reg.kyverno.io/kyverno/background-controller:v1.16.0 + - reg.kyverno.io/kyverno/cleanup-controller:v1.16.0 + - reg.kyverno.io/kyverno/kyverno-cli:v1.16.0 + - reg.kyverno.io/kyverno/kyverno:v1.16.0 + - reg.kyverno.io/kyverno/kyvernopre:v1.16.0 + - reg.kyverno.io/kyverno/reports-controller:v1.16.0 + - registry.k8s.io/kubectl:v1.32.7 eolAt: '2026-08-20' - version: 1.15.0 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -21145,33 +27546,45 @@ addons: your downstream tooling consumes it. ' - chart_updates: [Adds ServiceMonitor annotation support., Includes `mpol` and - `gpol` CRDs in the Helm chart (and related CRD packaging updates)., Adds - PDB `unhealthyPodEvictionPolicy` support., Adds ability to disable ServiceAccount - token automount; adds `automountServiceAccountToken` for Kyverno controllers., - Adds Service `trafficDistribution` support (K8s 1.31+)., Adds nodeSelector/tolerations - support for test pod templates., Renders OpenReports resources and wires - values to flags., 'Tooling bumps: helm/helm-docs version updates.'] - features: ['Introduces new policy types/flows: **MutatingPolicy**, **GeneratingPolicy**, - and **DeletingPolicy** with admission flow, background reporting, and CLI - support (mutate existing, generate existing, cleanup).', 'Policy reports - can be emitted in **OpenReports** format (alpha), replacing/transitioning - from prior report mechanisms.', 'CLI improvements: `skipColor`, more test - output formats (json/yaml/markdown/junit), improved apply/test behaviors, - and support for additional admission policy types.'] - breaking_changes: ['**ValidatingAdmissionPolicy generation is enabled by default** - in v1.15.0; this can create additional Kubernetes resources and requires - cluster permissions and API availability.', "CEL function/operator rename:\ - \ `image()` \u2192 `parseImageReference`, which can break existing CEL expressions\ - \ in policies.", CLI deprecated APIs removed; older scripts/automation invoking - removed flags/APIs may need updates., Context is disabled when using CEL - expressions in `validate` rules; policies that depended on context + CEL - together may behave differently.] + chart_updates: + - Adds ServiceMonitor annotation support. + - Includes `mpol` and `gpol` CRDs in the Helm chart (and related CRD packaging + updates). + - Adds PDB `unhealthyPodEvictionPolicy` support. + - Adds ability to disable ServiceAccount token automount; adds `automountServiceAccountToken` + for Kyverno controllers. + - Adds Service `trafficDistribution` support (K8s 1.31+). + - Adds nodeSelector/tolerations support for test pod templates. + - Renders OpenReports resources and wires values to flags. + - 'Tooling bumps: helm/helm-docs version updates.' + features: + - 'Introduces new policy types/flows: **MutatingPolicy**, **GeneratingPolicy**, + and **DeletingPolicy** with admission flow, background reporting, and CLI + support (mutate existing, generate existing, cleanup).' + - Policy reports can be emitted in **OpenReports** format (alpha), replacing/transitioning + from prior report mechanisms. + - 'CLI improvements: `skipColor`, more test output formats (json/yaml/markdown/junit), + improved apply/test behaviors, and support for additional admission policy + types.' + breaking_changes: + - '**ValidatingAdmissionPolicy generation is enabled by default** in v1.15.0; + this can create additional Kubernetes resources and requires cluster permissions + and API availability.' + - "CEL function/operator rename: `image()` \u2192 `parseImageReference`, which\ + \ can break existing CEL expressions in policies." + - CLI deprecated APIs removed; older scripts/automation invoking removed flags/APIs + may need updates. + - Context is disabled when using CEL expressions in `validate` rules; policies + that depended on context + CEL together may behave differently. chart_version: 3.5.0 images: [] eolAt: '2026-04-29' - version: 1.14.0 - kube: ['1.32', '1.31', '1.30', '1.29'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -21210,45 +27623,59 @@ addons: \ to `serviceAccountName`.\n- If you use custom RBAC patterns, review the\ \ new \u201Caggregate roles\u201D toggle.\n- If you want autoscaling for admission-controller,\ \ evaluate the new HPA values.\n" - chart_updates: ['Kyverno v1.13.0: chart removed wildcard view permissions and - changed default exception settings; multiple reporting/cleanup/report-type - changes landed including removal of old report types and disabling cleanup - jobs by default.', 'Kyverno v1.13.0: Helm chart removed `cleanupJobs` values - keys; added multiple new configuration knobs (hostNetwork, global tolerations, - imagePullSecrets, resync periods, ports, annotations).', 'Kyverno v1.14.0: - Helm chart added admission-controller HPA support, added `dnsconfig`, switched - to `serviceAccountName`, and introduced a toggle for aggregating user-facing - roles with Kyverno RBAC.'] - features: ['v1.14: Introduced new policy types `ValidatingPolicy` and `ImageValidatingPolicy`, - including JSON payload support and auto-generation of Kubernetes `ValidatingAdmissionPolicy` - where applicable.', 'v1.14: Extended CEL support (libraries and the ability - to reference `PolicyException` in CEL), increasing expressiveness for validation - logic.', 'v1.13: Significant enhancements to image verification (Cosign - features like TSA chain, signature algorithms, OCI 1.1 signatures, bundle - verification) and policy authoring (new `validate.assert`, `foreach` for - generate, labelSelectors for mutate targets).', 'v1.13: Reporting enhancements - including richer results (custom data, more rule types covered), new controller - circuit breaker, and additional tunables for report aggregation workers.'] - breaking_changes: ['v1.13: RBAC hardening removed wildcard view permissions; - Kyverno may no longer be able to read all resources/CRDs by default. This - can affect reports and mutate/generate on custom resources unless additional - RBAC is granted.', 'v1.13: Policy Exceptions are no longer enabled by default - for all namespaces due to CVE-2024-48921. If you relied on cluster-wide - exceptions, you must explicitly configure allowed namespaces.', 'v1.13: - Several API migrations/deprecations occurred (e.g., moving validationFailureAction - fields into per-rule `validate.failureAction` and removal of `validatingadmissionpolicies` - v1alpha1). Validate CRDs and policy manifests against the new schema.', - 'v1.13: Report types and cleanup behavior changed (old intermediate report - types removed; cleanup jobs disabled by default; some cleanup cronjobs removed). - If you had automation depending on those objects/jobs, update it.'] + chart_updates: + - 'Kyverno v1.13.0: chart removed wildcard view permissions and changed default + exception settings; multiple reporting/cleanup/report-type changes landed + including removal of old report types and disabling cleanup jobs by default.' + - 'Kyverno v1.13.0: Helm chart removed `cleanupJobs` values keys; added multiple + new configuration knobs (hostNetwork, global tolerations, imagePullSecrets, + resync periods, ports, annotations).' + - 'Kyverno v1.14.0: Helm chart added admission-controller HPA support, added + `dnsconfig`, switched to `serviceAccountName`, and introduced a toggle for + aggregating user-facing roles with Kyverno RBAC.' + features: + - 'v1.14: Introduced new policy types `ValidatingPolicy` and `ImageValidatingPolicy`, + including JSON payload support and auto-generation of Kubernetes `ValidatingAdmissionPolicy` + where applicable.' + - 'v1.14: Extended CEL support (libraries and the ability to reference `PolicyException` + in CEL), increasing expressiveness for validation logic.' + - 'v1.13: Significant enhancements to image verification (Cosign features like + TSA chain, signature algorithms, OCI 1.1 signatures, bundle verification) + and policy authoring (new `validate.assert`, `foreach` for generate, labelSelectors + for mutate targets).' + - 'v1.13: Reporting enhancements including richer results (custom data, more + rule types covered), new controller circuit breaker, and additional tunables + for report aggregation workers.' + breaking_changes: + - 'v1.13: RBAC hardening removed wildcard view permissions; Kyverno may no longer + be able to read all resources/CRDs by default. This can affect reports and + mutate/generate on custom resources unless additional RBAC is granted.' + - 'v1.13: Policy Exceptions are no longer enabled by default for all namespaces + due to CVE-2024-48921. If you relied on cluster-wide exceptions, you must + explicitly configure allowed namespaces.' + - 'v1.13: Several API migrations/deprecations occurred (e.g., moving validationFailureAction + fields into per-rule `validate.failureAction` and removal of `validatingadmissionpolicies` + v1alpha1). Validate CRDs and policy manifests against the new schema.' + - 'v1.13: Report types and cleanup behavior changed (old intermediate report + types removed; cleanup jobs disabled by default; some cleanup cronjobs removed). + If you had automation depending on those objects/jobs, update it.' chart_version: 3.4.0 - images: ['bitnami/kubectl:1.32.3', 'busybox:1.35', 'reg.kyverno.io/kyverno/background-controller:v1.14.0', - 'reg.kyverno.io/kyverno/cleanup-controller:v1.14.0', 'reg.kyverno.io/kyverno/kyverno-cli:v1.14.0', - 'reg.kyverno.io/kyverno/kyverno:v1.14.0', 'reg.kyverno.io/kyverno/kyvernopre:v1.14.0', - 'reg.kyverno.io/kyverno/reports-controller:v1.14.0'] + images: + - bitnami/kubectl:1.32.3 + - busybox:1.35 + - reg.kyverno.io/kyverno/background-controller:v1.14.0 + - reg.kyverno.io/kyverno/cleanup-controller:v1.14.0 + - reg.kyverno.io/kyverno/kyverno-cli:v1.14.0 + - reg.kyverno.io/kyverno/kyverno:v1.14.0 + - reg.kyverno.io/kyverno/kyvernopre:v1.14.0 + - reg.kyverno.io/kyverno/reports-controller:v1.14.0 eolAt: '2026-02-02' - version: 1.13.0 - kube: ['1.31', '1.30', '1.29', '1.28'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -21285,45 +27712,63 @@ addons: \ value key names aren\u2019t present in the snippet; compare your current\ \ `values.yaml` to the 1.13 chart `values.yaml` and run `helm diff upgrade`\ \ to confirm the precise paths." - chart_updates: ['Security posture tightened: exceptions default scope reduced - (CVE-2024-48921 guidance).', 'RBAC hardening: wildcard view permissions - removed; binding to default `view` role added.', 'Removed intermediate report - types (`admissionreports`, `backgroundscanreports`) and older report artifacts - removed from the chart; cleanup jobs disabled by default and several cleanup - cronjobs removed.', 'Reports architecture changed: removed report chunking - and other report aggregation behaviors; reports controller gains circuit - breaker and new worker configuration flag.', 'Helm templates updated: flowcontrol - API updated to v1; Grafana dashboards updated (Grafana 11 support, metric - rename); Service/port and annotations configurability expanded.'] - features: ['Policy reporting improvements: `validate.podSecurity` now records - control names/images in reports and custom data can be added to policy reports.', - 'Image verification expanded: supports multiple attestations/context entries, - TSA cert chain support, signature algorithm selection, full regexp support, - Sigstore bundle verification, and OCI 1.1 signatures.', 'Policy Exceptions - enhancements: can be generated from policy reports; CLI supports inline - exceptions and apply can continue-on-failure.', 'Admission experience: warnings - for policy violations/mutations can be emitted during admission reviews.', - 'Generate/mutate enhancements: `foreach` support for generate policies, labelSelectors - for mutate targets, `dumpPatch` option, and reporting added for mutate/generate - rules.'] - breaking_changes: ['RBAC breaking change: wildcard view permissions removed; - Kyverno may no longer be able to read some custom resources, affecting reports - and some mutate/generate policies unless you grant explicit RBAC.', 'Helm - breaking change: exception defaults changed (no longer enabled for all namespaces - by default); clusters relying on broad exception enablement must explicitly - configure it.', 'Helm breaking change: `cleanupJobs` values keys removed; - existing values will be ignored and must be migrated/removed.', 'API migrations - in policy schema: `spec.validationFailureAction` and overrides moved down - to rule-level fields; other API fields migrated (generateExisting, mutateExistingOnPolicyUpdate, - webhookTimeoutSeconds, failurePolicy), and VAP v1alpha1 removed in favor - of v1beta1.'] + chart_updates: + - 'Security posture tightened: exceptions default scope reduced (CVE-2024-48921 + guidance).' + - 'RBAC hardening: wildcard view permissions removed; binding to default `view` + role added.' + - Removed intermediate report types (`admissionreports`, `backgroundscanreports`) + and older report artifacts removed from the chart; cleanup jobs disabled by + default and several cleanup cronjobs removed. + - 'Reports architecture changed: removed report chunking and other report aggregation + behaviors; reports controller gains circuit breaker and new worker configuration + flag.' + - 'Helm templates updated: flowcontrol API updated to v1; Grafana dashboards + updated (Grafana 11 support, metric rename); Service/port and annotations + configurability expanded.' + features: + - 'Policy reporting improvements: `validate.podSecurity` now records control + names/images in reports and custom data can be added to policy reports.' + - 'Image verification expanded: supports multiple attestations/context entries, + TSA cert chain support, signature algorithm selection, full regexp support, + Sigstore bundle verification, and OCI 1.1 signatures.' + - 'Policy Exceptions enhancements: can be generated from policy reports; CLI + supports inline exceptions and apply can continue-on-failure.' + - 'Admission experience: warnings for policy violations/mutations can be emitted + during admission reviews.' + - 'Generate/mutate enhancements: `foreach` support for generate policies, labelSelectors + for mutate targets, `dumpPatch` option, and reporting added for mutate/generate + rules.' + breaking_changes: + - 'RBAC breaking change: wildcard view permissions removed; Kyverno may no longer + be able to read some custom resources, affecting reports and some mutate/generate + policies unless you grant explicit RBAC.' + - 'Helm breaking change: exception defaults changed (no longer enabled for all + namespaces by default); clusters relying on broad exception enablement must + explicitly configure it.' + - 'Helm breaking change: `cleanupJobs` values keys removed; existing values + will be ignored and must be migrated/removed.' + - 'API migrations in policy schema: `spec.validationFailureAction` and overrides + moved down to rule-level fields; other API fields migrated (generateExisting, + mutateExistingOnPolicyUpdate, webhookTimeoutSeconds, failurePolicy), and VAP + v1alpha1 removed in favor of v1beta1.' chart_version: 3.3.2 - images: ['bitnami/kubectl:1.30.2', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.13.0', - 'ghcr.io/kyverno/cleanup-controller:v1.13.0', 'ghcr.io/kyverno/kyverno-cli:v1.13.0', - 'ghcr.io/kyverno/kyverno:v1.13.0', 'ghcr.io/kyverno/kyvernopre:v1.13.0', 'ghcr.io/kyverno/reports-controller:v1.13.0'] + images: + - bitnami/kubectl:1.30.2 + - busybox:1.35 + - ghcr.io/kyverno/background-controller:v1.13.0 + - ghcr.io/kyverno/cleanup-controller:v1.13.0 + - ghcr.io/kyverno/kyverno-cli:v1.13.0 + - ghcr.io/kyverno/kyverno:v1.13.0 + - ghcr.io/kyverno/kyvernopre:v1.13.0 + - ghcr.io/kyverno/reports-controller:v1.13.0 eolAt: '2025-11-10' - version: 1.12.0 - kube: ['1.29', '1.28', '1.27', '1.26'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -21352,39 +27797,54 @@ addons: \ versions. Ensure hook jobs can run (RBAC, imagePull, PodSecurity, network\ \ policies) and that Argo CD/Flux allow hooks.\n - Sanity checks added for\ \ **CRD/controller mismatch** when deploying specific controllers/CRDs.\n" - chart_updates: [Introduces CRD migration hooks to move existing Kyverno custom - resources to new storage versions (aligns with multiple APIs graduating - to v2)., Tightens RBAC by removing wildcard permissions; expect more granular - ClusterRoles/RoleBindings., Adds defaults and knobs to reduce Event and - webhook scope noise (omit certain Events by default; default webhook exclusions)., - 'Multiple chart ergonomics improvements: global nodeSelector/extraEnvVars, - CA bundle support, job backoff tuning, webhook labeling, profiling enablement, - revisionHistoryLimit.', Renames bundled Grafana dashboard artifact to `kyverno-dashboard.json`.] - features: ['Global resource caching via new `GlobalContextEntry` CRD, enabling - reuse of cached resources across policy evaluations.', 'More flexible and - narrower webhook scope configuration, including support for Kubernetes 1.27+ - CEL-based `matchConditions`.', 'Policy Exceptions enhanced: support conditions, - exclude specific Pod Security controls, and be applied to existing resources - when created (behavioral change).', 'New ephemeral report kinds (`EphemeralReports`, - `ClusterEphemeralReports`) under new `reports.kyverno.io` API group to support - the revamped reports pipeline.', 'CLI additions: `migrate` command to upgrade - Kyverno resources to current APIs; experimental `json` command; improved - `test/apply` support for Policy Exceptions and VAP bindings.'] - breaking_changes: ["Policies using long-deprecated/invalid operators in conditions\ - \ (e.g., `In`, `NotIn`) will now be blocked\u2014validate and update policies\ - \ before upgrading.", 'Multiple Kyverno CRDs/APIs graduate to **v2** (Policy - Exceptions, Cleanup Policies, Reports APIs, UpdateRequests). Existing CRs - may need migration; use Helm hook migrations or `kyverno cli migrate` and - plan for CRD updates.', 'Operational caution: Kyverno 1.12.0 had known critical - issues; upstream recommends upgrading to at least **v1.12.1** (and for ephemeralreports - piling up, **v1.12.4**) rather than staying on 1.12.0.'] + chart_updates: + - Introduces CRD migration hooks to move existing Kyverno custom resources to + new storage versions (aligns with multiple APIs graduating to v2). + - Tightens RBAC by removing wildcard permissions; expect more granular ClusterRoles/RoleBindings. + - Adds defaults and knobs to reduce Event and webhook scope noise (omit certain + Events by default; default webhook exclusions). + - 'Multiple chart ergonomics improvements: global nodeSelector/extraEnvVars, + CA bundle support, job backoff tuning, webhook labeling, profiling enablement, + revisionHistoryLimit.' + - Renames bundled Grafana dashboard artifact to `kyverno-dashboard.json`. + features: + - Global resource caching via new `GlobalContextEntry` CRD, enabling reuse of + cached resources across policy evaluations. + - More flexible and narrower webhook scope configuration, including support + for Kubernetes 1.27+ CEL-based `matchConditions`. + - 'Policy Exceptions enhanced: support conditions, exclude specific Pod Security + controls, and be applied to existing resources when created (behavioral change).' + - New ephemeral report kinds (`EphemeralReports`, `ClusterEphemeralReports`) + under new `reports.kyverno.io` API group to support the revamped reports pipeline. + - 'CLI additions: `migrate` command to upgrade Kyverno resources to current + APIs; experimental `json` command; improved `test/apply` support for Policy + Exceptions and VAP bindings.' + breaking_changes: + - "Policies using long-deprecated/invalid operators in conditions (e.g., `In`,\ + \ `NotIn`) will now be blocked\u2014validate and update policies before upgrading." + - Multiple Kyverno CRDs/APIs graduate to **v2** (Policy Exceptions, Cleanup + Policies, Reports APIs, UpdateRequests). Existing CRs may need migration; + use Helm hook migrations or `kyverno cli migrate` and plan for CRD updates. + - 'Operational caution: Kyverno 1.12.0 had known critical issues; upstream recommends + upgrading to at least **v1.12.1** (and for ephemeralreports piling up, **v1.12.4**) + rather than staying on 1.12.0.' chart_version: 3.2.0 - images: ['bitnami/kubectl:1.28.5', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.12.0', - 'ghcr.io/kyverno/cleanup-controller:v1.12.0', 'ghcr.io/kyverno/kyverno-cli:v1.12.0', - 'ghcr.io/kyverno/kyverno:v1.12.0', 'ghcr.io/kyverno/kyvernopre:v1.12.0', 'ghcr.io/kyverno/reports-controller:v1.12.0'] + images: + - bitnami/kubectl:1.28.5 + - busybox:1.35 + - ghcr.io/kyverno/background-controller:v1.12.0 + - ghcr.io/kyverno/cleanup-controller:v1.12.0 + - ghcr.io/kyverno/kyverno-cli:v1.12.0 + - ghcr.io/kyverno/kyverno:v1.12.0 + - ghcr.io/kyverno/kyvernopre:v1.12.0 + - ghcr.io/kyverno/reports-controller:v1.12.0 eolAt: '2025-07-31' - version: 1.11.0 - kube: ['1.28', '1.27', '1.26', '1.25'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -21414,44 +27874,59 @@ addons: \ unrelated workloads).\n- Replica fields validated more safely (non-integer\ \ handling).\n- RBAC fixes for PolicyExceptions and Secrets access in background\ \ controller.\n- Added/adjusted PDB enablement values.\n" - chart_updates: [CRDs moved to a dedicated subchart to reduce main chart size - and change how CRDs are installed/managed during upgrades., Grafana dashboard - content moved to its own subchart to avoid Helm secret size issues and reduce - main chart footprint., Chart now includes Kubernetes API Priority & Fairness - objects (FlowSchema/PriorityLevelConfiguration)., Introduced a global image - registry value to simplify image overrides across controllers., 'Webhook - cleanup job supports configurable security contexts; multiple Helm fixes - around hooks, RBAC, replicas, and PDB enablement.'] - features: ['ValidatingAdmissionPolicy (VAP) support (alpha): Kyverno can work - with Kubernetes VAPs, including generating VAPs from compatible `validate.cel` - rules and producing PolicyReports from VAP evaluations.', 'CEL-based validation - rules: you can author Kyverno validate rules using CEL, with autogen support, - and optionally have Kyverno generate/manage matching VAPs.', 'PolicyReports - are now generated per-resource (UID-named) instead of per-policy, reducing - API server/etcd pressure and improving scalability.', 'New cleanup mechanism - via reserved label `cleanup.kyverno.io/ttl`, allowing resources to be cleaned - up based on a TTL label rather than scheduled CronJobs.', 'Image verification - updates: Cosign 2.0 support, Notary/OCI 1.1 updates, signature verification - caching, and improved registry credential configuration via `imageRegistryCredentials`.', - 'CLI improvements: major refactor, formal test manifest schema, ability to - test VAPs, new `create` commands to scaffold test resources, and improved - `apply` output.'] - breaking_changes: ['PolicyReports behavior change: reports are now per-resource - and named by UID rather than per-policy; any tooling/alerts/dashboards that - assumed old naming or aggregation may break.', 'Cosign policy requirement - change: Rekor URL must be present (may be empty string). If you previously - did not use Rekor, you may need to explicitly disable transparency log and - SCT verification via `rekor.ignoreTlogs` and `ctlog.IgnoreSCT` in policies - to avoid failures.', '(Operational/behavioral change) Cleanup policies no - longer use CronJobs; cleanup is handled internally, which can affect expectations - around CronJob presence and scheduling visibility.'] + chart_updates: + - CRDs moved to a dedicated subchart to reduce main chart size and change how + CRDs are installed/managed during upgrades. + - Grafana dashboard content moved to its own subchart to avoid Helm secret size + issues and reduce main chart footprint. + - Chart now includes Kubernetes API Priority & Fairness objects (FlowSchema/PriorityLevelConfiguration). + - Introduced a global image registry value to simplify image overrides across + controllers. + - Webhook cleanup job supports configurable security contexts; multiple Helm + fixes around hooks, RBAC, replicas, and PDB enablement. + features: + - 'ValidatingAdmissionPolicy (VAP) support (alpha): Kyverno can work with Kubernetes + VAPs, including generating VAPs from compatible `validate.cel` rules and producing + PolicyReports from VAP evaluations.' + - 'CEL-based validation rules: you can author Kyverno validate rules using CEL, + with autogen support, and optionally have Kyverno generate/manage matching + VAPs.' + - PolicyReports are now generated per-resource (UID-named) instead of per-policy, + reducing API server/etcd pressure and improving scalability. + - New cleanup mechanism via reserved label `cleanup.kyverno.io/ttl`, allowing + resources to be cleaned up based on a TTL label rather than scheduled CronJobs. + - 'Image verification updates: Cosign 2.0 support, Notary/OCI 1.1 updates, signature + verification caching, and improved registry credential configuration via `imageRegistryCredentials`.' + - 'CLI improvements: major refactor, formal test manifest schema, ability to + test VAPs, new `create` commands to scaffold test resources, and improved + `apply` output.' + breaking_changes: + - 'PolicyReports behavior change: reports are now per-resource and named by + UID rather than per-policy; any tooling/alerts/dashboards that assumed old + naming or aggregation may break.' + - 'Cosign policy requirement change: Rekor URL must be present (may be empty + string). If you previously did not use Rekor, you may need to explicitly disable + transparency log and SCT verification via `rekor.ignoreTlogs` and `ctlog.IgnoreSCT` + in policies to avoid failures.' + - (Operational/behavioral change) Cleanup policies no longer use CronJobs; cleanup + is handled internally, which can affect expectations around CronJob presence + and scheduling visibility. chart_version: 3.1.0 - images: ['bitnami/kubectl:1.26.10', 'bitnami/kubectl:1.26.4', 'busybox:1.35', - 'ghcr.io/kyverno/background-controller:v1.11.0', 'ghcr.io/kyverno/cleanup-controller:v1.11.0', - 'ghcr.io/kyverno/kyverno:v1.11.0', 'ghcr.io/kyverno/kyvernopre:v1.11.0', 'ghcr.io/kyverno/reports-controller:v1.11.0'] + images: + - bitnami/kubectl:1.26.10 + - bitnami/kubectl:1.26.4 + - busybox:1.35 + - ghcr.io/kyverno/background-controller:v1.11.0 + - ghcr.io/kyverno/cleanup-controller:v1.11.0 + - ghcr.io/kyverno/kyverno:v1.11.0 + - ghcr.io/kyverno/kyvernopre:v1.11.0 + - ghcr.io/kyverno/reports-controller:v1.11.0 eolAt: '2025-04-25' - version: 1.10.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -21481,55 +27956,72 @@ addons: \ no longer overuses `kyverno.fullname`; uses `.Release.Name`/instance labels\ \ more consistently.\n - Ensure any custom selectors/NetworkPolicies/ServiceMonitors\ \ that referenced the old labels/names are updated.\n" - chart_updates: [Chart migrates from v2 to v3 to support Kyverno 1.10 architectural - split (single Deployment -> multiple controllers)., Chart values are reorganized - per controller (admission/reports/background) and supplemented with a higher-level - `features` configuration section., 'Helm templates/refactoring: configmap - management, RBAC/role aggregation, tests, labels, network policies, and - CRD handling were substantially reworked.', 'Deployment naming updates: - admission controller Deployment renamed to `kyverno-admission-controller`; - additional controllers added.', 'Operational hardening: chart enforces at - least 1 replica for the admission controller.', 'Improved configurability: - ServiceAccount annotations supported for all SAs; configurable Grafana ConfigMap - name; configurable PDB API version; configurable Sigstore TUF root volume.', - 'Monitoring fixes/additions: missing ServiceMonitor for background controller - added; various Helm hook/imagePullSecret propagation fixes.'] - features: ['Kyverno is split into three controllers (admission, background, - reports), improving separation of responsibilities and scaling options.', - 'Kyverno policies can now make authenticated calls to in-cluster Services - (with verb control), enabling richer external-data and integration patterns.', - VerifyImages gains Notary signature verification support in addition to existing - Cosign flows., 'Mutate-existing rules now support context variables and - preconditions, enabling more expressive background mutations.', PolicyExceptions - now support background scanning and wildcard ruleNames for broader exception - handling., 'New JMESPath helpers (e.g., `image_normalize()`, `to_boolean()`, - `trim_prefix()`, enhanced `sum()`) expand policy authoring options.', Performance - improvements to reporting aggregation (higher workers/QPS/burst and new - cleanup jobs) reduce delays in large clusters.] - breaking_changes: ["**No direct in-place upgrade path** from 1.9 to 1.10 due\ - \ to controller decomposition; plan downtime and use Helm v2\u2192v3 migration\ - \ steps (backup/restore policies or scale Kyverno to 0 first).", "Aggregated\ - \ ClusterRoles may need updates to match **new label selectors** for the\ - \ decomposed controllers\u2019 RBAC aggregation.", 'Policies matching subresources - must use the standardized `Parent/subresource` form (e.g., `Pod/exec`); - some subresource matches will be rejected when background scanning is enabled.', - 'Generate rules: several fields are now **immutable** after creation and certain - variable usages are disallowed; additionally `generate.apiVersion` is now - **required**.', 'Generate-existing behavior changes: `spec.generateExistingOnPolicyUpdate` - is deprecated in favor of `spec.generateExisting`; update policies accordingly.', - 'Mutate existing enforcement: when `mutateExistingOnPolicyUpdate=true`, `mutate.targets[]` - must be defined or policy creation is blocked.', 'VerifyImages in Audit - mode: policy creation is rejected unless `mutateDigest=false`.', 'Mutation - behavior change: Kyverno no longer implicitly adds `docker.io` to image - context; adjust policies to use `images.*.registry` or `image_normalize()` - instead.'] + chart_updates: + - Chart migrates from v2 to v3 to support Kyverno 1.10 architectural split (single + Deployment -> multiple controllers). + - Chart values are reorganized per controller (admission/reports/background) + and supplemented with a higher-level `features` configuration section. + - 'Helm templates/refactoring: configmap management, RBAC/role aggregation, + tests, labels, network policies, and CRD handling were substantially reworked.' + - 'Deployment naming updates: admission controller Deployment renamed to `kyverno-admission-controller`; + additional controllers added.' + - 'Operational hardening: chart enforces at least 1 replica for the admission + controller.' + - 'Improved configurability: ServiceAccount annotations supported for all SAs; + configurable Grafana ConfigMap name; configurable PDB API version; configurable + Sigstore TUF root volume.' + - 'Monitoring fixes/additions: missing ServiceMonitor for background controller + added; various Helm hook/imagePullSecret propagation fixes.' + features: + - Kyverno is split into three controllers (admission, background, reports), + improving separation of responsibilities and scaling options. + - Kyverno policies can now make authenticated calls to in-cluster Services (with + verb control), enabling richer external-data and integration patterns. + - VerifyImages gains Notary signature verification support in addition to existing + Cosign flows. + - Mutate-existing rules now support context variables and preconditions, enabling + more expressive background mutations. + - PolicyExceptions now support background scanning and wildcard ruleNames for + broader exception handling. + - New JMESPath helpers (e.g., `image_normalize()`, `to_boolean()`, `trim_prefix()`, + enhanced `sum()`) expand policy authoring options. + - Performance improvements to reporting aggregation (higher workers/QPS/burst + and new cleanup jobs) reduce delays in large clusters. + breaking_changes: + - "**No direct in-place upgrade path** from 1.9 to 1.10 due to controller decomposition;\ + \ plan downtime and use Helm v2\u2192v3 migration steps (backup/restore policies\ + \ or scale Kyverno to 0 first)." + - "Aggregated ClusterRoles may need updates to match **new label selectors**\ + \ for the decomposed controllers\u2019 RBAC aggregation." + - Policies matching subresources must use the standardized `Parent/subresource` + form (e.g., `Pod/exec`); some subresource matches will be rejected when background + scanning is enabled. + - 'Generate rules: several fields are now **immutable** after creation and certain + variable usages are disallowed; additionally `generate.apiVersion` is now + **required**.' + - 'Generate-existing behavior changes: `spec.generateExistingOnPolicyUpdate` + is deprecated in favor of `spec.generateExisting`; update policies accordingly.' + - 'Mutate existing enforcement: when `mutateExistingOnPolicyUpdate=true`, `mutate.targets[]` + must be defined or policy creation is blocked.' + - 'VerifyImages in Audit mode: policy creation is rejected unless `mutateDigest=false`.' + - 'Mutation behavior change: Kyverno no longer implicitly adds `docker.io` to + image context; adjust policies to use `images.*.registry` or `image_normalize()` + instead.' chart_version: 3.0.0 - images: ['bitnami/kubectl:1.26.4', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.10.0', - 'ghcr.io/kyverno/cleanup-controller:v1.10.0', 'ghcr.io/kyverno/kyverno:v1.10.0', - 'ghcr.io/kyverno/kyvernopre:v1.10.0', 'ghcr.io/kyverno/reports-controller:v1.10.0'] + images: + - bitnami/kubectl:1.26.4 + - busybox:1.35 + - ghcr.io/kyverno/background-controller:v1.10.0 + - ghcr.io/kyverno/cleanup-controller:v1.10.0 + - ghcr.io/kyverno/kyverno:v1.10.0 + - ghcr.io/kyverno/kyvernopre:v1.10.0 + - ghcr.io/kyverno/reports-controller:v1.10.0 eolAt: '2024-10-29' - version: 1.9.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -21555,49 +28047,65 @@ addons: \ `_` instead of `+` to avoid Flux reconciliation failures (relevant if you\ \ use Flux and versions with build metadata).\n - Helm test pod busybox image\ \ is pinned; initContainer extraArgs handling fixed.\n" - chart_updates: ['Reports system and CRDs were overhauled in 1.8: `ReportChangeRequest`/`ClusterReportChangeRequest` - removed and replaced with `AdmissionReport`, `ClusterAdmissionReport`, `BackgroundScanReport`, - `ClusterBackgroundScanReport` CRDs. Ensure CRDs are updated as part of the - upgrade and any tooling consuming old CRDs is updated.', 'Kyverno introduced/advanced - the **v2beta1** API for Kyverno resources, intended to remove deprecated - fields/types. Plan a migration path for policies using deprecated fields.', - 'Autogen behavior changed: in 1.8 autogen moved to `status` (not `spec`) and - is enabled by default; in 1.9 the deprecated `--autogenInternals` flag is - removed and the behavior is automatic.', 'Webhooks behavior changed in 1.9: - separate webhook rules per GVK; AdmissionReview v1 is used instead of v1beta1. - This may affect clusters/components expecting v1beta1 AdmissionReview.', - 'New alpha CRDs/resources added in 1.9: **PolicyException** and **CleanupPolicy** - (and associated cleanup controller components when enabled).'] - features: [PolicyException (alpha) to define exceptions to policy enforcement - without editing the policy itself., 'CleanupPolicy (alpha) to automate cleanup/removal - of resources matching criteria, delivered with an optional cleanup controller.', - 'Distributed tracing improvements building on OpenTelemetry support, enabling - better end-to-end request visibility.', Nested `foreach` loops in policies - for more complex iteration logic., Extended subresource support in webhook - and CLI for validation/mutation across more Kubernetes subresources., ConfigMap - caching to improve performance and reduce API load for repeated ConfigMap - lookups., 'CLI enhancements: dump AdmissionReview payload, audit/warn flags, - accept policies via stdin/pipes, git repo policy sources, and experimental - OCI push/pull of policies.', 'verifyImages enhancements: key signature algorithm - selection, attestations attestors, and (Helm) support for existing imagePullSecrets.', - 'Kubernetes version support extended (1.25 in 1.8, 1.26 in 1.9).'] - breaking_changes: ['JMESPath behavior change (introduced in 1.8): unresolved - expressions now evaluate to `null` instead of empty string; some policies - may need explicit existence checks to avoid unexpected denies/mutations.', - 'Reporting CRDs changed (1.8): old RCR CRDs removed and replaced; any automation - querying old CRDs will break until updated.', 'CLI/flags: `--splitPolicyReport` - and `--autogenInternals` are removed in 1.9; deployments using these flags - will fail to start until removed.', 'verifyImages attestations: new `verifyImages.attestations.attestors` - is for attestations while existing `verifyImages.attestors` remains for - signatures; misconfiguration can cause verification failures.', 'Operational - change (1.9): if Kyverno is down, new/changed policies are blocked until - Kyverno returns, which can impact GitOps rollouts during outages.'] + chart_updates: + - 'Reports system and CRDs were overhauled in 1.8: `ReportChangeRequest`/`ClusterReportChangeRequest` + removed and replaced with `AdmissionReport`, `ClusterAdmissionReport`, `BackgroundScanReport`, + `ClusterBackgroundScanReport` CRDs. Ensure CRDs are updated as part of the + upgrade and any tooling consuming old CRDs is updated.' + - Kyverno introduced/advanced the **v2beta1** API for Kyverno resources, intended + to remove deprecated fields/types. Plan a migration path for policies using + deprecated fields. + - 'Autogen behavior changed: in 1.8 autogen moved to `status` (not `spec`) and + is enabled by default; in 1.9 the deprecated `--autogenInternals` flag is + removed and the behavior is automatic.' + - 'Webhooks behavior changed in 1.9: separate webhook rules per GVK; AdmissionReview + v1 is used instead of v1beta1. This may affect clusters/components expecting + v1beta1 AdmissionReview.' + - 'New alpha CRDs/resources added in 1.9: **PolicyException** and **CleanupPolicy** + (and associated cleanup controller components when enabled).' + features: + - PolicyException (alpha) to define exceptions to policy enforcement without + editing the policy itself. + - CleanupPolicy (alpha) to automate cleanup/removal of resources matching criteria, + delivered with an optional cleanup controller. + - Distributed tracing improvements building on OpenTelemetry support, enabling + better end-to-end request visibility. + - Nested `foreach` loops in policies for more complex iteration logic. + - Extended subresource support in webhook and CLI for validation/mutation across + more Kubernetes subresources. + - ConfigMap caching to improve performance and reduce API load for repeated + ConfigMap lookups. + - 'CLI enhancements: dump AdmissionReview payload, audit/warn flags, accept + policies via stdin/pipes, git repo policy sources, and experimental OCI push/pull + of policies.' + - 'verifyImages enhancements: key signature algorithm selection, attestations + attestors, and (Helm) support for existing imagePullSecrets.' + - Kubernetes version support extended (1.25 in 1.8, 1.26 in 1.9). + breaking_changes: + - 'JMESPath behavior change (introduced in 1.8): unresolved expressions now + evaluate to `null` instead of empty string; some policies may need explicit + existence checks to avoid unexpected denies/mutations.' + - 'Reporting CRDs changed (1.8): old RCR CRDs removed and replaced; any automation + querying old CRDs will break until updated.' + - 'CLI/flags: `--splitPolicyReport` and `--autogenInternals` are removed in + 1.9; deployments using these flags will fail to start until removed.' + - 'verifyImages attestations: new `verifyImages.attestations.attestors` is for + attestations while existing `verifyImages.attestors` remains for signatures; + misconfiguration can cause verification failures.' + - 'Operational change (1.9): if Kyverno is down, new/changed policies are blocked + until Kyverno returns, which can impact GitOps rollouts during outages.' chart_version: 2.7.0 - images: ['busybox:1.35', 'ghcr.io/kyverno/cleanup-controller:v1.9.0', 'ghcr.io/kyverno/kyverno:v1.9.0', - 'ghcr.io/kyverno/kyvernopre:v1.9.0'] + images: + - busybox:1.35 + - ghcr.io/kyverno/cleanup-controller:v1.9.0 + - ghcr.io/kyverno/kyverno:v1.9.0 + - ghcr.io/kyverno/kyvernopre:v1.9.0 eolAt: '2024-04-26' - version: 1.8.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: @@ -21617,34 +28125,48 @@ addons: \ re-check after upgrade.\n- **Note**: upstream release notes mention \u201C\ several Helm chart changes with both kyverno and kyverno-policies\u201D; review\ \ the chart changelog for your exact chart versions (not provided here).\n" - chart_updates: [New reporting system v2 (ground-up refactor) which changes/renames - reporting CRDs., 'Aggregated ClusterRoles are now used, simplifying adding - custom permissions but changing RBAC shape.', 'Improved certificate management: - dynamic certificate fetching and more graceful rotation; CA key is now included - in the Kyverno Secret; self-signed certs no longer need annotation.', Autogen - internals enabled by default; autogen results stored in policy status rather - than spec., 'Build/distribution changes: Kyverno images built with `ko` - by default and use a distroless base image.', Support added for Kubernetes - 1.25., Event RBAC tightened (reduced permissions).] - features: [New validate subrule `podSecurity` integrates Pod Security Admission - libraries to validate workloads against PSA controls., New validate subrule - `manifests` supports YAML manifest signature validation., Generate rules - can now generate multiple resources in a single rule (including selection - via labels)., OpenTelemetry support for traces/metrics export., New policy - field `applyRules` controls whether one or all rules are applied., New JMESPath - functions including `x509_decode` (decode X.509 certs) and `random` (composable - random strings).] - breaking_changes: ['Unresolved JMESPath expressions now evaluate to `null` instead - of empty string (`''''`), which can change preconditions/deny logic; policies - may need existence checks to avoid unintended denies/mutations.', Reporting - CRDs `ReportChangeRequest` and `ClusterReportChangeRequest` were removed - and replaced by Admission/BackgroundScan report CRDs; any tooling relying - on the old CRDs must be updated.] + chart_updates: + - New reporting system v2 (ground-up refactor) which changes/renames reporting + CRDs. + - Aggregated ClusterRoles are now used, simplifying adding custom permissions + but changing RBAC shape. + - 'Improved certificate management: dynamic certificate fetching and more graceful + rotation; CA key is now included in the Kyverno Secret; self-signed certs + no longer need annotation.' + - Autogen internals enabled by default; autogen results stored in policy status + rather than spec. + - 'Build/distribution changes: Kyverno images built with `ko` by default and + use a distroless base image.' + - Support added for Kubernetes 1.25. + - Event RBAC tightened (reduced permissions). + features: + - New validate subrule `podSecurity` integrates Pod Security Admission libraries + to validate workloads against PSA controls. + - New validate subrule `manifests` supports YAML manifest signature validation. + - Generate rules can now generate multiple resources in a single rule (including + selection via labels). + - OpenTelemetry support for traces/metrics export. + - New policy field `applyRules` controls whether one or all rules are applied. + - New JMESPath functions including `x509_decode` (decode X.509 certs) and `random` + (composable random strings). + breaking_changes: + - Unresolved JMESPath expressions now evaluate to `null` instead of empty string + (`''`), which can change preconditions/deny logic; policies may need existence + checks to avoid unintended denies/mutations. + - Reporting CRDs `ReportChangeRequest` and `ClusterReportChangeRequest` were + removed and replaced by Admission/BackgroundScan report CRDs; any tooling + relying on the old CRDs must be updated. chart_version: 2.6.0 - images: [busybox, 'ghcr.io/kyverno/kyverno:v1.8.0', 'ghcr.io/kyverno/kyvernopre:v1.8.0'] + images: + - busybox + - ghcr.io/kyverno/kyverno:v1.8.0 + - ghcr.io/kyverno/kyvernopre:v1.8.0 eolAt: '2023-11-10' - version: 1.7.0 - kube: ['1.23', '1.22', '1.21'] + kube: + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -21662,40 +28184,57 @@ addons: \ `config.resourceFilters` and Helm release name/namespace interactions; review\ \ your custom `config.resourceFilters` to ensure Kyverno isn\u2019t unintentionally\ \ processing or skipping resources (especially in the Kyverno namespace)." - chart_updates: [Policy status representation updated to use `status.conditions` - internally; `status.ready` is deprecated (kept for a couple of releases)., - Deprecated flags removed (and some config moved to ConfigMap-only)., 'Policy - schema/behavior changes around autogen internals: Kyverno reduces/stops - mutating policies in some cases when autogen internals are enabled.', 'CRD - lifecycle/compat: drop `v1alpha1` PolicyReport CRD (noted as an enhancement).', - UpdateRequest/GenerateRequest work evolved (UR controller changes; backward - compatibility noted where GenerateRequest converts to UpdateRequest)., 'Security/operability - hardening: seccomp profile and various controller refactors; improved webhook/config - controller behavior and cache sync handling.'] - features: ['Major expansion of image verification capabilities: support for - certificate chains, multiple keys, required signed images, digest enforcement/mutation, - and better CLI testing for image verification rules.', 'Policy authoring - improvements: inline variables in context, richer `foreach` support (including - broader request.* JMESPath usage), and new JMESPath functions.', 'Operational - features: webhooks object selector support and ability to disable leader - election for the UpdateRequest controller in certain scenarios.'] - breaking_changes: ['`mutate.overlay` and `mutate.patches` (deprecated since - 1.4) were **removed in v1.6.0**; any policies still using them must be migrated - before/while upgrading.', 'In v1.7.0, **deprecated CLI flags were removed**, - and some options (`filterK8sResources`, `excludeGroupRole`, `excludeUsername`) - can now be configured **only via the Kyverno ConfigMap**. This can break - existing deployments relying on those flags.', '`status.ready` on policies - is **deprecated** in v1.7.0 in favor of `status.conditions`/`policy.IsReady()`; - if you have tooling/scripts reading `status.ready`, plan to migrate.'] + chart_updates: + - Policy status representation updated to use `status.conditions` internally; + `status.ready` is deprecated (kept for a couple of releases). + - Deprecated flags removed (and some config moved to ConfigMap-only). + - 'Policy schema/behavior changes around autogen internals: Kyverno reduces/stops + mutating policies in some cases when autogen internals are enabled.' + - 'CRD lifecycle/compat: drop `v1alpha1` PolicyReport CRD (noted as an enhancement).' + - UpdateRequest/GenerateRequest work evolved (UR controller changes; backward + compatibility noted where GenerateRequest converts to UpdateRequest). + - 'Security/operability hardening: seccomp profile and various controller refactors; + improved webhook/config controller behavior and cache sync handling.' + features: + - 'Major expansion of image verification capabilities: support for certificate + chains, multiple keys, required signed images, digest enforcement/mutation, + and better CLI testing for image verification rules.' + - 'Policy authoring improvements: inline variables in context, richer `foreach` + support (including broader request.* JMESPath usage), and new JMESPath functions.' + - 'Operational features: webhooks object selector support and ability to disable + leader election for the UpdateRequest controller in certain scenarios.' + breaking_changes: + - '`mutate.overlay` and `mutate.patches` (deprecated since 1.4) were **removed + in v1.6.0**; any policies still using them must be migrated before/while upgrading.' + - In v1.7.0, **deprecated CLI flags were removed**, and some options (`filterK8sResources`, + `excludeGroupRole`, `excludeUsername`) can now be configured **only via the + Kyverno ConfigMap**. This can break existing deployments relying on those + flags. + - '`status.ready` on policies is **deprecated** in v1.7.0 in favor of `status.conditions`/`policy.IsReady()`; + if you have tooling/scripts reading `status.ready`, plan to migrate.' chart_version: 2.4.0 - images: [busybox, 'ghcr.io/kyverno/kyverno:v1.7.0', 'ghcr.io/kyverno/kyvernopre:v1.7.0'] + images: + - busybox + - ghcr.io/kyverno/kyverno:v1.7.0 + - ghcr.io/kyverno/kyvernopre:v1.7.0 - version: 1.6.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: [busybox, 'ghcr.io/kyverno/kyverno:v1.6.0', 'ghcr.io/kyverno/kyvernopre:v1.6.0'] + images: + - busybox + - ghcr.io/kyverno/kyverno:v1.6.0 + - ghcr.io/kyverno/kyvernopre:v1.6.0 name: kyverno - icon: https://avatars.githubusercontent.com/u/25301026?s=200&v=4 git_url: https://github.com/linkerd/linkerd2 @@ -21703,59 +28242,143 @@ addons: helm_repository_url: https://helm.linkerd.io/stable versions: - version: 2.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null - version: 2.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null - version: 2.18.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23', '1.22'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 2.17.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', - '1.22'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 2.16.0 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 2.15.0 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 2.14.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 2.13.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 2.12.0 - kube: ['1.24', '1.23', '1.22', '1.21'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 2.11.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null - version: 2.10.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null @@ -21766,8 +28389,18 @@ addons: helm_repository_url: https://charts.longhorn.io versions: - version: 1.10.1 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -21787,25 +28420,40 @@ addons: *before* the Helm upgrade. ' - chart_updates: ['Helm chart behavior improvement: `defaultSettings` handling - supports automatic quoting and multiple types (reduces YAML/JSON typing - pitfalls when setting Longhorn global settings via Helm).'] - features: ['V2 Data Engine: interrupt mode now supports **NVMe disks** starting - in v1.10.1 (v1.10.0 supported AIO disks only).', 'Improved scheduling visibility: - `CSIStorageCapacity` objects show schedulable/allocatable capacity (helps - capacity-aware scheduling with `WaitForFirstConsumer`).', Adds/extends installation - variant usage metrics (observability/telemetry improvement).] - breaking_changes: ['Longhorn v1.10.0 removes the `longhorn.io/v1beta1` API and - removes the deprecated `replica.status.evictionRequested` field. If any - CRs are still stored as `v1beta1`, upgrades to v1.10.x can fail until you - migrate CRD storedVersions to `v1beta2`.', 'Kubernetes requirement: v1.10.x - requires **Kubernetes v1.25+**; upgrading on older clusters is unsupported.'] + chart_updates: + - 'Helm chart behavior improvement: `defaultSettings` handling supports automatic + quoting and multiple types (reduces YAML/JSON typing pitfalls when setting + Longhorn global settings via Helm).' + features: + - 'V2 Data Engine: interrupt mode now supports **NVMe disks** starting in v1.10.1 + (v1.10.0 supported AIO disks only).' + - 'Improved scheduling visibility: `CSIStorageCapacity` objects show schedulable/allocatable + capacity (helps capacity-aware scheduling with `WaitForFirstConsumer`).' + - Adds/extends installation variant usage metrics (observability/telemetry improvement). + breaking_changes: + - Longhorn v1.10.0 removes the `longhorn.io/v1beta1` API and removes the deprecated + `replica.status.evictionRequested` field. If any CRs are still stored as `v1beta1`, + upgrades to v1.10.x can fail until you migrate CRD storedVersions to `v1beta2`. + - 'Kubernetes requirement: v1.10.x requires **Kubernetes v1.25+**; upgrading + on older clusters is unsupported.' chart_version: 1.10.1 - images: ['longhornio/longhorn-manager:v1.10.1', 'longhornio/longhorn-share-manager:v1.10.1', - 'longhornio/longhorn-ui:v1.10.1'] + images: + - longhornio/longhorn-manager:v1.10.1 + - longhornio/longhorn-share-manager:v1.10.1 + - longhornio/longhorn-ui:v1.10.1 - version: 1.10.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -21822,43 +28470,64 @@ addons: \ to support per\u2013data-engine JSON values; if you currently set these\ \ via Helm `defaultSettings`, validate they still apply as intended (see \u201C\ Consolidated Global Settings\u201D below).\n" - chart_updates: ['Hotfix guidance: v1.10.0 chart should deploy `longhorn-manager:v1.10.0-hotfix-1` - instead of `v1.10.0` to avoid a share-manager backoff regression (manager - crash loop / inability to deploy new share-manager pods).', 'Pre-upgrade - requirement: ensure Longhorn CRDs no longer store `v1beta1` objects in `status.storedVersions` - before upgrading to v1.10 (manual storage-version migration may be required).', - 'API removal: `longhorn.io/v1beta1` is removed in v1.10; clusters with leftover - `v1beta1` stored objects can fail CRD patching during upgrade.', 'Field - removal: deprecated `replica.status.evictionRequested` removed in v1.10.'] - features: ['V2 Data Engine: interrupt mode (AIO disks only) to reduce CPU usage - on idle/low I/O workloads.', 'V2 Data Engine: volume & snapshot cloning - (full-copy clone and fast linked/smart clone).', 'V2 Data Engine: replica - rebuild QoS / bandwidth limiting (global or per volume) to reduce rebuild - impact.', 'V2 Data Engine: volume expansion supported (PVC resize/UI).', - 'V2 Data Engine: can run without hugepages (more flexible on low-spec nodes; - possible performance tradeoff).', 'V1 Data Engine: single-stack IPv6 support - (dual-stack and V2 IPv6 not supported in this release).', 'Kubernetes scheduling: - CSIStorageCapacity support for better placement with `WaitForFirstConsumer` - StorageClasses.', 'Backups: configurable backup block size at volume creation - time.', 'UX/observability: consolidated settings model allowing per-engine - values via JSON; UI shows volume attachment ticket summaries.'] - breaking_changes: ['`longhorn.io/v1beta1` API is removed in v1.10; upgrades - will fail if any CRDs still have `v1beta1` as a stored version or any objects - persisted in `v1beta1`. Manual CRD storage-version migration is strongly - advised before upgrading from v1.9 to v1.10, especially for clusters originally - installed < v1.3.0 or after etcd/CRD restores.', Deprecated `replica.status.evictionRequested` - field is removed; any tooling that reads/writes it must be updated., "Settings\ - \ consolidation: several global settings now support per\u2013data-engine\ - \ values via JSON (`{\"v1\":..., \"v2\":...}`); existing automation that\ - \ assumes simple string values may need updates.", 'Known regression: `longhorn-manager:v1.10.0` - can crash due to share-manager backoff logic; plan to use `v1.10.0-hotfix-1` - during upgrade to avoid instability.'] + chart_updates: + - 'Hotfix guidance: v1.10.0 chart should deploy `longhorn-manager:v1.10.0-hotfix-1` + instead of `v1.10.0` to avoid a share-manager backoff regression (manager + crash loop / inability to deploy new share-manager pods).' + - 'Pre-upgrade requirement: ensure Longhorn CRDs no longer store `v1beta1` objects + in `status.storedVersions` before upgrading to v1.10 (manual storage-version + migration may be required).' + - 'API removal: `longhorn.io/v1beta1` is removed in v1.10; clusters with leftover + `v1beta1` stored objects can fail CRD patching during upgrade.' + - 'Field removal: deprecated `replica.status.evictionRequested` removed in v1.10.' + features: + - 'V2 Data Engine: interrupt mode (AIO disks only) to reduce CPU usage on idle/low + I/O workloads.' + - 'V2 Data Engine: volume & snapshot cloning (full-copy clone and fast linked/smart + clone).' + - 'V2 Data Engine: replica rebuild QoS / bandwidth limiting (global or per volume) + to reduce rebuild impact.' + - 'V2 Data Engine: volume expansion supported (PVC resize/UI).' + - 'V2 Data Engine: can run without hugepages (more flexible on low-spec nodes; + possible performance tradeoff).' + - 'V1 Data Engine: single-stack IPv6 support (dual-stack and V2 IPv6 not supported + in this release).' + - 'Kubernetes scheduling: CSIStorageCapacity support for better placement with + `WaitForFirstConsumer` StorageClasses.' + - 'Backups: configurable backup block size at volume creation time.' + - 'UX/observability: consolidated settings model allowing per-engine values + via JSON; UI shows volume attachment ticket summaries.' + breaking_changes: + - '`longhorn.io/v1beta1` API is removed in v1.10; upgrades will fail if any + CRDs still have `v1beta1` as a stored version or any objects persisted in + `v1beta1`. Manual CRD storage-version migration is strongly advised before + upgrading from v1.9 to v1.10, especially for clusters originally installed + < v1.3.0 or after etcd/CRD restores.' + - Deprecated `replica.status.evictionRequested` field is removed; any tooling + that reads/writes it must be updated. + - "Settings consolidation: several global settings now support per\u2013data-engine\ + \ values via JSON (`{\"v1\":..., \"v2\":...}`); existing automation that assumes\ + \ simple string values may need updates." + - 'Known regression: `longhorn-manager:v1.10.0` can crash due to share-manager + backoff logic; plan to use `v1.10.0-hotfix-1` during upgrade to avoid instability.' chart_version: 1.10.0 - images: ['longhornio/longhorn-manager:v1.10.0', 'longhornio/longhorn-share-manager:v1.10.0', - 'longhornio/longhorn-ui:v1.10.0'] + images: + - longhornio/longhorn-manager:v1.10.0 + - longhornio/longhorn-share-manager:v1.10.0 + - longhornio/longhorn-ui:v1.10.0 - version: 1.9.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -21873,34 +28542,52 @@ addons: \ Kubernetes objects.\n - Fix: `persistence.backupTargetName` was not referenced\ \ in the StorageClass template (verify your StorageClass rendering if you\ \ relied on this).\n" - chart_updates: [v1.9.0 removes the deprecated `environment_check.sh` script - from the release artifacts (use `longhornctl` for preflight checks instead)., - "CRDs: deprecated fields removed from `longhorn.io/v1beta2` CRDs; ensure CRs/manifests\ - \ don\u2019t rely on removed fields.", 'Settings migration: `orphan-auto-deletion` - is replaced by `orphan-resource-auto-deletion` and is auto-migrated during - upgrade.'] - features: [Recurring **system backups** can now be scheduled via recurring jobs - (new operational safety net)., '**Offline replica rebuilding** (v1 and v2) - can automatically rebuild replicas while volumes are detached (disabled - by default).', '**Orphaned instance cleanup** can track and delete leftover - engine/replica runtime resources (disabled by default).', 'Improved **observability/metrics**: - new Prometheus metrics for replica/engine CR identity and rebuild status.', - 'V2 Data Engine enhancements: **UBLK frontend** support and **storage network** - support (still experimental).'] - breaking_changes: [Kubernetes **v1.25+ is required** for Longhorn v1.9.x upgrades/installs - (blocker if cluster is older)., V2 **backing images are incompatible** with - earlier versions due to xattr naming conflicts; you must delete/recreate - V2 backing images during upgrade and restore any dependent volumes from - backups., '`longhorn.io/v1beta1` API is now unserved/unsupported in v1.9.0 - and will be removed in v1.10.0; any tooling using v1beta1 must move to v1beta2.', - 'Setting rename: `orphan-auto-deletion` replaced by `orphan-resource-auto-deletion` - (auto-migrated, but automation/scripts must be updated).'] + chart_updates: + - v1.9.0 removes the deprecated `environment_check.sh` script from the release + artifacts (use `longhornctl` for preflight checks instead). + - "CRDs: deprecated fields removed from `longhorn.io/v1beta2` CRDs; ensure CRs/manifests\ + \ don\u2019t rely on removed fields." + - 'Settings migration: `orphan-auto-deletion` is replaced by `orphan-resource-auto-deletion` + and is auto-migrated during upgrade.' + features: + - Recurring **system backups** can now be scheduled via recurring jobs (new + operational safety net). + - '**Offline replica rebuilding** (v1 and v2) can automatically rebuild replicas + while volumes are detached (disabled by default).' + - '**Orphaned instance cleanup** can track and delete leftover engine/replica + runtime resources (disabled by default).' + - 'Improved **observability/metrics**: new Prometheus metrics for replica/engine + CR identity and rebuild status.' + - 'V2 Data Engine enhancements: **UBLK frontend** support and **storage network** + support (still experimental).' + breaking_changes: + - Kubernetes **v1.25+ is required** for Longhorn v1.9.x upgrades/installs (blocker + if cluster is older). + - V2 **backing images are incompatible** with earlier versions due to xattr + naming conflicts; you must delete/recreate V2 backing images during upgrade + and restore any dependent volumes from backups. + - '`longhorn.io/v1beta1` API is now unserved/unsupported in v1.9.0 and will + be removed in v1.10.0; any tooling using v1beta1 must move to v1beta2.' + - 'Setting rename: `orphan-auto-deletion` replaced by `orphan-resource-auto-deletion` + (auto-migrated, but automation/scripts must be updated).' chart_version: 1.9.0 - images: ['longhornio/longhorn-manager:v1.9.0', 'longhornio/longhorn-share-manager:v1.9.0', - 'longhornio/longhorn-ui:v1.9.0'] + images: + - longhornio/longhorn-manager:v1.9.0 + - longhornio/longhorn-share-manager:v1.9.0 + - longhornio/longhorn-ui:v1.9.0 - version: 1.8.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -21928,71 +28615,112 @@ addons: \ backup target.\n- **RWX expansion behavior:** v1.8.0 supports **automatic\ \ online RWX volume expansion** when **manager, share-manager, and CSI plugin\ \ are all at v1.8.0** (so avoid mixed-version states longer than necessary).\n" - chart_updates: ["Longhorn v1.8.0 includes the standard chart/app refresh plus:\ - \ (1) updated CSI external-snapshotter (v8.2.0), which drives the Kubernetes\ - \ v1.25+ requirement; (2) support for installation/upgrade via the built-in\ - \ Helm Controller for K3s/RKE2 using a HelmChart CRD; (3) a warning that\ - \ the longhorn/longhorn repo\u2019s v1.8.0 manifest and chart had an incorrect\ - \ image tag (`v1.8.x-head`), so ensure your chart source is correct (prefer\ - \ charts.longhorn.io or fix the tag before applying)."] - features: ['Multiple backupstores support, including creation of a default backup - target named `default` used for system backups and volumes without a specified - target.', Automatic online RWX volume expansion (no workload scale-down/manual - resize steps) when all Longhorn components are on v1.8.0., 'V2 Data Engine - enhancements: configurable CPU cores, DR volumes, auto-salvage, live migration, - volume encryption, delta replica rebuild using snapshot checksums, and backing - image update/download.', Support installing/upgrading Longhorn on K3s/RKE2 - via the built-in Helm Controller (HelmChart CRD workflow)., V2 Data Engine - support for Talos Linux (assuming prerequisites are met).] - breaking_changes: [Kubernetes minimum version is now **v1.25+** for Longhorn - v1.8.0 due to CSI external-snapshotter v8.2.0; clusters below v1.25 must - upgrade Kubernetes before upgrading Longhorn., V2 block-type disk default - block size changed from **4096** to **512** bytes; existing V2 volumes on - 4k-block disks require a disruptive migrate/restore procedure to align with - the new default and avoid incompatibilities with V1-generated backing images., - 'If you upgraded using the *main* longhorn/longhorn repo chart/manifest without - fixing the image tag, you may have deployed `v1.8.x-head` images; you must - correct to `v1.8.0` and update engine images for affected volumes.'] + chart_updates: + - "Longhorn v1.8.0 includes the standard chart/app refresh plus: (1) updated\ + \ CSI external-snapshotter (v8.2.0), which drives the Kubernetes v1.25+ requirement;\ + \ (2) support for installation/upgrade via the built-in Helm Controller for\ + \ K3s/RKE2 using a HelmChart CRD; (3) a warning that the longhorn/longhorn\ + \ repo\u2019s v1.8.0 manifest and chart had an incorrect image tag (`v1.8.x-head`),\ + \ so ensure your chart source is correct (prefer charts.longhorn.io or fix\ + \ the tag before applying)." + features: + - Multiple backupstores support, including creation of a default backup target + named `default` used for system backups and volumes without a specified target. + - Automatic online RWX volume expansion (no workload scale-down/manual resize + steps) when all Longhorn components are on v1.8.0. + - 'V2 Data Engine enhancements: configurable CPU cores, DR volumes, auto-salvage, + live migration, volume encryption, delta replica rebuild using snapshot checksums, + and backing image update/download.' + - Support installing/upgrading Longhorn on K3s/RKE2 via the built-in Helm Controller + (HelmChart CRD workflow). + - V2 Data Engine support for Talos Linux (assuming prerequisites are met). + breaking_changes: + - Kubernetes minimum version is now **v1.25+** for Longhorn v1.8.0 due to CSI + external-snapshotter v8.2.0; clusters below v1.25 must upgrade Kubernetes + before upgrading Longhorn. + - V2 block-type disk default block size changed from **4096** to **512** bytes; + existing V2 volumes on 4k-block disks require a disruptive migrate/restore + procedure to align with the new default and avoid incompatibilities with V1-generated + backing images. + - If you upgraded using the *main* longhorn/longhorn repo chart/manifest without + fixing the image tag, you may have deployed `v1.8.x-head` images; you must + correct to `v1.8.0` and update engine images for affected volumes. chart_version: 1.8.0 - images: ['longhornio/longhorn-manager:v1.8.0', 'longhornio/longhorn-share-manager:v1.8.0', - 'longhornio/longhorn-ui:v1.8.0'] + images: + - longhornio/longhorn-manager:v1.8.0 + - longhornio/longhorn-share-manager:v1.8.0 + - longhornio/longhorn-ui:v1.8.0 - version: 1.7.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Helm chart values.yaml was simplified/cleaned up (less churn, - but expect some keys to have moved/been renamed).', Helm chart added support - for Gateway API and improved Ingress options., 'Chart includes updated defaults/behavior - aligned with Longhorn v1.7.0 features (e.g., RWX storage network support, - monitoring knobs).'] - features: ['V2 Data Engine (still preview) gained online replica rebuild, filesystem - trim, broader SPDK block-disk driver support (AIO/NVMe/VirtIO), and live - data-plane upgrade for V2 volumes (spdk_tgt) with no downtime.', High availability - improvements include HA backing images and experimental RWX fast failover - (faster Share Manager failure detection/response)., Data protection now - supports periodic and on-demand full backups to reduce corruption risk and - improve reliability., Scheduling enhancements improve replica auto-balancing - under disk pressure and speed up rebuilds via local file copying when possible., - Storage network can now be used with RWX volumes for traffic segregation., - Introduced an official Longhorn CLI (longhornctl) for install/ops/troubleshooting - via CRs and in-cluster pod execution., 'Improved platform coverage, including - support for Container-Optimized OS (COS).'] - breaking_changes: [Longhorn v1.7.0 requires Kubernetes v1.21+ for install/upgrade - from 1.6.x., "environment_check.sh is deprecated in v1.7.0 (overlaps with\ - \ the new Longhorn CLI) and scheduled for removal in v1.8.0\u2014don\u2019\ - t build automation around the script going forward.", 'There is a critical - known issue in v1.7.0 affecting volume attachment for clusters with legacy - engine resource names (pre v1.5.2/v1.4.4 pattern); if present, you must - hold the upgrade until v1.7.1.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart values.yaml was simplified/cleaned up (less churn, but expect some + keys to have moved/been renamed). + - Helm chart added support for Gateway API and improved Ingress options. + - Chart includes updated defaults/behavior aligned with Longhorn v1.7.0 features + (e.g., RWX storage network support, monitoring knobs). + features: + - V2 Data Engine (still preview) gained online replica rebuild, filesystem trim, + broader SPDK block-disk driver support (AIO/NVMe/VirtIO), and live data-plane + upgrade for V2 volumes (spdk_tgt) with no downtime. + - High availability improvements include HA backing images and experimental + RWX fast failover (faster Share Manager failure detection/response). + - Data protection now supports periodic and on-demand full backups to reduce + corruption risk and improve reliability. + - Scheduling enhancements improve replica auto-balancing under disk pressure + and speed up rebuilds via local file copying when possible. + - Storage network can now be used with RWX volumes for traffic segregation. + - Introduced an official Longhorn CLI (longhornctl) for install/ops/troubleshooting + via CRs and in-cluster pod execution. + - Improved platform coverage, including support for Container-Optimized OS (COS). + breaking_changes: + - Longhorn v1.7.0 requires Kubernetes v1.21+ for install/upgrade from 1.6.x. + - "environment_check.sh is deprecated in v1.7.0 (overlaps with the new Longhorn\ + \ CLI) and scheduled for removal in v1.8.0\u2014don\u2019t build automation\ + \ around the script going forward." + - There is a critical known issue in v1.7.0 affecting volume attachment for + clusters with legacy engine resource names (pre v1.5.2/v1.4.4 pattern); if + present, you must hold the upgrade until v1.7.1. chart_version: 1.7.0 - images: ['longhornio/longhorn-manager:v1.7.0', 'longhornio/longhorn-share-manager:v1.7.0', - 'longhornio/longhorn-ui:v1.7.0'] + images: + - longhornio/longhorn-manager:v1.7.0 + - longhornio/longhorn-share-manager:v1.7.0 + - longhornio/longhorn-ui:v1.7.0 - version: 1.6.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -22017,81 +28745,124 @@ addons: \ release notes provided don\u2019t list a full values.yaml diff; do a `helm\ \ diff upgrade` between your current chart and the v1.6.0 chart to catch renamed/added/removed\ \ values." - chart_updates: ['Improved GitOps friendliness: validated with Flux/Argo CD/Fleet; - chart adjusted (notably pre-upgrade hook changes) to work better with Argo - CD.', Adds optional Prometheus Operator integration by allowing deployment - of a ServiceMonitor., Adds chart support for configuring StorageClass mount - options and component log level via values.yaml., 'General dependency bumps - and manifest refactors noted in release notes (e.g., CSI component upgrades, - Kubernetes version support updates).'] - features: ['Snapshot space management: define max snapshot count and max total - snapshot size globally or per-volume to control space usage.', 'V2 Data - Engine (preview) gains snapshot/revert and backup/restore, including backup/restore - interoperability between v1 and v2 engines.', 'Platform support broadened: - Talos support and OKD (OpenShift Origin) support added; v2 engine support - on ARM64.', 'Node maintenance enhancements: new node drain policy options - to proactively evict/relocate replicas during planned maintenance.', 'Data - protection: encryption support for `volumeMode: Block` volumes.', 'Backing - image improvements: ability to back up and restore backing images across - clusters.'] - breaking_changes: [Potential behavior change for GitOps installs/upgrades due - to removal/change of the Helm pre-upgrade hook (re-test Argo CD/Flux pipelines)., - "V1/V2 data plane separation and selective v2 activation introduce new operational\ - \ modes; ensure you don\u2019t accidentally enable v2 in production unless\ - \ you intend to (v2 remains preview)."] + chart_updates: + - 'Improved GitOps friendliness: validated with Flux/Argo CD/Fleet; chart adjusted + (notably pre-upgrade hook changes) to work better with Argo CD.' + - Adds optional Prometheus Operator integration by allowing deployment of a + ServiceMonitor. + - Adds chart support for configuring StorageClass mount options and component + log level via values.yaml. + - General dependency bumps and manifest refactors noted in release notes (e.g., + CSI component upgrades, Kubernetes version support updates). + features: + - 'Snapshot space management: define max snapshot count and max total snapshot + size globally or per-volume to control space usage.' + - V2 Data Engine (preview) gains snapshot/revert and backup/restore, including + backup/restore interoperability between v1 and v2 engines. + - 'Platform support broadened: Talos support and OKD (OpenShift Origin) support + added; v2 engine support on ARM64.' + - 'Node maintenance enhancements: new node drain policy options to proactively + evict/relocate replicas during planned maintenance.' + - 'Data protection: encryption support for `volumeMode: Block` volumes.' + - 'Backing image improvements: ability to back up and restore backing images + across clusters.' + breaking_changes: + - Potential behavior change for GitOps installs/upgrades due to removal/change + of the Helm pre-upgrade hook (re-test Argo CD/Flux pipelines). + - "V1/V2 data plane separation and selective v2 activation introduce new operational\ + \ modes; ensure you don\u2019t accidentally enable v2 in production unless\ + \ you intend to (v2 remains preview)." chart_version: 1.6.0 - images: ['longhornio/longhorn-manager:v1.6.0', 'longhornio/longhorn-ui:v1.6.0'] + images: + - longhornio/longhorn-manager:v1.6.0 + - longhornio/longhorn-ui:v1.6.0 - version: 1.5.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Upgrade path is enforced: v1.5.0 supports upgrades only from\ - \ Longhorn 1.4.x (you\u2019re currently on 1.4.0, so you\u2019re in the\ - \ supported path).", 'Instance Manager architecture change: engine+replica - instance managers are consolidated into a single instance-manager, which - affects pod count/resources during/after upgrade.', Admission webhook and - recovery-backend services are merged into longhorn-manager (fewer standalone - components/services)., 'New CRD introduced: Longhorn VolumeAttachment (used - for exclusive attachment and headless operations like cloning/recurring - jobs/backing image export).', 'New/expanded backup stores and backup behaviors: - CIFS and Azure backup stores; backup compression options (lz4/gzip/none).', - 'New/expanded trim and recurring job capabilities: automatic filesystem trim - via recurring job; RWX volume trim; new recurring job types for snapshot - cleanup and delete.', 'New node maintenance behavior: Kubernetes Upgrade - Node Drain Policy and use of PDBs to protect Longhorn components during - drains.', 'Preview feature added: v2/SPDK data engine (disabled by default; - not for production).', "Deprecations/removals called out in 1.5 notes: remove\ - \ global setting mkfs-ext4-parameters; remove system-managed component image\ - \ settings; remove deprecated volume spec recurringJobs fields; remove deprecated\ - \ allow-node-drain-with-last-healthy-replica; remove disable-replica-rebuild\ - \ feature; remove several \u201CGuaranteed * CPU\u201D settings; default\ - \ backup/restore concurrent limits reduced."] - features: ['SPDK-based v2 data engine (preview, disabled by default) for an - alternative datapath with new lifecycle and replica management capabilities.', - 'New VolumeAttachment CRD to ensure exclusive attachment and enable safe headless - operations (clones, recurring jobs, backing image export).', Cluster Autoscaler - support is GA (no longer experimental)., Consolidated instance managers - reduce resource usage during normal operation and upgrades., 'Backup improvements: - new compression methods (lz4/gzip/none) and additional backup stores (CIFS - and Azure).', 'Operations improvements: automatic trim via recurring job, - RWX volume trim, and new recurring jobs for snapshot cleanup/delete.', 'Node - maintenance protection: node drain policy and PDB usage to improve safety - during Kubernetes upgrades/maintenance.'] - breaking_changes: ['Upgrade path enforcement & downgrade prevention: you cannot - downgrade after upgrading, and upgrades are only supported from 1.4.x to - 1.5.0.', "Removed/changed settings and deprecated fields may break existing\ - \ Helm values or automation if you rely on them (e.g., mkfs-ext4-parameters,\ - \ system-managed component image settings, deprecated recurringJobs fields,\ - \ allow-node-drain-with-last-healthy-replica, disable-replica-rebuild, \u201C\ - Guaranteed * CPU\u201D settings)."] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Upgrade path is enforced: v1.5.0 supports upgrades only from Longhorn 1.4.x\ + \ (you\u2019re currently on 1.4.0, so you\u2019re in the supported path)." + - 'Instance Manager architecture change: engine+replica instance managers are + consolidated into a single instance-manager, which affects pod count/resources + during/after upgrade.' + - Admission webhook and recovery-backend services are merged into longhorn-manager + (fewer standalone components/services). + - 'New CRD introduced: Longhorn VolumeAttachment (used for exclusive attachment + and headless operations like cloning/recurring jobs/backing image export).' + - 'New/expanded backup stores and backup behaviors: CIFS and Azure backup stores; + backup compression options (lz4/gzip/none).' + - 'New/expanded trim and recurring job capabilities: automatic filesystem trim + via recurring job; RWX volume trim; new recurring job types for snapshot cleanup + and delete.' + - 'New node maintenance behavior: Kubernetes Upgrade Node Drain Policy and use + of PDBs to protect Longhorn components during drains.' + - 'Preview feature added: v2/SPDK data engine (disabled by default; not for + production).' + - "Deprecations/removals called out in 1.5 notes: remove global setting mkfs-ext4-parameters;\ + \ remove system-managed component image settings; remove deprecated volume\ + \ spec recurringJobs fields; remove deprecated allow-node-drain-with-last-healthy-replica;\ + \ remove disable-replica-rebuild feature; remove several \u201CGuaranteed\ + \ * CPU\u201D settings; default backup/restore concurrent limits reduced." + features: + - SPDK-based v2 data engine (preview, disabled by default) for an alternative + datapath with new lifecycle and replica management capabilities. + - New VolumeAttachment CRD to ensure exclusive attachment and enable safe headless + operations (clones, recurring jobs, backing image export). + - Cluster Autoscaler support is GA (no longer experimental). + - Consolidated instance managers reduce resource usage during normal operation + and upgrades. + - 'Backup improvements: new compression methods (lz4/gzip/none) and additional + backup stores (CIFS and Azure).' + - 'Operations improvements: automatic trim via recurring job, RWX volume trim, + and new recurring jobs for snapshot cleanup/delete.' + - 'Node maintenance protection: node drain policy and PDB usage to improve safety + during Kubernetes upgrades/maintenance.' + breaking_changes: + - 'Upgrade path enforcement & downgrade prevention: you cannot downgrade after + upgrading, and upgrades are only supported from 1.4.x to 1.5.0.' + - "Removed/changed settings and deprecated fields may break existing Helm values\ + \ or automation if you rely on them (e.g., mkfs-ext4-parameters, system-managed\ + \ component image settings, deprecated recurringJobs fields, allow-node-drain-with-last-healthy-replica,\ + \ disable-replica-rebuild, \u201CGuaranteed * CPU\u201D settings)." chart_version: 1.5.0 - images: ['longhornio/longhorn-manager:v1.5.0', 'longhornio/longhorn-ui:v1.5.0'] + images: + - longhornio/longhorn-manager:v1.5.0 + - longhornio/longhorn-ui:v1.5.0 - version: 1.4.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -22107,235 +28878,374 @@ addons: \ - **v1beta1 VolumeSnapshot CRDs are deprecated (still supported)**; you\ \ should migrate to **snapshot.storage.k8s.io/v1** before a future snapshotter\ \ upgrade removes v1beta1 support.\n" - chart_updates: [Kubernetes 1.25 compatibility work (removal of deprecated API - usage such as PodSecurityPolicy by default; PSP becomes opt-in)., Helm chart - docs/readme updates mentioned in release notes (#4175/#4745)., 'Adds/updates - chart-level knobs for scaling certain components (e.g., configurable replica - counts for webhook and RWX recovery-backend) (#5087).', Adds/changes UI - deployment affinity options in the chart (#4987).] - features: [Kubernetes 1.25 support via PSA/optional PSP handling., ARM64 support - promoted to General Availability (GA)., RWX (NFS) support promoted to GA - with recovery backend to improve failover behavior., Snapshot checksum + - periodic verification to detect corruption and support data integrity workflows., - Bit-rot detection and repair for snapshots when snapshot checksum is enabled., - Replica rebuild speed-ups (notably leveraging snapshot checksums/metadata - to reduce unnecessary replication)., Volume trim (UNMAP) support to reclaim - space on block volumes., Online volume expansion support via engine + CSI - node driver filesystem resize., Strict data locality mode to keep a local - replica and use local socket for improved performance., System Backup & - Restore for backing up Longhorn system resources/metadata and restoring - in-place or to a new cluster., Enhanced support bundle collection via rancher/support-bundle-kit - integration., New tunable engine-to-replica timeout setting for low-spec/latent - environments.] - breaking_changes: ['Kubernetes support window shifts: upgrading to v1.4.0 requires - Kubernetes **>=1.21** (and v1.4.0 is intended for newer clusters, including - 1.25).', "PodSecurityPolicy is no longer assumed; on Kubernetes 1.25 you\ - \ must use PSA, and if you still need PSP you must explicitly enable Longhorn\u2019\ - s opt-in PSP support.", VolumeSnapshot v1beta1 API is deprecated (still - works now) and will be removed in a future CSI snapshotter upgrade; plan - migration to v1.] + chart_updates: + - Kubernetes 1.25 compatibility work (removal of deprecated API usage such as + PodSecurityPolicy by default; PSP becomes opt-in). + - Helm chart docs/readme updates mentioned in release notes (#4175/#4745). + - Adds/updates chart-level knobs for scaling certain components (e.g., configurable + replica counts for webhook and RWX recovery-backend) (#5087). + - Adds/changes UI deployment affinity options in the chart (#4987). + features: + - Kubernetes 1.25 support via PSA/optional PSP handling. + - ARM64 support promoted to General Availability (GA). + - RWX (NFS) support promoted to GA with recovery backend to improve failover + behavior. + - Snapshot checksum + periodic verification to detect corruption and support + data integrity workflows. + - Bit-rot detection and repair for snapshots when snapshot checksum is enabled. + - Replica rebuild speed-ups (notably leveraging snapshot checksums/metadata + to reduce unnecessary replication). + - Volume trim (UNMAP) support to reclaim space on block volumes. + - Online volume expansion support via engine + CSI node driver filesystem resize. + - Strict data locality mode to keep a local replica and use local socket for + improved performance. + - System Backup & Restore for backing up Longhorn system resources/metadata + and restoring in-place or to a new cluster. + - Enhanced support bundle collection via rancher/support-bundle-kit integration. + - New tunable engine-to-replica timeout setting for low-spec/latent environments. + breaking_changes: + - 'Kubernetes support window shifts: upgrading to v1.4.0 requires Kubernetes + **>=1.21** (and v1.4.0 is intended for newer clusters, including 1.25).' + - "PodSecurityPolicy is no longer assumed; on Kubernetes 1.25 you must use PSA,\ + \ and if you still need PSP you must explicitly enable Longhorn\u2019s opt-in\ + \ PSP support." + - VolumeSnapshot v1beta1 API is deprecated (still works now) and will be removed + in a future CSI snapshotter upgrade; plan migration to v1. chart_version: 1.4.0 - images: ['longhornio/longhorn-manager:v1.4.0', 'longhornio/longhorn-ui:v1.4.0'] + images: + - longhornio/longhorn-manager:v1.4.0 + - longhornio/longhorn-ui:v1.4.0 - version: 1.3.2 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Upgrade target is within the Longhorn 1.3 minor line (v1.3.0\ - \ \u2192 v1.3.2); most changes are bugfixes and operational improvements\ - \ rather than new features.", 'v1.3.2 adds an explicit Kubernetes version - upper bound for <1.4 charts: supported Kubernetes is >=1.18 and <=1.24 (<1.25).', - 'v1.3.2 cleans up Helm chart packaging inconsistencies (e.g., values.yaml - containing unused values; questions.yaml had outdated CSI image tags).', - 'CRD/manifest maintenance: updates around preserveUnknownFields and CRD patch - generation/reorg; relevant if you manage CRDs outside Helm.'] - features: [Data alignment correction for existing volumes when filesystem block - size is <4096 to prevent rare potential data corruption during replica rebuilds., - 'Use a specific filesystem block size to reduce unnecessary read-modify-write - between volume head and snapshots, improving write performance.', Support - cleanup of failed/obsolete orphaned backups (backup hygiene improvements).] - breaking_changes: ['Kubernetes compatibility constraint tightened/clarified - for v1.3.2: cluster must be Kubernetes >=1.18 and <=1.24 (i.e., not 1.25+). - Upgrading on newer clusters may be unsupported and should be avoided/validated - before proceeding.'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Upgrade target is within the Longhorn 1.3 minor line (v1.3.0 \u2192 v1.3.2);\ + \ most changes are bugfixes and operational improvements rather than new features." + - 'v1.3.2 adds an explicit Kubernetes version upper bound for <1.4 charts: supported + Kubernetes is >=1.18 and <=1.24 (<1.25).' + - v1.3.2 cleans up Helm chart packaging inconsistencies (e.g., values.yaml containing + unused values; questions.yaml had outdated CSI image tags). + - 'CRD/manifest maintenance: updates around preserveUnknownFields and CRD patch + generation/reorg; relevant if you manage CRDs outside Helm.' + features: + - Data alignment correction for existing volumes when filesystem block size + is <4096 to prevent rare potential data corruption during replica rebuilds. + - Use a specific filesystem block size to reduce unnecessary read-modify-write + between volume head and snapshots, improving write performance. + - Support cleanup of failed/obsolete orphaned backups (backup hygiene improvements). + breaking_changes: + - 'Kubernetes compatibility constraint tightened/clarified for v1.3.2: cluster + must be Kubernetes >=1.18 and <=1.24 (i.e., not 1.25+). Upgrading on newer + clusters may be unsupported and should be avoided/validated before proceeding.' chart_version: 1.3.2 images: [] - version: 1.3.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Longhorn now requires Kubernetes >= 1.18 for install/upgrade - (still upgrading only supported from 1.2.x to 1.3.0)., CRDs move to `longhorn.io/v1beta2` - as the default; a conversion webhook is introduced to keep `v1beta1` access - working post-upgrade., New/updated admission webhooks (mutating + validating) - are added and the manager now waits for the webhook server to be ready., - Communication between longhorn-manager and engine/replica processes is changed - to be proxied through instance-manager (enables storage network segregation)., - 'Optional security hardening additions: NetworkPolicies and optional mTLS - between manager and instance-manager.', Snapshot-related API surface expands - with a new Snapshot CRD; CSI snapshot support is extended to Longhorn snapshots., - Orphaned replica detection/cleanup feature added (including opt-in automatic - cleanup)., Instance-manager lifecycle management changes; optional dynamic - PDB management to work with Cluster Autoscaler (experimental)., 'Multiple - operational/UX improvements: snapshot purge/prune improvement, backing image - download support, metrics improvements, non-root default user for images, - etc.'] - features: [Storage network / multi-network cluster support with control-plane/data-plane - segregation via Multus (opt-in)., Managed Kubernetes compatibility improvements - (EKS/GKE/AKS operations like upgrades and node pool replacement)., New v1beta2 - CRDs with structural schema validation and a conversion webhook (v1beta2 - becomes default)., New Snapshot CRD and extended CSI snapshot integration - to create/restore Longhorn snapshots via CSI workflows., Orphaned replica - detection with optional automatic cleanup to reduce manual maintenance., - Snapshot prune capability to delete snapshots directly behind the head to - reclaim duplicated space., Optional mTLS between longhorn-manager and instance-manager - for tighter control-plane security., Experimental support for Cluster Autoscaler - via dynamic PDB handling for instance-manager pods.] - breaking_changes: ['CRD API versioning shifts to `longhorn.io/v1beta2` as default; - while a conversion webhook keeps `v1beta1` workable, any tooling that hard-codes - v1beta1 manifests or relies on direct etcd objects should be validated against - the new schemas/webhooks.', 'Networking/engine invocation path changes (manager->instance-manager - proxy) could affect environments with strict NetworkPolicies/firewalls; - if you run hardened clusters, ensure webhook/manager/instance-manager connectivity - is allowed and consider the new provided NetworkPolicies.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Longhorn now requires Kubernetes >= 1.18 for install/upgrade (still upgrading + only supported from 1.2.x to 1.3.0). + - CRDs move to `longhorn.io/v1beta2` as the default; a conversion webhook is + introduced to keep `v1beta1` access working post-upgrade. + - New/updated admission webhooks (mutating + validating) are added and the manager + now waits for the webhook server to be ready. + - Communication between longhorn-manager and engine/replica processes is changed + to be proxied through instance-manager (enables storage network segregation). + - 'Optional security hardening additions: NetworkPolicies and optional mTLS + between manager and instance-manager.' + - Snapshot-related API surface expands with a new Snapshot CRD; CSI snapshot + support is extended to Longhorn snapshots. + - Orphaned replica detection/cleanup feature added (including opt-in automatic + cleanup). + - Instance-manager lifecycle management changes; optional dynamic PDB management + to work with Cluster Autoscaler (experimental). + - 'Multiple operational/UX improvements: snapshot purge/prune improvement, backing + image download support, metrics improvements, non-root default user for images, + etc.' + features: + - Storage network / multi-network cluster support with control-plane/data-plane + segregation via Multus (opt-in). + - Managed Kubernetes compatibility improvements (EKS/GKE/AKS operations like + upgrades and node pool replacement). + - New v1beta2 CRDs with structural schema validation and a conversion webhook + (v1beta2 becomes default). + - New Snapshot CRD and extended CSI snapshot integration to create/restore Longhorn + snapshots via CSI workflows. + - Orphaned replica detection with optional automatic cleanup to reduce manual + maintenance. + - Snapshot prune capability to delete snapshots directly behind the head to + reclaim duplicated space. + - Optional mTLS between longhorn-manager and instance-manager for tighter control-plane + security. + - Experimental support for Cluster Autoscaler via dynamic PDB handling for instance-manager + pods. + breaking_changes: + - CRD API versioning shifts to `longhorn.io/v1beta2` as default; while a conversion + webhook keeps `v1beta1` workable, any tooling that hard-codes v1beta1 manifests + or relies on direct etcd objects should be validated against the new schemas/webhooks. + - Networking/engine invocation path changes (manager->instance-manager proxy) + could affect environments with strict NetworkPolicies/firewalls; if you run + hardened clusters, ensure webhook/manager/instance-manager connectivity is + allowed and consider the new provided NetworkPolicies. chart_version: 1.3.0 - images: ['longhornio/longhorn-manager:v1.3.0', 'longhornio/longhorn-ui:v1.3.0'] + images: + - longhornio/longhorn-manager:v1.3.0 + - longhornio/longhorn-ui:v1.3.0 - version: 1.2.6 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Longhorn v1.2.x remains within the same major/minor line; upgrade - is primarily a patch-level move to v1.2.6., v1.2.0 introduced new CRDs/controllers - for backups (BackupTarget/BackupVolume/Backup CRs) and for Recurring Jobs; - upgrading to 1.2.0 triggers migration of per-volume recurring job settings - to the new RecurringJob resources., v1.2.6 includes data-path correctness/performance - fixes around filesystem block size alignment during rebuild and using a - specific filesystem block size to avoid unnecessary RMW operations., 'v1.2.6 - also contains fixes around replica auto-balance/rebuild loops and some helm - chart hygiene (removing unused values, updating outdated CSI image tags - in questions.yaml).'] - features: [(Introduced in 1.2.0) Encrypted volumes and backups using Kubernetes - Secrets for key storage., (Introduced in 1.2.0) CSI volume cloning support., - (Introduced in 1.2.0) Automatic replica rebalancing based on node/zone soft - anti-affinity., (Introduced in 1.2.0) Asynchronous backup operations via - new backup CRDs/controllers and improved scheduling via recurring job/groups., - (Patch focus in 1.2.6) Data alignment correction and filesystem block size - handling to reduce risk of rare rebuild-related corruption and improve write - performance.] - breaking_changes: [Kubernetes minimum supported version becomes v1.18 in Longhorn - v1.2.0 (and v1.2.6 supports Kubernetes <= v1.24)., 'After upgrading to v1.2.0, - volume recurring job settings are migrated to new RecurringJob resources - and the `RecurringJobs` field in Volume spec is deprecated.', 'Known issue - in v1.2.0: StorageClasses using the longhorn CSI driver without specifying - `fsType` can hit an `fsGroup`-ineffective issue for new filesystem volumes - (resolved in 1.2.1 per notes).'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Longhorn v1.2.x remains within the same major/minor line; upgrade is primarily + a patch-level move to v1.2.6. + - v1.2.0 introduced new CRDs/controllers for backups (BackupTarget/BackupVolume/Backup + CRs) and for Recurring Jobs; upgrading to 1.2.0 triggers migration of per-volume + recurring job settings to the new RecurringJob resources. + - v1.2.6 includes data-path correctness/performance fixes around filesystem + block size alignment during rebuild and using a specific filesystem block + size to avoid unnecessary RMW operations. + - v1.2.6 also contains fixes around replica auto-balance/rebuild loops and some + helm chart hygiene (removing unused values, updating outdated CSI image tags + in questions.yaml). + features: + - (Introduced in 1.2.0) Encrypted volumes and backups using Kubernetes Secrets + for key storage. + - (Introduced in 1.2.0) CSI volume cloning support. + - (Introduced in 1.2.0) Automatic replica rebalancing based on node/zone soft + anti-affinity. + - (Introduced in 1.2.0) Asynchronous backup operations via new backup CRDs/controllers + and improved scheduling via recurring job/groups. + - (Patch focus in 1.2.6) Data alignment correction and filesystem block size + handling to reduce risk of rare rebuild-related corruption and improve write + performance. + breaking_changes: + - Kubernetes minimum supported version becomes v1.18 in Longhorn v1.2.0 (and + v1.2.6 supports Kubernetes <= v1.24). + - After upgrading to v1.2.0, volume recurring job settings are migrated to new + RecurringJob resources and the `RecurringJobs` field in Volume spec is deprecated. + - 'Known issue in v1.2.0: StorageClasses using the longhorn CSI driver without + specifying `fsType` can hit an `fsGroup`-ineffective issue for new filesystem + volumes (resolved in 1.2.1 per notes).' chart_version: 1.2.6 images: [] - version: 1.2.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Longhorn v1.2.0 updates supported Kubernetes versions: minimum - supported Kubernetes is now v1.18; adds compatibility up to Kubernetes v1.22 - by migrating deprecated resources and updating CSI sidecars.', 'CSI components - are updated; known issue in v1.2.0: if a StorageClass using the `driver.longhorn.io` - provisioner does not specify `fsType`, `fsGroup` may be ineffective for - newly created filesystem volumes due to an external-provisioner default - change. Workaround: explicitly set `parameters.fsType` (e.g., `ext4` or - `xfs`) in the StorageClass; fixed in v1.2.1.', 'Recurring jobs are migrated: - per-volume `spec.RecurringJobs` is deprecated and volume recurring job settings - are migrated into new RecurringJob CRDs/resources during upgrade.', 'Backup - subsystem refactor: introduces BackupTarget/BackupVolume/Backup CRDs and - controllers enabling asynchronous backups; behavior and UI/observability - around backups changes accordingly.'] - features: ['Kubernetes support updates: minimum K8s version becomes v1.18 and - Longhorn supports K8s v1.22 with updated CSI sidecars.', Volume encryption - and backup encryption using kernel crypto + Kubernetes Secrets; encrypted - volumes are encrypted in transit and at rest and their backups are encrypted - too., CSI volume cloning support to clone PVCs/volumes via CSI primitives., - Automatic replica rebalancing based on (soft) node/zone anti-affinity when - nodes go up/down., 'Backing image enhancements: upload backing images from - local and create backing images from existing volumes.', Asynchronous backup - operations via new backup-related CRDs/controllers to improve backup performance - and reduce blocking operations., Recurring job and recurring job groups - via new CRD/controller for reusable scheduled snapshots/backups; includes - default recurring backup policy concept.] - breaking_changes: ['Kubernetes version compatibility change: you must be running - Kubernetes v1.18+ before upgrading to Longhorn v1.2.0.', 'Recurring job - model change: volume-level `RecurringJobs` in the Volume spec is deprecated - and settings are migrated to new RecurringJob resources; automation that - edits Volume specs directly must be updated.', 'Potential post-upgrade workload - behavior change (known issue): StorageClasses without `fsType` may experience - ineffective `fsGroup` on new filesystem volumes in v1.2.0; mitigate by setting - `fsType` explicitly or upgrade to v1.2.1+.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Longhorn v1.2.0 updates supported Kubernetes versions: minimum supported + Kubernetes is now v1.18; adds compatibility up to Kubernetes v1.22 by migrating + deprecated resources and updating CSI sidecars.' + - 'CSI components are updated; known issue in v1.2.0: if a StorageClass using + the `driver.longhorn.io` provisioner does not specify `fsType`, `fsGroup` + may be ineffective for newly created filesystem volumes due to an external-provisioner + default change. Workaround: explicitly set `parameters.fsType` (e.g., `ext4` + or `xfs`) in the StorageClass; fixed in v1.2.1.' + - 'Recurring jobs are migrated: per-volume `spec.RecurringJobs` is deprecated + and volume recurring job settings are migrated into new RecurringJob CRDs/resources + during upgrade.' + - 'Backup subsystem refactor: introduces BackupTarget/BackupVolume/Backup CRDs + and controllers enabling asynchronous backups; behavior and UI/observability + around backups changes accordingly.' + features: + - 'Kubernetes support updates: minimum K8s version becomes v1.18 and Longhorn + supports K8s v1.22 with updated CSI sidecars.' + - Volume encryption and backup encryption using kernel crypto + Kubernetes Secrets; + encrypted volumes are encrypted in transit and at rest and their backups are + encrypted too. + - CSI volume cloning support to clone PVCs/volumes via CSI primitives. + - Automatic replica rebalancing based on (soft) node/zone anti-affinity when + nodes go up/down. + - 'Backing image enhancements: upload backing images from local and create backing + images from existing volumes.' + - Asynchronous backup operations via new backup-related CRDs/controllers to + improve backup performance and reduce blocking operations. + - Recurring job and recurring job groups via new CRD/controller for reusable + scheduled snapshots/backups; includes default recurring backup policy concept. + breaking_changes: + - 'Kubernetes version compatibility change: you must be running Kubernetes v1.18+ + before upgrading to Longhorn v1.2.0.' + - 'Recurring job model change: volume-level `RecurringJobs` in the Volume spec + is deprecated and settings are migrated to new RecurringJob resources; automation + that edits Volume specs directly must be updated.' + - 'Potential post-upgrade workload behavior change (known issue): StorageClasses + without `fsType` may experience ineffective `fsGroup` on new filesystem volumes + in v1.2.0; mitigate by setting `fsType` explicitly or upgrade to v1.2.1+.' chart_version: 1.2.0 - images: ['longhornio/longhorn-manager:v1.2.0', 'longhornio/longhorn-ui:v1.2.0'] + images: + - longhornio/longhorn-manager:v1.2.0 + - longhornio/longhorn-ui:v1.2.0 - version: 1.1.3 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Includes security fixes for CVE-2021-36779 (host operations allowed - in privileged Longhorn-managed pods) and CVE-2021-36780 (unauthorized data - access from replicas via vulnerable instance manager pods)., 'Improves data-plane - behavior in low-performance environments (e.g., spinning disks, 1Gbps networks, - low CPU).', 'Updates default advertised CSI version to CSI 1.2, improving - compatibility with CSI consumers.'] + features: + - Includes security fixes for CVE-2021-36779 (host operations allowed in privileged + Longhorn-managed pods) and CVE-2021-36780 (unauthorized data access from replicas + via vulnerable instance manager pods). + - Improves data-plane behavior in low-performance environments (e.g., spinning + disks, 1Gbps networks, low CPU). + - Updates default advertised CSI version to CSI 1.2, improving compatibility + with CSI consumers. breaking_changes: [] chart_version: 1.1.3 images: [] - version: 1.1.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Native RWX (ReadWriteMany) support via NFS provisioner is introduced - as an experimental feature; validate with non-production workloads first., - Experimental ARM64 support is added so Longhorn can be deployed on ARM64 clusters - without special modifications., CSI Snapshotter support is added (requires - Kubernetes >=1.17) enabling kubectl-managed VolumeSnapshots that map to - Longhorn backups/restores., Prometheus metrics endpoints and a sample Grafana - dashboard are added to integrate Longhorn into existing monitoring/alerting - stacks., 'Improved node failure and volume failure recovery, including automatic - StatefulSet recovery behavior and rebuild from existing replicas after temporary - node disconnects.', 'Expanded node maintenance operations (supports drain, - replica eviction, pausing rebuilds, auto-removal of deleted K8s nodes, and - disk recognition when reattached/moved).', Data Locality option is added - to prefer keeping one replica local to the engine/workload to improve resilience - during network interruptions., New setting to allow volume creation with - degraded availability (default true; recommended false for production) for - small clusters or constrained capacity environments., Experimental performance - improvement by removing the revision counter is introduced.] - breaking_changes: [Kubernetes minimum version increases to v1.16 for Longhorn - v1.1.0; clusters below this must be upgraded before Longhorn., 'CSI Snapshotter - feature requires Kubernetes v1.17+ and installation of the external CSI - Snapshot Controller; without it, CSI snapshots will not work.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Native RWX (ReadWriteMany) support via NFS provisioner is introduced as an + experimental feature; validate with non-production workloads first. + - Experimental ARM64 support is added so Longhorn can be deployed on ARM64 clusters + without special modifications. + - CSI Snapshotter support is added (requires Kubernetes >=1.17) enabling kubectl-managed + VolumeSnapshots that map to Longhorn backups/restores. + - Prometheus metrics endpoints and a sample Grafana dashboard are added to integrate + Longhorn into existing monitoring/alerting stacks. + - Improved node failure and volume failure recovery, including automatic StatefulSet + recovery behavior and rebuild from existing replicas after temporary node + disconnects. + - Expanded node maintenance operations (supports drain, replica eviction, pausing + rebuilds, auto-removal of deleted K8s nodes, and disk recognition when reattached/moved). + - Data Locality option is added to prefer keeping one replica local to the engine/workload + to improve resilience during network interruptions. + - New setting to allow volume creation with degraded availability (default true; + recommended false for production) for small clusters or constrained capacity + environments. + - Experimental performance improvement by removing the revision counter is introduced. + breaking_changes: + - Kubernetes minimum version increases to v1.16 for Longhorn v1.1.0; clusters + below this must be upgraded before Longhorn. + - CSI Snapshotter feature requires Kubernetes v1.17+ and installation of the + external CSI Snapshot Controller; without it, CSI snapshots will not work. chart_version: 1.1.0 - images: ['longhornio/longhorn-manager:v1.1.0', 'longhornio/longhorn-ui:v1.1.0'] + images: + - longhornio/longhorn-manager:v1.1.0 + - longhornio/longhorn-ui:v1.1.0 - version: 1.0.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 - images: ['longhornio/longhorn-manager:v1.0.0', 'longhornio/longhorn-ui:v1.0.0'] + images: + - longhornio/longhorn-manager:v1.0.0 + - longhornio/longhorn-ui:v1.0.0 name: longhorn - icon: https://avatars.githubusercontent.com/u/36015203?s=400&v=4 git_url: https://github.com/kubernetes-sigs/metrics-server @@ -22343,48 +29253,73 @@ addons: helm_repository_url: https://kubernetes-sigs.github.io/metrics-server versions: - version: 0.9.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Kubernetes dependency updates to v1.36.2, which may improve compatibility - with newer clusters and API behaviors.', 'Logging behavior improvements: - honors `stderrthreshold` when `logtostderr` is enabled, and reduces log - severity for scrape failures on not-ready nodes.', 'Documentation improvement: - adds a diagram explaining the `kubectl top pod` request flow through metrics-server.', - 'Storage readiness now requires both node and pod metrics to be present before - reporting ready, reducing false-ready states.'] - breaking_changes: ['Readiness semantics are stricter: metrics-server may remain - unready until it has successfully collected both node and pod metrics (could - affect rollouts/alerts that expect quicker readiness).'] + features: + - Kubernetes dependency updates to v1.36.2, which may improve compatibility + with newer clusters and API behaviors. + - 'Logging behavior improvements: honors `stderrthreshold` when `logtostderr` + is enabled, and reduces log severity for scrape failures on not-ready nodes.' + - 'Documentation improvement: adds a diagram explaining the `kubectl top pod` + request flow through metrics-server.' + - Storage readiness now requires both node and pod metrics to be present before + reporting ready, reducing false-ready states. + breaking_changes: + - 'Readiness semantics are stricter: metrics-server may remain unready until + it has successfully collected both node and pod metrics (could affect rollouts/alerts + that expect quicker readiness).' chart_version: 3.14.0 - images: ['registry.k8s.io/metrics-server/metrics-server:v0.9.0'] + images: + - registry.k8s.io/metrics-server/metrics-server:v0.9.0 - version: 0.8.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Flags are now wired through to server run options, exposing Kubernetes - SecureServingOptions flags (notably `--disable-http2-serving`) via metrics-server - CLI configuration.', 'Dependency bumps: Go toolchain updated to 1.24.4 and - Kubernetes client libraries to v0.33.2, plus Prometheus module bumped to - v0.304.2.', Tooling can now target alternate container engines when building/testing - (useful for non-Docker environments).] - breaking_changes: ['If you still pass any deprecated klog logging flags removed - in v0.7.0 (e.g., `--logtostderr`, `--log-file`, `--log-dir`, etc.), metrics-server - will fail to start; ensure your deployment/helm values no longer include - them.', 'Newly exposed secure serving flags may change defaults/behavior - in some clusters; if you need HTTP/2 disabled for compliance/interoperability, - explicitly set `--disable-http2-serving` after upgrading.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Flags are now wired through to server run options, exposing Kubernetes SecureServingOptions + flags (notably `--disable-http2-serving`) via metrics-server CLI configuration. + - 'Dependency bumps: Go toolchain updated to 1.24.4 and Kubernetes client libraries + to v0.33.2, plus Prometheus module bumped to v0.304.2.' + - Tooling can now target alternate container engines when building/testing (useful + for non-Docker environments). + breaking_changes: + - If you still pass any deprecated klog logging flags removed in v0.7.0 (e.g., + `--logtostderr`, `--log-file`, `--log-dir`, etc.), metrics-server will fail + to start; ensure your deployment/helm values no longer include them. + - Newly exposed secure serving flags may change defaults/behavior in some clusters; + if you need HTTP/2 disabled for compliance/interoperability, explicitly set + `--disable-http2-serving` after upgrading. chart_version: 3.13.0 - images: ['registry.k8s.io/metrics-server/metrics-server:v0.8.0'] + images: + - registry.k8s.io/metrics-server/metrics-server:v0.8.0 - version: 0.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -22396,28 +29331,46 @@ addons: - Optional new configuration knobs you can add to `extraArgs` (or equivalent\ \ chart values):\n - `--logging-format=json` (JSON logs)\n - `--kubelet-request-timeout=`\n\ \ - `--node-selector=` (exclude nodes by label selector)" - chart_updates: [Metrics-server manifests were restructured (base-components-overlays) - upstream; the chart may reflect this via updated templates/paths but functional - intent is the same., PodDisruptionBudget API updated to `policy/v1`., Version-specific - high-availability manifests were added upstream; ensure your deployment/replica/PDB - settings align with your cluster version guidance., Manifests were adjusted - to permit running under PodSecurity `restricted` (securityContext/permissions - tightening)., Autoscaling/addon-resizer manifests and securityContext were - updated (notably `containerSecurityContext` for addonResizer).] - features: [Supports JSON-formatted logging., New `--kubelet-request-timeout` - flag allows tuning kubelet scrape timeouts., New `--node-selector` flag - can exclude nodes by label selector., Metric collection path can be overridden - per-node via the `metrics.k8s.io/resource-metrics-path` node annotation., - Binaries are now attached to GitHub release artifacts (useful for airgapped/off-cluster - debugging).] - breaking_changes: ['Deprecated klog-specific logging flags were removed; if - your Helm values or manifests still set them, metrics-server will fail to - start or ignore flags depending on arg handling.'] + chart_updates: + - Metrics-server manifests were restructured (base-components-overlays) upstream; + the chart may reflect this via updated templates/paths but functional intent + is the same. + - PodDisruptionBudget API updated to `policy/v1`. + - Version-specific high-availability manifests were added upstream; ensure your + deployment/replica/PDB settings align with your cluster version guidance. + - Manifests were adjusted to permit running under PodSecurity `restricted` (securityContext/permissions + tightening). + - Autoscaling/addon-resizer manifests and securityContext were updated (notably + `containerSecurityContext` for addonResizer). + features: + - Supports JSON-formatted logging. + - New `--kubelet-request-timeout` flag allows tuning kubelet scrape timeouts. + - New `--node-selector` flag can exclude nodes by label selector. + - Metric collection path can be overridden per-node via the `metrics.k8s.io/resource-metrics-path` + node annotation. + - Binaries are now attached to GitHub release artifacts (useful for airgapped/off-cluster + debugging). + breaking_changes: + - Deprecated klog-specific logging flags were removed; if your Helm values or + manifests still set them, metrics-server will fail to start or ignore flags + depending on arg handling. chart_version: 3.12.0 - images: ['registry.k8s.io/metrics-server/metrics-server:v0.7.0'] + images: + - registry.k8s.io/metrics-server/metrics-server:v0.7.0 - version: 0.6.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -22430,272 +29383,707 @@ addons: your existing manifests into Helm values. ' - chart_updates: [Added official Helm chart and chart metadata., Added high-availability - manifests/configuration options., RBAC permissions were minimized and updated; - Metrics Server now needs `nodes/metrics` instead of `nodes/stats`., Switched - to the Kubelet resource metrics endpoint for collection.] - features: ['High availability configuration was added, enabling running multiple - replicas with the appropriate setup.', 'An official Helm chart is now available, - making installation/upgrade via Helm supported.', 'Metrics collection migrated - to the Kubelet resource metrics endpoint, improving alignment with current - kubelet endpoints and behavior.'] - breaking_changes: ['RBAC requirement changed: Metrics Server now needs access - to the `nodes/metrics` resource instead of `nodes/stats`. Custom manifests/RBAC - must be updated or metrics collection will fail/403.'] + chart_updates: + - Added official Helm chart and chart metadata. + - Added high-availability manifests/configuration options. + - RBAC permissions were minimized and updated; Metrics Server now needs `nodes/metrics` + instead of `nodes/stats`. + - Switched to the Kubelet resource metrics endpoint for collection. + features: + - High availability configuration was added, enabling running multiple replicas + with the appropriate setup. + - An official Helm chart is now available, making installation/upgrade via Helm + supported. + - Metrics collection migrated to the Kubelet resource metrics endpoint, improving + alignment with current kubelet endpoints and behavior. + breaking_changes: + - 'RBAC requirement changed: Metrics Server now needs access to the `nodes/metrics` + resource instead of `nodes/stats`. Custom manifests/RBAC must be updated or + metrics collection will fail/403.' chart_version: 3.8.0 - images: ['k8s.gcr.io/metrics-server/metrics-server:v0.6.0'] + images: + - k8s.gcr.io/metrics-server/metrics-server:v0.6.0 - version: 0.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', - '1.17', '1.16', '1.15', '1.14', '1.13', '1.12', '1.11', '1.10', '1.9', '1.8'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' + - '1.10' + - '1.9' + - '1.8' requirements: [] incompatibilities: [] summary: null chart_version: 3.5.0 - images: ['k8s.gcr.io/metrics-server/metrics-server:v0.5.0'] + images: + - k8s.gcr.io/metrics-server/metrics-server:v0.5.0 name: metrics-server - icon: https://avatars.githubusercontent.com/u/49998002?s=48&v=4 git_url: https://github.com/open-telemetry/opentelemetry-operator release_url: https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v{vsn} versions: - version: 0.154.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.153.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.152.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.151.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.150.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.149.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.148.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.147.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.146.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.145.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.144.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.143.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.142.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.141.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', - '1.25'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.140.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.139.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.138.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.137.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.136.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.135.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.134.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.132.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.131.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.129.1 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', - '1.24', '1.23'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.127.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.126.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.125.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.124.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.123.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.122.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.121.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.120.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.119.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.118.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.117.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', - '1.23'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.116.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.115.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.114.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.113.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.112.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.111.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.110.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.109.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null @@ -22706,7 +30094,14 @@ addons: helm_repository_url: https://charts.rook.io/release versions: - version: 1.20.0 - kube: ['1.37', '1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -22720,31 +30115,44 @@ addons: \ values.\n- From v1.19 (still relevant if you are crossing it): `rook-ceph-cluster`\ \ chart changed Ceph image configuration to **separate repository and tag**\ \ (ensure your values match the new schema)." - chart_updates: ['CSI settings removed from the rook operator configmap and operator - Helm chart; new `ceph-csi-drivers` chart/CRs (`OperatorConfig`, `Driver`) - become the place to configure CSI behavior going forward.', Defaults for - CSI CRs are provided in `operator.yaml`; customizations now documented under - CSI Configuration in v1.20 docs.] - features: ["Kubernetes support window moves to v1.31\u2013v1.36 (from v1.30\u2013\ - v1.35 in v1.19).", SSE-S3 object store encryption can now use HashiCorp - Vault Agent auth for key management., Rook now cleans up unused CRUSH rules - by default after the Ceph mgr starts (can be disabled)., Multi-CephCluster - concurrent reconcile setting (`ROOK_RECONCILE_CONCURRENT_CLUSTERS`) is now - stable., Operator reconciliation is more robust by matching containers by - name instead of declaration order (helps when mutating webhooks reorder - containers)., 'Encrypted host-based OSDs auto-expand when the underlying - disk is resized (with `encryptedDevice: true`).', 'Experimental: RGW Accounts - via `CephObjectStoreAccount` CRD and `accountRef` on `CephObjectStoreUser` - (currently only testable with Ceph main image).', 'Experimental: Two-node - clusters can use a ''floating'' mon that migrates between nodes on failure.'] - breaking_changes: ['Ceph-CSI operator is now required to manage CSI driver settings; - CSI config is removed from the rook operator configmap/chart, and ongoing - CSI changes must be applied via Ceph-CSI `OperatorConfig`/`Driver` CRs (Helm: - `ceph-csi-drivers` chart).'] + chart_updates: + - CSI settings removed from the rook operator configmap and operator Helm chart; + new `ceph-csi-drivers` chart/CRs (`OperatorConfig`, `Driver`) become the place + to configure CSI behavior going forward. + - Defaults for CSI CRs are provided in `operator.yaml`; customizations now documented + under CSI Configuration in v1.20 docs. + features: + - "Kubernetes support window moves to v1.31\u2013v1.36 (from v1.30\u2013v1.35\ + \ in v1.19)." + - SSE-S3 object store encryption can now use HashiCorp Vault Agent auth for + key management. + - Rook now cleans up unused CRUSH rules by default after the Ceph mgr starts + (can be disabled). + - Multi-CephCluster concurrent reconcile setting (`ROOK_RECONCILE_CONCURRENT_CLUSTERS`) + is now stable. + - Operator reconciliation is more robust by matching containers by name instead + of declaration order (helps when mutating webhooks reorder containers). + - 'Encrypted host-based OSDs auto-expand when the underlying disk is resized + (with `encryptedDevice: true`).' + - 'Experimental: RGW Accounts via `CephObjectStoreAccount` CRD and `accountRef` + on `CephObjectStoreUser` (currently only testable with Ceph main image).' + - 'Experimental: Two-node clusters can use a ''floating'' mon that migrates + between nodes on failure.' + breaking_changes: + - 'Ceph-CSI operator is now required to manage CSI driver settings; CSI config + is removed from the rook operator configmap/chart, and ongoing CSI changes + must be applied via Ceph-CSI `OperatorConfig`/`Driver` CRs (Helm: `ceph-csi-drivers` + chart).' chart_version: 1.20.0 images: [] - version: 1.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -22758,28 +30166,38 @@ addons: created via the external cluster script/process and that your CSI secrets/configs reference those clients.' chart_updates: [] - features: ['Experimental NVMe over Fabrics (NVMe-oF): expose RBD volumes via - NVMe/TCP for in-cluster pods and external clients using standard NVMe initiators.', - 'CephCSI v3.16 integration: adds NVMe-oF CSI driver support, improved fencing - during node failure, block volume usage stats, and configurable block encryption - cipher.', Operator can optionally reconcile multiple CephCluster CRs concurrently - via `ROOK_RECONCILE_CONCURRENT_CLUSTERS>1` when managing multiple clusters., - 'Improved operator logging: controller log lines include namespaced names - for more consistent troubleshooting.'] - breaking_changes: ["Supported Kubernetes versions are now **v1.30\u2013v1.35**;\ - \ clusters on older Kubernetes must upgrade Kubernetes first.", 'Minimum - supported Ceph version is **v19.2.0**. If your Rook v1.18 cluster runs Ceph - v18, you must upgrade Ceph to v19.2.0+ before upgrading Rook.', '`CephFilesystem.spec.metadataServer.activeStandby` - behavior changed: when set to `false`, the standby MDS deployment is scaled - down/removed (not just disabling standby cache). Plan for reduced failover - redundancy if you had `activeStandby=false`.', 'In external mode with an - admin keyring provided, Rook no longer creates CSI clients automatically; - CSI client provisioning must be handled explicitly (typically via the external - cluster script).'] + features: + - 'Experimental NVMe over Fabrics (NVMe-oF): expose RBD volumes via NVMe/TCP + for in-cluster pods and external clients using standard NVMe initiators.' + - 'CephCSI v3.16 integration: adds NVMe-oF CSI driver support, improved fencing + during node failure, block volume usage stats, and configurable block encryption + cipher.' + - Operator can optionally reconcile multiple CephCluster CRs concurrently via + `ROOK_RECONCILE_CONCURRENT_CLUSTERS>1` when managing multiple clusters. + - 'Improved operator logging: controller log lines include namespaced names + for more consistent troubleshooting.' + breaking_changes: + - "Supported Kubernetes versions are now **v1.30\u2013v1.35**; clusters on older\ + \ Kubernetes must upgrade Kubernetes first." + - Minimum supported Ceph version is **v19.2.0**. If your Rook v1.18 cluster + runs Ceph v18, you must upgrade Ceph to v19.2.0+ before upgrading Rook. + - '`CephFilesystem.spec.metadataServer.activeStandby` behavior changed: when + set to `false`, the standby MDS deployment is scaled down/removed (not just + disabling standby cache). Plan for reduced failover redundancy if you had + `activeStandby=false`.' + - In external mode with an admin keyring provided, Rook no longer creates CSI + clients automatically; CSI client provisioning must be handled explicitly + (typically via the external cluster script). chart_version: 1.19.0 images: [] - version: 1.18.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -22792,135 +30210,180 @@ addons: \ false`.\n- **Install-time manifest note:** If you deploy with raw manifests,\ \ you now need `csi-operator.yaml`. With Helm, this is handled automatically\ \ when `csi.rookUseCsiOperator` is enabled." - chart_updates: [Ceph CSI Operator integration is now the default/recommended - path for configuring CSI drivers (RBD/CephFS/NFS). Rook will auto-convert - existing Rook CSI settings to Ceph CSI Operator CRs during the v1.18 upgrade - and throughout v1.18.x., Operator supports Kubernetes v1.29+ minimum (v1.17 - required v1.28+)., Operator validates node topology labels at CephCluster - creation to prevent invalid CRUSH hierarchies; failures occur for new clusters - with duplicated child topology labels across zones unless the check is skipped., - Adds `clusterID` support fields for certain CRDs (CephBlockPoolRadosNamespace - and CephFilesystemSubVolumeGroup)., 'Mon failover behavior improved: if - the assigned node no longer exists, failover is immediate (no 20-minute - wait).'] - features: [Ceph CSI Operator becomes the default/recommended way to manage CSI - (RBD/CephFS/NFS); Rook v1.18 auto-migrates existing CSI settings to the - operator CRs transparently during upgrade., Ceph CSI v3.15 support (via - CSI operator or legacy mode for now); note that the CSI operator will become - required in the next release., Experimental CephX key rotation support with - new `spec.security.cephx` settings; requires Ceph v19.2.3+ (admin/mon keys - not yet rotatable)., Support specifying `clusterID` in CephBlockPoolRadosNamespace - and CephFilesystemSubVolumeGroup CRs., Faster mon failover when the target - node is gone (immediate instead of waiting 20 minutes).] - breaking_changes: [Kubernetes **v1.29** is now the minimum supported version - (v1.17 was v1.28)., 'New clusters only: CephCluster creation now validates - topology labels to prevent misconfigured CRUSH hierarchies; creation can - fail if child labels (e.g., `topology.rook.io/rack`) are duplicated across - zones unless `ROOK_SKIP_OSD_TOPOLOGY_CHECK=true` is set.', 'Object storage - changes introduced in v1.17 (relevant when coming from 1.17.0): OBC additional - config fields are disabled by default unless `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` - is enabled; CephObjectStoreUser credential management may purge undeclared - extra S3 credentials; Kafka bucket notifications now default Kafka auth - mechanism to `PLAIN` and cannot be set via `opaqueData` mechanism param.'] + chart_updates: + - Ceph CSI Operator integration is now the default/recommended path for configuring + CSI drivers (RBD/CephFS/NFS). Rook will auto-convert existing Rook CSI settings + to Ceph CSI Operator CRs during the v1.18 upgrade and throughout v1.18.x. + - Operator supports Kubernetes v1.29+ minimum (v1.17 required v1.28+). + - Operator validates node topology labels at CephCluster creation to prevent + invalid CRUSH hierarchies; failures occur for new clusters with duplicated + child topology labels across zones unless the check is skipped. + - Adds `clusterID` support fields for certain CRDs (CephBlockPoolRadosNamespace + and CephFilesystemSubVolumeGroup). + - 'Mon failover behavior improved: if the assigned node no longer exists, failover + is immediate (no 20-minute wait).' + features: + - Ceph CSI Operator becomes the default/recommended way to manage CSI (RBD/CephFS/NFS); + Rook v1.18 auto-migrates existing CSI settings to the operator CRs transparently + during upgrade. + - Ceph CSI v3.15 support (via CSI operator or legacy mode for now); note that + the CSI operator will become required in the next release. + - Experimental CephX key rotation support with new `spec.security.cephx` settings; + requires Ceph v19.2.3+ (admin/mon keys not yet rotatable). + - Support specifying `clusterID` in CephBlockPoolRadosNamespace and CephFilesystemSubVolumeGroup + CRs. + - Faster mon failover when the target node is gone (immediate instead of waiting + 20 minutes). + breaking_changes: + - Kubernetes **v1.29** is now the minimum supported version (v1.17 was v1.28). + - 'New clusters only: CephCluster creation now validates topology labels to + prevent misconfigured CRUSH hierarchies; creation can fail if child labels + (e.g., `topology.rook.io/rack`) are duplicated across zones unless `ROOK_SKIP_OSD_TOPOLOGY_CHECK=true` + is set.' + - 'Object storage changes introduced in v1.17 (relevant when coming from 1.17.0): + OBC additional config fields are disabled by default unless `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` + is enabled; CephObjectStoreUser credential management may purge undeclared + extra S3 credentials; Kafka bucket notifications now default Kafka auth mechanism + to `PLAIN` and cannot be set via `opaqueData` mechanism param.' chart_version: 1.18.0 images: [] - version: 1.17.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Rook v1.17 raises the supported Kubernetes floor to v1.28 (v1.16 - was v1.27). Ensure your cluster/control-plane and any constrained environments - (e.g., managed K8s versions) meet this before upgrading.', ObjectBucketClaim - (OBC) flexibility introduced in v1.16 is now disabled by default in v1.17 - for safer defaults; enabling it requires setting the operator env var `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS`. - This may require updating the operator deployment/Helm values to add the - env var if you rely on those OBC fields., 'CephObjectStoreUser behavior - changes due to new first-class credential management: Rook will purge undeclared - extra S3 credentials on existing users; plan to migrate to declarative credential - management if you previously rotated credentials manually.', CephBucketTopic - Kafka notifications now default `PLAIN` auth mechanism and no longer allow - overriding the mechanism via `spec.endpoint.kafka.opaqueData` using `&mechanism=`; update affected CephBucketTopic manifests explicitly if you use - another mechanism.] - features: ['OBCs can optionally set a pre-existing Ceph RGW user as bucket owner - (via CephObjectStoreUser), avoiding one-user-per-bucket and allowing re-linking - existing buckets to a specified owner.', 'Ceph CSI updated to v3.14 with - multiple improvements across RBD/CephFS, snapshots, and other areas (review - ceph-csi 3.14 release notes for specifics relevant to your workloads).', - Experimental support for external monitors (mons) to place a mon outside the - Kubernetes cluster for certain two-datacenter/stretch-like scenarios., 'DNS-based - mon endpoint tracking for clients outside the cluster via `rook-ceph-active-mons..svc.cluster.local`, - reducing manual mon endpoint updates when mon IPs change.', 'Per-node ceph.conf - overrides: node-specific ConfigMaps can override `ceph.conf` for OSDs and - OSD prepare jobs on that node.'] - breaking_changes: [Minimum supported Kubernetes version is now v1.28 (was v1.27 - in v1.16)., OBC additionalConfig options that allow user-controlled bucket - policy/etc. are now disabled by default; you must opt in with `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` - if you depend on them., 'CephObjectStoreUser now has first-class credential - management; Rook will remove (purge) any extra S3 credentials not declared - in the resource, which can break setups where admins manually added/rotated - credentials on the RGW user.', 'Kafka notification auth mechanism defaults - to `PLAIN`, and overriding the mechanism via `opaqueData` query string is - no longer supported; manifests must be adjusted for non-PLAIN auth.'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Rook v1.17 raises the supported Kubernetes floor to v1.28 (v1.16 was v1.27). + Ensure your cluster/control-plane and any constrained environments (e.g., + managed K8s versions) meet this before upgrading. + - ObjectBucketClaim (OBC) flexibility introduced in v1.16 is now disabled by + default in v1.17 for safer defaults; enabling it requires setting the operator + env var `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS`. This may require updating + the operator deployment/Helm values to add the env var if you rely on those + OBC fields. + - 'CephObjectStoreUser behavior changes due to new first-class credential management: + Rook will purge undeclared extra S3 credentials on existing users; plan to + migrate to declarative credential management if you previously rotated credentials + manually.' + - CephBucketTopic Kafka notifications now default `PLAIN` auth mechanism and + no longer allow overriding the mechanism via `spec.endpoint.kafka.opaqueData` + using `&mechanism=`; update affected CephBucketTopic manifests + explicitly if you use another mechanism. + features: + - OBCs can optionally set a pre-existing Ceph RGW user as bucket owner (via + CephObjectStoreUser), avoiding one-user-per-bucket and allowing re-linking + existing buckets to a specified owner. + - Ceph CSI updated to v3.14 with multiple improvements across RBD/CephFS, snapshots, + and other areas (review ceph-csi 3.14 release notes for specifics relevant + to your workloads). + - Experimental support for external monitors (mons) to place a mon outside the + Kubernetes cluster for certain two-datacenter/stretch-like scenarios. + - DNS-based mon endpoint tracking for clients outside the cluster via `rook-ceph-active-mons..svc.cluster.local`, + reducing manual mon endpoint updates when mon IPs change. + - 'Per-node ceph.conf overrides: node-specific ConfigMaps can override `ceph.conf` + for OSDs and OSD prepare jobs on that node.' + breaking_changes: + - Minimum supported Kubernetes version is now v1.28 (was v1.27 in v1.16). + - OBC additionalConfig options that allow user-controlled bucket policy/etc. + are now disabled by default; you must opt in with `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` + if you depend on them. + - CephObjectStoreUser now has first-class credential management; Rook will remove + (purge) any extra S3 credentials not declared in the resource, which can break + setups where admins manually added/rotated credentials on the RGW user. + - Kafka notification auth mechanism defaults to `PLAIN`, and overriding the + mechanism via `opaqueData` query string is no longer supported; manifests + must be adjusted for non-PLAIN auth. chart_version: 1.17.0 images: [] - version: 1.16.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Ceph-CSI driver updated to v3.13, adding volume group snapshots - plus various CephFS/RBD improvements and sidecar updates.', 'CephBlockPoolRadosNamespace - now supports mirroring, including optional periodic status monitoring when - the parent pool has statusCheck enabled.', PVC-based OSDs can be migrated - to enable/disable encryption., Ceph object storage gains multiple RGW instances - support and more advanced configuration options (extra CLI params/ceph.conf - settings)., ObjectBucketClaims can manage S3 bucket policy via additionalConfig.bucketPolicy; - RGW admin ops logging can be enabled via opsLogSidecar., Kubernetes support - is extended up to v1.32.] - breaking_changes: [Ceph Quincy (v17) support is removed; only Ceph Reef (v18) - and Squid (v19) are supported in Rook v1.16., "CSI network \u201Cholder\u201D\ - \ pods are removed; clusters still using csi-*plugin-holder-* must disable/remove\ - \ them before upgrading.", Minimum supported Kubernetes version increases - to v1.27.] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Ceph-CSI driver updated to v3.13, adding volume group snapshots plus various + CephFS/RBD improvements and sidecar updates. + - CephBlockPoolRadosNamespace now supports mirroring, including optional periodic + status monitoring when the parent pool has statusCheck enabled. + - PVC-based OSDs can be migrated to enable/disable encryption. + - Ceph object storage gains multiple RGW instances support and more advanced + configuration options (extra CLI params/ceph.conf settings). + - ObjectBucketClaims can manage S3 bucket policy via additionalConfig.bucketPolicy; + RGW admin ops logging can be enabled via opsLogSidecar. + - Kubernetes support is extended up to v1.32. + breaking_changes: + - Ceph Quincy (v17) support is removed; only Ceph Reef (v18) and Squid (v19) + are supported in Rook v1.16. + - "CSI network \u201Cholder\u201D pods are removed; clusters still using csi-*plugin-holder-*\ + \ must disable/remove them before upgrading." + - Minimum supported Kubernetes version increases to v1.27. chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Kubernetes minimum supported version increases to 1.26 in v1.15.0 - (was 1.25 in v1.14.0); verify cluster version before upgrading., 'Rook now - uses fully-qualified image names (e.g., docker.io/rook/ceph) in operator - manifests and Helm charts; if you mirror images or use private registries, - ensure overrides still work as expected.', Ceph-CSI sidecars/images updated - with Ceph-CSI v3.12; expect rolling restarts of CSI components during upgrade.] - features: [Adds support for Ceph Squid (v19) in addition to Reef (v18) and Quincy - (v17); note Quincy support will be removed in Rook v1.16., 'Ceph-CSI driver - updated to v3.12, bringing new RBD options, log rotation, and updated sidecar - images.', 'New cluster options to allow updating OSD device class (allowDeviceClassUpdate: - true) and OSD weight (allowOsdCrushWeightUpdate: true) via the CephCluster - CR.'] - breaking_changes: [Minimum supported Kubernetes version is now v1.26; upgrade - Kubernetes before upgrading Rook if needed., CephBlockPool updates now error - when an invalid deviceClass is specified; existing pools with invalid device - class settings may fail until corrected., "CSI network \u201Cholder\u201D\ - \ pods are now deprecated and should be disabled if present; this becomes\ - \ required before upgrading to Rook v1.16.", Ceph COSI driver image changes - can impact existing COSI Buckets/BucketClaims/BucketAccesses; follow the - upstream migration guide before/after upgrade., Object store endpoint behavior - changes when spec.hosting is set; use the new spec.hosting.advertiseEndpoint - to get the desired endpoint behavior.] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Kubernetes minimum supported version increases to 1.26 in v1.15.0 (was 1.25 + in v1.14.0); verify cluster version before upgrading. + - Rook now uses fully-qualified image names (e.g., docker.io/rook/ceph) in operator + manifests and Helm charts; if you mirror images or use private registries, + ensure overrides still work as expected. + - Ceph-CSI sidecars/images updated with Ceph-CSI v3.12; expect rolling restarts + of CSI components during upgrade. + features: + - Adds support for Ceph Squid (v19) in addition to Reef (v18) and Quincy (v17); + note Quincy support will be removed in Rook v1.16. + - Ceph-CSI driver updated to v3.12, bringing new RBD options, log rotation, + and updated sidecar images. + - 'New cluster options to allow updating OSD device class (allowDeviceClassUpdate: + true) and OSD weight (allowOsdCrushWeightUpdate: true) via the CephCluster + CR.' + breaking_changes: + - Minimum supported Kubernetes version is now v1.26; upgrade Kubernetes before + upgrading Rook if needed. + - CephBlockPool updates now error when an invalid deviceClass is specified; + existing pools with invalid device class settings may fail until corrected. + - "CSI network \u201Cholder\u201D pods are now deprecated and should be disabled\ + \ if present; this becomes required before upgrading to Rook v1.16." + - Ceph COSI driver image changes can impact existing COSI Buckets/BucketClaims/BucketAccesses; + follow the upstream migration guide before/after upgrade. + - Object store endpoint behavior changes when spec.hosting is set; use the new + spec.hosting.advertiseEndpoint to get the desired endpoint behavior. chart_version: 1.15.0 images: [] - version: 1.14.0 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.25'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.25' requirements: [] incompatibilities: [] summary: @@ -22932,81 +30395,116 @@ addons: \ config. If you relied on it (especially if set to `\"true\"`), configure\ \ the equivalent **per-`CephCluster` CSI driver options** before upgrading\ \ (see the v1.14 docs for `csi.driverOptions`).\n" - chart_updates: [Kubernetes minimum version raised to **v1.25** (cluster must - be upgraded first)., Ceph daemon pods that used the `default` service account - now use **`rook-ceph-default`** (review any RBAC/PSA/PodSecurity policies - or tooling that assumed `default`)., CSI network *plugin holder* pods are - being deprecated; optional migration in v1.14 but plan to disable/migrate - ahead of a future required removal.] - features: ["Supports Kubernetes **v1.25\u2013v1.29** (v1.30 planned once released).", - CephBlockPool CR can set a custom Ceph `application` value., RGW object stores - can share metadata/data pools using RADOS namespaces to reduce pool count - when multiple object stores exist., Adds VolumeSnapshotGroup support for - RBD and CephFS CSI drivers., Adds S3 virtual-host-style bucket access via - `hosting.dnsNames` in CephObjectStore., Allows configuring a static prefix - for CSI drivers and the OBC provisioner (default prefix is the `rook-ceph` - namespace)., Adds Azure Key Vault KMS integration for storing OSD encryption - keys., Adds additional status columns for `kubectl get` output on Rook CRDs.] - breaking_changes: [Minimum supported Kubernetes version is now **v1.25**; upgrade - Kubernetes before upgrading Rook., Helm CSI image configuration changed - from a single `image` to separate `repository` + `tag` fields; existing - values must be updated., CSI network *holder* pods are deprecated; v1.14 - migration is optional but will be required in a future release (plan remediation)., - Operator config `CSI_ENABLE_READ_AFFINITY` removed; configure read-affinity - via each `CephCluster` CSI driver options before upgrading if you previously - enabled it.] + chart_updates: + - Kubernetes minimum version raised to **v1.25** (cluster must be upgraded first). + - Ceph daemon pods that used the `default` service account now use **`rook-ceph-default`** + (review any RBAC/PSA/PodSecurity policies or tooling that assumed `default`). + - CSI network *plugin holder* pods are being deprecated; optional migration + in v1.14 but plan to disable/migrate ahead of a future required removal. + features: + - "Supports Kubernetes **v1.25\u2013v1.29** (v1.30 planned once released)." + - CephBlockPool CR can set a custom Ceph `application` value. + - RGW object stores can share metadata/data pools using RADOS namespaces to + reduce pool count when multiple object stores exist. + - Adds VolumeSnapshotGroup support for RBD and CephFS CSI drivers. + - Adds S3 virtual-host-style bucket access via `hosting.dnsNames` in CephObjectStore. + - Allows configuring a static prefix for CSI drivers and the OBC provisioner + (default prefix is the `rook-ceph` namespace). + - Adds Azure Key Vault KMS integration for storing OSD encryption keys. + - Adds additional status columns for `kubectl get` output on Rook CRDs. + breaking_changes: + - Minimum supported Kubernetes version is now **v1.25**; upgrade Kubernetes + before upgrading Rook. + - Helm CSI image configuration changed from a single `image` to separate `repository` + + `tag` fields; existing values must be updated. + - CSI network *holder* pods are deprecated; v1.14 migration is optional but + will be required in a future release (plan remediation). + - Operator config `CSI_ENABLE_READ_AFFINITY` removed; configure read-affinity + via each `CephCluster` CSI driver options before upgrading if you previously + enabled it. chart_version: 1.14.0 images: [] - version: 1.13.0 - kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Default Ceph-CSI driver moves from v3.9 (in 1.12) to v3.10 in 1.13., - Added experimental `cephConfig` in the `CephCluster` CR to set Ceph config - options via the CR; these settings override existing ceph.conf override - mechanisms., CSI read-affinity settings are now configured per-cluster in - the `CephCluster` CR instead of the operator ConfigMap., CephFS default - SubvolumeGroup now enables pinning by default to spread load predictably - across MDS ranks., Ceph exporter now uses a reduced-privilege keyring instead - of the admin keyring., MONs will automatically fail over when `hostNetwork` - is changed in the `CephCluster` CR., Rook will honor the label `ceph.rook.io/do-not-reconcile` - on all Ceph daemons to allow advanced maintenance/debug workflows.] - breaking_changes: [Ceph Pacific (v16) support is removed; only Ceph Quincy (v17) - and Reef (v18) are supported in 1.13., Minimum Kubernetes version increases - to v1.23 (from v1.22 in 1.12)., 'Minimum supported Ceph-CSI driver increases - to 3.9 (1.12 already required 3.8+, but 1.13 requires 3.9+).', 'Rook admission - controller is removed; if you had enabled it, disable it before upgrading - per the 1.13 upgrade guide.'] + kube: + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Default Ceph-CSI driver moves from v3.9 (in 1.12) to v3.10 in 1.13. + - Added experimental `cephConfig` in the `CephCluster` CR to set Ceph config + options via the CR; these settings override existing ceph.conf override mechanisms. + - CSI read-affinity settings are now configured per-cluster in the `CephCluster` + CR instead of the operator ConfigMap. + - CephFS default SubvolumeGroup now enables pinning by default to spread load + predictably across MDS ranks. + - Ceph exporter now uses a reduced-privilege keyring instead of the admin keyring. + - MONs will automatically fail over when `hostNetwork` is changed in the `CephCluster` + CR. + - Rook will honor the label `ceph.rook.io/do-not-reconcile` on all Ceph daemons + to allow advanced maintenance/debug workflows. + breaking_changes: + - Ceph Pacific (v16) support is removed; only Ceph Quincy (v17) and Reef (v18) + are supported in 1.13. + - Minimum Kubernetes version increases to v1.23 (from v1.22 in 1.12). + - Minimum supported Ceph-CSI driver increases to 3.9 (1.12 already required + 3.8+, but 1.13 requires 3.9+). + - Rook admission controller is removed; if you had enabled it, disable it before + upgrading per the 1.13 upgrade guide. chart_version: 1.13.0 images: [] - version: 1.12.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Support for Ceph Reef (v18)., Ceph CSI default version bumped to - v3.9 (minimum supported v3.8)., Experimental Ceph COSI driver added to provision - object buckets., Automation to recover RBD (RWO) volumes after node loss - (requires CSI-addons and K8s v1.26 non-graceful node shutdown feature)., - Multus network validation tool and improvements to external Ceph cluster configuration - script., Security hardening by dropping container capabilities., Ability - to disable ObjectBucketClaim and ObjectBucketNotification controllers., - 'NFS enhancements: experimental RGW backend for CephNFS, NFS-Ganesha v5.1 - monitoring endpoint support, and kerberos bug fixes.'] - breaking_changes: [Minimum supported Kubernetes version is now v1.22 (was v1.21 - in v1.11)., 'Minimum supported Ceph-CSI driver is now 3.8; if you pin CSI - images/versions, update them accordingly.', 'For CephObjectStores, a manually-set - `rgw_run_sync_thread` (via `ceph config set`) will be overridden based on - `disableMultisiteSyncTraffic`; validate multisite/sync behavior after upgrade.'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Support for Ceph Reef (v18). + - Ceph CSI default version bumped to v3.9 (minimum supported v3.8). + - Experimental Ceph COSI driver added to provision object buckets. + - Automation to recover RBD (RWO) volumes after node loss (requires CSI-addons + and K8s v1.26 non-graceful node shutdown feature). + - Multus network validation tool and improvements to external Ceph cluster configuration + script. + - Security hardening by dropping container capabilities. + - Ability to disable ObjectBucketClaim and ObjectBucketNotification controllers. + - 'NFS enhancements: experimental RGW backend for CephNFS, NFS-Ganesha v5.1 + monitoring endpoint support, and kerberos bug fixes.' + breaking_changes: + - Minimum supported Kubernetes version is now v1.22 (was v1.21 in v1.11). + - Minimum supported Ceph-CSI driver is now 3.8; if you pin CSI images/versions, + update them accordingly. + - For CephObjectStores, a manually-set `rgw_run_sync_thread` (via `ceph config + set`) will be overridden based on `disableMultisiteSyncTraffic`; validate + multisite/sync behavior after upgrade. chart_version: 1.12.0 images: [] - version: 1.11.0 - kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -23017,36 +30515,49 @@ addons: \ settings related to **MachineDisruptionBudgets** were removed (see breaking\ \ changes). If you previously set these via chart values/CR, remove them before\ \ upgrading:\n - `manageMachineDisruptionBudgets`\n - `machineDisruptionBudgetNamespace`\n" - chart_updates: [Charts should no longer assume/enable PodSecurityPolicy by default - (`pspEnable` default is `false`)., Any chart templating/values that referenced - MachineDisruptionBudgets-related settings must be removed/updated accordingly., - Expect updated manifests/images for the new default Ceph-CSI version (now - v3.8).] - features: ['Ceph-CSI default version is now v3.8, bringing new storage features - and fixes compared to v3.7.', 'New `requireMsgr2` option on `CephCluster` - allows enforcing msgr2-only communication (kernel 5.11+), enabling wire - features like encryption/compression.', RGW bucket notifications and topics - are now considered stable., 'Ceph exporter daemon becomes the preferred - metrics source (performance counters), reducing load on the Ceph mgr and - improving scalability.', RBD read affinity is available via krbd map options - to prefer nearby OSDs based on CRUSH/topology labels., 'Multi-cluster mirroring - with overlapping networks is supported via MCS-compatible solutions (e.g., - Submariner globalnet) for Ceph v17.2.6+.', 'Standby Ceph mgr readiness is - now handled via readiness probes (active passes, standby fails) instead - of a sidecar.'] - breaking_changes: [Kubernetes minimum supported version increased to **v1.21** - (ensure the cluster control plane and nodes meet this before upgrading)., - 'Minimum supported Ceph-CSI version is **v3.7**; Rook 1.11 deploys **v3.8** - by default, so pinning older CSI versions will not be supported.', 'MachineDisruptionBudgets - support was removed; delete/stop using related `CephCluster` fields (`manageMachineDisruptionBudgets`, - `machineDisruptionBudgetNamespace`) and any dependent automation.', 'If - you relied on PodSecurityPolicy being enabled by default, you must now explicitly - enable it (older K8s only) or migrate to Pod Security Standards/admission - alternatives.'] + chart_updates: + - Charts should no longer assume/enable PodSecurityPolicy by default (`pspEnable` + default is `false`). + - Any chart templating/values that referenced MachineDisruptionBudgets-related + settings must be removed/updated accordingly. + - Expect updated manifests/images for the new default Ceph-CSI version (now + v3.8). + features: + - Ceph-CSI default version is now v3.8, bringing new storage features and fixes + compared to v3.7. + - New `requireMsgr2` option on `CephCluster` allows enforcing msgr2-only communication + (kernel 5.11+), enabling wire features like encryption/compression. + - RGW bucket notifications and topics are now considered stable. + - Ceph exporter daemon becomes the preferred metrics source (performance counters), + reducing load on the Ceph mgr and improving scalability. + - RBD read affinity is available via krbd map options to prefer nearby OSDs + based on CRUSH/topology labels. + - Multi-cluster mirroring with overlapping networks is supported via MCS-compatible + solutions (e.g., Submariner globalnet) for Ceph v17.2.6+. + - Standby Ceph mgr readiness is now handled via readiness probes (active passes, + standby fails) instead of a sidecar. + breaking_changes: + - Kubernetes minimum supported version increased to **v1.21** (ensure the cluster + control plane and nodes meet this before upgrading). + - Minimum supported Ceph-CSI version is **v3.7**; Rook 1.11 deploys **v3.8** + by default, so pinning older CSI versions will not be supported. + - MachineDisruptionBudgets support was removed; delete/stop using related `CephCluster` + fields (`manageMachineDisruptionBudgets`, `machineDisruptionBudgetNamespace`) + and any dependent automation. + - If you relied on PodSecurityPolicy being enabled by default, you must now + explicitly enable it (older K8s only) or migrate to Pod Security Standards/admission + alternatives. chart_version: 1.11.0 images: [] - version: 1.10.0 - kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + kube: + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: @@ -23064,30 +30575,44 @@ addons: \ Ensure your Ceph cluster is **>= v16 (Pacific)** before upgrading to Rook\ \ **v1.10**.\n- **Kubernetes minimum version**: Rook **v1.10** requires **Kubernetes\ \ >= 1.19**." - chart_updates: [Prometheus alerting rules are now installed/managed by the **cluster - Helm chart** when enabled via `monitoring.createPrometheusRules` (instead - of being created via the `CephCluster` CR setting)., Helm charts now ship - with **default resource requests/limits** for Ceph component pods (review - and tune for your environment).] - features: [Ceph-CSI **v3.7** becomes the default CSI driver version with Rook - v1.10 (brings CSI feature updates per upstream v3.7 notes)., 'RGW adds support - for **AWS Server Side Encryption** (AWS-SSE:S3) configuration.', '`customEndpoints` - added for Object Multi-site connections in `CephObjectZone`.', Host-based - clusters can use OSDs on **logical volumes (LVM)** in addition to raw devices/partitions., - 'Toolbox pod now uses the **Ceph image directly**, matching the Ceph version - running in your cluster.', (From v1.9) Network **encryption** and **compression** - settings are configurable via `CephCluster` (with kernel/Ceph version prerequisites).] - breaking_changes: ['MDS liveness/startup probes must be configured on **`CephFilesystem`**, - not `CephCluster` (update your CR manifests accordingly).', Ceph Octopus - (v15) is **no longer supported** in v1.10; upgrade Ceph to **>= v16** first., - Rook v1.10 requires **Kubernetes >= 1.19**., 'If you depended on `CephCluster.spec.monitoring.enabled` - to create Prometheus rules, switch to Helm value **`monitoring.createPrometheusRules`**.', - Helm charts now apply **default pod resources** for Ceph components; this - can change scheduling/limits if you were not explicitly setting them.] + chart_updates: + - Prometheus alerting rules are now installed/managed by the **cluster Helm + chart** when enabled via `monitoring.createPrometheusRules` (instead of being + created via the `CephCluster` CR setting). + - Helm charts now ship with **default resource requests/limits** for Ceph component + pods (review and tune for your environment). + features: + - Ceph-CSI **v3.7** becomes the default CSI driver version with Rook v1.10 (brings + CSI feature updates per upstream v3.7 notes). + - RGW adds support for **AWS Server Side Encryption** (AWS-SSE:S3) configuration. + - '`customEndpoints` added for Object Multi-site connections in `CephObjectZone`.' + - Host-based clusters can use OSDs on **logical volumes (LVM)** in addition + to raw devices/partitions. + - Toolbox pod now uses the **Ceph image directly**, matching the Ceph version + running in your cluster. + - (From v1.9) Network **encryption** and **compression** settings are configurable + via `CephCluster` (with kernel/Ceph version prerequisites). + breaking_changes: + - MDS liveness/startup probes must be configured on **`CephFilesystem`**, not + `CephCluster` (update your CR manifests accordingly). + - Ceph Octopus (v15) is **no longer supported** in v1.10; upgrade Ceph to **>= + v16** first. + - Rook v1.10 requires **Kubernetes >= 1.19**. + - If you depended on `CephCluster.spec.monitoring.enabled` to create Prometheus + rules, switch to Helm value **`monitoring.createPrometheusRules`**. + - Helm charts now apply **default pod resources** for Ceph components; this + can change scheduling/limits if you were not explicitly setting them. chart_version: 1.10.0 images: [] - version: 1.9.0 - kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: @@ -23102,57 +30627,98 @@ addons: \ moved:** MDS liveness/startup probes are no longer configured via `CephCluster`;\ \ they are configured via the **`CephFilesystem` CR**. If you set or tuned\ \ MDS probes, migrate those settings accordingly." - chart_updates: [Prometheus alerting rules are now deployed by the rook-ceph-cluster - Helm chart (when enabled) rather than being created based on `CephCluster.spec.monitoring.enabled`., - Helm charts now include default CPU/memory resource requests/limits (or requests) - for all Ceph component pods; these may change scheduling behavior and should - be reviewed before upgrade.] - features: [Example clusters now run **2 mgr daemons** (active + standby) for - higher availability; services labeled `app=rook-ceph-mgr` will be updated - to point to the new active mgr after failover., '**Network encryption** - can be configured via `CephCluster` network settings (requires Linux kernel - 5.11+).', '**Network compression** can be configured via `CephCluster` network - settings (requires Ceph Quincy/v17 plus a newer kernel, similar to encryption - requirements).', CSI pods can be configured with a **custom `ceph.conf`**., - Updated/added **Ceph Prometheus rules** aligned with upstream Ceph recommendations; - can be created via Helm with `monitoring.createPrometheusRules`., RGW pods - now use a dedicated **`rook-ceph-rgw` service account**., New **`CephBlockPoolRadosNamespace` - CRD** to manage RADOS namespaces within a pool.] - breaking_changes: [MDS liveness/startup probes configuration moved from `CephCluster` - to `CephFilesystem`; existing `CephCluster` probe settings will no longer - apply until migrated., 'Helm charts now set default pod resources for Ceph - components, which can cause scheduling/admission changes (e.g., pods may - not schedule on small nodes) unless values are adjusted.', Prometheus rules - are no longer created by `CephCluster.spec.monitoring.enabled`; Helm users - must enable rule creation with `monitoring.createPrometheusRules` (or manage - rules externally)., 'The obsolete cross-build container was removed (mostly - impacts CI/build workflows, not runtime clusters).'] + chart_updates: + - Prometheus alerting rules are now deployed by the rook-ceph-cluster Helm chart + (when enabled) rather than being created based on `CephCluster.spec.monitoring.enabled`. + - Helm charts now include default CPU/memory resource requests/limits (or requests) + for all Ceph component pods; these may change scheduling behavior and should + be reviewed before upgrade. + features: + - Example clusters now run **2 mgr daemons** (active + standby) for higher availability; + services labeled `app=rook-ceph-mgr` will be updated to point to the new active + mgr after failover. + - '**Network encryption** can be configured via `CephCluster` network settings + (requires Linux kernel 5.11+).' + - '**Network compression** can be configured via `CephCluster` network settings + (requires Ceph Quincy/v17 plus a newer kernel, similar to encryption requirements).' + - CSI pods can be configured with a **custom `ceph.conf`**. + - Updated/added **Ceph Prometheus rules** aligned with upstream Ceph recommendations; + can be created via Helm with `monitoring.createPrometheusRules`. + - RGW pods now use a dedicated **`rook-ceph-rgw` service account**. + - New **`CephBlockPoolRadosNamespace` CRD** to manage RADOS namespaces within + a pool. + breaking_changes: + - MDS liveness/startup probes configuration moved from `CephCluster` to `CephFilesystem`; + existing `CephCluster` probe settings will no longer apply until migrated. + - Helm charts now set default pod resources for Ceph components, which can cause + scheduling/admission changes (e.g., pods may not schedule on small nodes) + unless values are adjusted. + - Prometheus rules are no longer created by `CephCluster.spec.monitoring.enabled`; + Helm users must enable rule creation with `monitoring.createPrometheusRules` + (or manage rules externally). + - The obsolete cross-build container was removed (mostly impacts CI/build workflows, + not runtime clusters). chart_version: 1.9.0 images: [] - version: 1.8.0 - kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null chart_version: 1.8.0 images: [] - version: 1.7.0 - kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null - version: 1.6.0 - kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 1.5.0 - kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15'] + kube: + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null - version: 1.4.0 - kube: ['1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14'] + kube: + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' requirements: [] incompatibilities: [] summary: null @@ -23162,253 +30728,893 @@ addons: release_url: https://github.com/strimzi/strimzi-kafka-operator/releases/tag/{vsn} versions: - version: 0.50.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null - version: 0.49.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null - version: 0.48.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null - version: 0.47.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.46.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.45.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.44.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 0.43.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.42.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.41.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.40.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null - version: 0.39.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 0.38.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 0.37.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 0.36.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: null - version: 0.35.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 0.34.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 0.33.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 0.32.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null - version: 0.31.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.30.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.29.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.28.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.27.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.26.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.25.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.24.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.23.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.22.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.21.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' requirements: [] incompatibilities: [] summary: null - version: 0.20.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.19.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.18.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.17.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.16.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.15.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.14.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.13.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null - version: 0.12.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', - '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' + - '1.16' + - '1.15' + - '1.14' + - '1.13' + - '1.12' + - '1.11' requirements: [] incompatibilities: [] summary: null @@ -23420,245 +31626,343 @@ addons: eolApiSlug: traefik versions: - version: 3.7.12 - kube: ['1.36', '1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['v3.7.0 introduced a large batch of new capabilities, mostly around - Kubernetes integrations (Ingress-NGINX provider annotation compatibility, - Gateway API enhancements, and CRD improvements), plus new middleware and - UI/observability options.', 'v3.7.12 is primarily a security and stability - patch release, fixing three published CVEs and a handful of correctness/robustness - issues (HTTP/3 timeouts, file provider error context, ingress-nginx edge - cases, and service weight validation).'] - breaking_changes: ['Potential behavior changes within v3.7.x to watch for include - stricter handling/sanitization of headers and URLs (e.g., removal of untrusted - X- headers with underscores, encoded character handling becoming opt-in) - which could affect applications that relied on previously accepted requests.', - ForwardAuth.TrustForwardHeader was deprecated in v3.7.0; plan to adjust configurations - and validate forward-auth behavior if you were using that option.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - v3.7.0 introduced a large batch of new capabilities, mostly around Kubernetes + integrations (Ingress-NGINX provider annotation compatibility, Gateway API + enhancements, and CRD improvements), plus new middleware and UI/observability + options. + - v3.7.12 is primarily a security and stability patch release, fixing three + published CVEs and a handful of correctness/robustness issues (HTTP/3 timeouts, + file provider error context, ingress-nginx edge cases, and service weight + validation). + breaking_changes: + - Potential behavior changes within v3.7.x to watch for include stricter handling/sanitization + of headers and URLs (e.g., removal of untrusted X- headers with underscores, + encoded character handling becoming opt-in) which could affect applications + that relied on previously accepted requests. + - ForwardAuth.TrustForwardHeader was deprecated in v3.7.0; plan to adjust configurations + and validate forward-auth behavior if you were using that option. chart_version: 41.4.0 images: [] - version: 3.7.0 - kube: ['1.36', '1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Kubernetes ingress-nginx provider gained broad compatibility with - many NGINX annotations (rate limiting, auth snippets, rewrites, timeouts, - buffering, canary, custom headers, allow/whitelist ranges, etc.), making - Traefik a more drop-in replacement for NGINX Ingress setups.', 'Gateway - API improvements include support for multiple certificateRefs per listener - and secret support for BackendTLSPolicy caCertificateRefs, plus a bump to - gateway-api v1.5.1.', 'Kubernetes CRDs gained new capabilities: ingressClassName - in CRD specs, TraefikService failover support, and ServersTransport cipherSuites - configuration.', 'New routing control: configurable provider routing precedence, - and wildcard host support in Host/HostSNI matchers (Ingress/Gateway/ingress-nginx - contexts).', Observability and logging enhancements include additional Kubernetes - Ingress access-log fields and the ability to emit stdio access logs alongside - OTLP logging., 'Security/HTTP handling additions include a new encodedCharacters - middleware, improved retry logic based on status codes/timeouts/non-idempotent - methods, and options around handling/sanitizing encoded characters.', 'Dashboard/UI - improvements add a certificates overview/menu, server weight display, and - configurable dashboard name.'] - breaking_changes: [ForwardAuth.TrustForwardHeader is deprecated; configurations - relying on it should be reviewed and updated per the v3.7 migration guide., - Traefik is stricter about suspicious/encoded characters (now rejected by default/with - new opt-in controls); applications depending on unusual encoded URLs may - see new 4xx responses unless configured appropriately., 'Access logs may - now be produced for rejected requests, which can change log volume/alerting - expectations.', 'Ingress NGINX provider: the experimental flag is deprecated - and the provider underwent refactors; some behaviors (e.g., SSL redirect, - rewrite-target handling) changed/fixed and should be validated against your - current annotations/config.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Kubernetes ingress-nginx provider gained broad compatibility with many NGINX + annotations (rate limiting, auth snippets, rewrites, timeouts, buffering, + canary, custom headers, allow/whitelist ranges, etc.), making Traefik a more + drop-in replacement for NGINX Ingress setups. + - Gateway API improvements include support for multiple certificateRefs per + listener and secret support for BackendTLSPolicy caCertificateRefs, plus a + bump to gateway-api v1.5.1. + - 'Kubernetes CRDs gained new capabilities: ingressClassName in CRD specs, TraefikService + failover support, and ServersTransport cipherSuites configuration.' + - 'New routing control: configurable provider routing precedence, and wildcard + host support in Host/HostSNI matchers (Ingress/Gateway/ingress-nginx contexts).' + - Observability and logging enhancements include additional Kubernetes Ingress + access-log fields and the ability to emit stdio access logs alongside OTLP + logging. + - Security/HTTP handling additions include a new encodedCharacters middleware, + improved retry logic based on status codes/timeouts/non-idempotent methods, + and options around handling/sanitizing encoded characters. + - Dashboard/UI improvements add a certificates overview/menu, server weight + display, and configurable dashboard name. + breaking_changes: + - ForwardAuth.TrustForwardHeader is deprecated; configurations relying on it + should be reviewed and updated per the v3.7 migration guide. + - Traefik is stricter about suspicious/encoded characters (now rejected by default/with + new opt-in controls); applications depending on unusual encoded URLs may see + new 4xx responses unless configured appropriately. + - Access logs may now be produced for rejected requests, which can change log + volume/alerting expectations. + - 'Ingress NGINX provider: the experimental flag is deprecated and the provider + underwent refactors; some behaviors (e.g., SSL redirect, rewrite-target handling) + changed/fixed and should be validated against your current annotations/config.' chart_version: 40.0.1 images: [] - version: 3.6.0 - kube: ['1.35', '1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['ACME: new certificate resolver options, following earlier v3.5 OCSP - stapling and HTTP challenge delay/timeout improvements.', 'Health checks: - adds TCP health checks and passive health checks (in addition to v3.5 healthcheck - improvements).', 'Load balancing: adds "least time" strategy and HighestRandomWeight - algorithm (plus CRD support for HighestRandomWeight).', 'Kubernetes: Gateway - API bumped to v1.4.0; Ingress can publish ExternalName services; adds a - Knative provider.', 'Docker/ECS: can discover non-running Docker containers; - ECS gains IPv6 support.', "Middleware/server: multi-layer routing; warning\ - \ when maxBodySize isn\u2019t set.", 'Plugins: adds syscall support; earlier - v3.5 allowed enabling unsafe yaegi via plugin manifest.', 'HTTP/2: adds - HPACK table size tuning options.', 'Web UI: dashboard continues React migration - and adds Hub demo plus layout tweaks.'] - breaking_changes: ['Potential behavior change risk: multi-layer routing and - new load-balancing/healthcheck features may alter request routing/traffic - patterns if enabled.', Gateway API bump may expose/require updated CRDs - or behavior differences depending on cluster/controller versions., 'Ingress - prefix-matching behavior was made consistent with Kubernetes docs in v3.5; - if you rely on the old behavior, routes may match differently after upgrading - to >=3.5 (including 3.6).'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'ACME: new certificate resolver options, following earlier v3.5 OCSP stapling + and HTTP challenge delay/timeout improvements.' + - 'Health checks: adds TCP health checks and passive health checks (in addition + to v3.5 healthcheck improvements).' + - 'Load balancing: adds "least time" strategy and HighestRandomWeight algorithm + (plus CRD support for HighestRandomWeight).' + - 'Kubernetes: Gateway API bumped to v1.4.0; Ingress can publish ExternalName + services; adds a Knative provider.' + - 'Docker/ECS: can discover non-running Docker containers; ECS gains IPv6 support.' + - "Middleware/server: multi-layer routing; warning when maxBodySize isn\u2019\ + t set." + - 'Plugins: adds syscall support; earlier v3.5 allowed enabling unsafe yaegi + via plugin manifest.' + - 'HTTP/2: adds HPACK table size tuning options.' + - 'Web UI: dashboard continues React migration and adds Hub demo plus layout + tweaks.' + breaking_changes: + - 'Potential behavior change risk: multi-layer routing and new load-balancing/healthcheck + features may alter request routing/traffic patterns if enabled.' + - Gateway API bump may expose/require updated CRDs or behavior differences depending + on cluster/controller versions. + - Ingress prefix-matching behavior was made consistent with Kubernetes docs + in v3.5; if you rely on the old behavior, routes may match differently after + upgrading to >=3.5 (including 3.6). chart_version: 37.3.0 - images: ['docker.io/traefik:v3.6.0'] + images: + - docker.io/traefik:v3.6.0 eolAt: '2026-08-16' - version: 3.5.0 - kube: ['1.35', '1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['ACME improvements: OCSP stapling support plus new tuning options - for HTTP-01 challenge delay and ACME HTTP client timeout.', 'Kubernetes-related - additions: new NGINX Ingress provider and Gateway API dependency bumped - to v1.3.0.', 'Ingress behavior change: Prefix path matching is now consistent - with Kubernetes documentation (may affect which Ingress rules match).', - 'Observability improvements for OpenTelemetry: more resource attribute detectors, - automatic k8s resource attributes, new resourceAttributes option for OTel - metrics, and reduced default tracing span volume with trace verbosity control.', - 'Dashboard updates: UI migrated to React and improved visualization for Errors - middleware StatusRewrites.', 'TLS enhancement: adds X25519MLKEM768 (post-quantum) - key exchange option.', 'Plugin system: plugin manifests can now allow enabling - unsafe mode in Yaegi.', 'ForwardAuth middleware: better handling of context-canceled - scenarios.'] - breaking_changes: ['Potential behavioral change for Kubernetes Ingress Prefix - matching; verify your Ingress rules/routes still match as expected after - upgrade, especially for overlapping prefixes.', Trace output may change - because Traefik produces fewer spans by default due to new trace verbosity - behavior; dashboards/alerts based on span counts may need adjustment.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'ACME improvements: OCSP stapling support plus new tuning options for HTTP-01 + challenge delay and ACME HTTP client timeout.' + - 'Kubernetes-related additions: new NGINX Ingress provider and Gateway API + dependency bumped to v1.3.0.' + - 'Ingress behavior change: Prefix path matching is now consistent with Kubernetes + documentation (may affect which Ingress rules match).' + - 'Observability improvements for OpenTelemetry: more resource attribute detectors, + automatic k8s resource attributes, new resourceAttributes option for OTel + metrics, and reduced default tracing span volume with trace verbosity control.' + - 'Dashboard updates: UI migrated to React and improved visualization for Errors + middleware StatusRewrites.' + - 'TLS enhancement: adds X25519MLKEM768 (post-quantum) key exchange option.' + - 'Plugin system: plugin manifests can now allow enabling unsafe mode in Yaegi.' + - 'ForwardAuth middleware: better handling of context-canceled scenarios.' + breaking_changes: + - Potential behavioral change for Kubernetes Ingress Prefix matching; verify + your Ingress rules/routes still match as expected after upgrade, especially + for overlapping prefixes. + - Trace output may change because Traefik produces fewer spans by default due + to new trace verbosity behavior; dashboards/alerts based on span counts may + need adjustment. chart_version: 37.0.0 - images: ['docker.io/traefik:v3.5.0'] + images: + - docker.io/traefik:v3.5.0 eolAt: '2025-11-07' - version: 3.4.0 - kube: ['1.35', '1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Security hardening in v3.3.6: request path is now sanitized (collapses - /../, /./ and duplicate slashes) before router matching and before forwarding - to backends.', v3.4.0 adds ACME options `acme.profile` and `acme.emailAddresses`., - v3.4.0 adds a Redis-backed rate limiter middleware., v3.4.0 adds `p2c` (power-of-two-choices) - load-balancing strategy for services., v3.4.0 extends forwardAuth to optionally - preserve the original request method., 'v3.4.0 improves Kubernetes support: - better CRD CEL validations, Gateway API TLSRoute rule priority, and ingress - status for ClusterIP/NodePort services.', 'v3.4.0 adds TLS features: add - root CAs via ConfigMaps and ability to disable TLS session tickets.', v3.4.0 - adds sticky-session cookie domain configuration and WebUI auto theme option.] - breaking_changes: ['Potential behavior change starting v3.3.6: request path - sanitization can change routing/backends for paths containing dot-segments - or duplicate slashes; validate against your existing router rules and any - apps that rely on raw paths.', 'v3.4.0 removes the default load-balancing - strategy from Kubernetes IngressRoute/CRD resources; if you relied on the - implicit default, you may need to set an explicit strategy.', '`defaultRuleSyntax` - and `ruleSyntax` are deprecated in v3.4.0 (plan to remove/avoid using them - going forward).'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Security hardening in v3.3.6: request path is now sanitized (collapses /../, + /./ and duplicate slashes) before router matching and before forwarding to + backends.' + - v3.4.0 adds ACME options `acme.profile` and `acme.emailAddresses`. + - v3.4.0 adds a Redis-backed rate limiter middleware. + - v3.4.0 adds `p2c` (power-of-two-choices) load-balancing strategy for services. + - v3.4.0 extends forwardAuth to optionally preserve the original request method. + - 'v3.4.0 improves Kubernetes support: better CRD CEL validations, Gateway API + TLSRoute rule priority, and ingress status for ClusterIP/NodePort services.' + - 'v3.4.0 adds TLS features: add root CAs via ConfigMaps and ability to disable + TLS session tickets.' + - v3.4.0 adds sticky-session cookie domain configuration and WebUI auto theme + option. + breaking_changes: + - 'Potential behavior change starting v3.3.6: request path sanitization can + change routing/backends for paths containing dot-segments or duplicate slashes; + validate against your existing router rules and any apps that rely on raw + paths.' + - v3.4.0 removes the default load-balancing strategy from Kubernetes IngressRoute/CRD + resources; if you relied on the implicit default, you may need to set an explicit + strategy. + - '`defaultRuleSyntax` and `ruleSyntax` are deprecated in v3.4.0 (plan to remove/avoid + using them going forward).' chart_version: 35.4.0 - images: ['docker.io/traefik:v3.4.0'] + images: + - docker.io/traefik:v3.4.0 eolAt: '2025-07-23' - version: 3.3.6 - kube: ['1.34', '1.33', '1.32', '1.31'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 35.2.0 - images: ['docker.io/traefik:v3.3.6'] + images: + - docker.io/traefik:v3.3.6 eolAt: '2025-05-05' - version: 3.3.0 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null eolAt: '2025-05-05' - version: 3.2.0 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null chart_version: 33.0.0 - images: ['docker.io/traefik:v3.2.0'] + images: + - docker.io/traefik:v3.2.0 eolAt: '2025-01-06' - version: 3.1.7 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null eolAt: '2024-10-28' - version: 3.1.4 - kube: ['1.32', '1.31', '1.30', '1.29'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Datadog metrics output now better handles `unix://` endpoints by - guessing the socket type when the prefix is `unix` (improves compatibility - for Datadog socket configurations).'] + features: + - Datadog metrics output now better handles `unix://` endpoints by guessing + the socket type when the prefix is `unix` (improves compatibility for Datadog + socket configurations). breaking_changes: [] chart_version: 31.1.1 - images: ['docker.io/traefik:v3.1.4'] + images: + - docker.io/traefik:v3.1.4 eolAt: '2024-10-28' - version: 3.1.3 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Security fixes included in this upgrade: v3.0.2 addressed GHSA-7jmw-8259-q9jx - (CVE-2024-24790 related) and v3.1.3 includes CVE-2024-45410 (GHSA-62c8-mh53-4cqv).', - 'Kubernetes Ingress improvements: you can configure rule syntax via Ingress - annotation, and empty configuration for the Kubernetes Ingress provider - is allowed again.', 'Observability improvements and fixes: updated OpenTelemetry - dependencies, fixed Grafana label_replace for service-name in metrics, and - multiple tracing/OTLP documentation + stability fixes.', 'Compression middleware - behavior improvements: better Accept-Encoding handling (including weights) - and correct status code forwarding when Brotli compression is disabled.', - 'Plugins internal change: removed goexport dependency and added _initialize - (plugin loading/runtime change).'] - breaking_changes: ["Potentially breaking for monitoring: the v3 migration guide\ - \ notes missing metrics removal\u2014verify any dashboards/alerts that rely\ - \ on Traefik metrics that may have been removed/renamed in v3.x.", 'Kubernetes - API version expectations: documentation removes mentions of traefik.io/v1; - ensure your CRDs/manifests align with the supported API versions for Traefik - v3 (commonly traefik.io/v1alpha1 depending on resource).'] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Security fixes included in this upgrade: v3.0.2 addressed GHSA-7jmw-8259-q9jx + (CVE-2024-24790 related) and v3.1.3 includes CVE-2024-45410 (GHSA-62c8-mh53-4cqv).' + - 'Kubernetes Ingress improvements: you can configure rule syntax via Ingress + annotation, and empty configuration for the Kubernetes Ingress provider is + allowed again.' + - 'Observability improvements and fixes: updated OpenTelemetry dependencies, + fixed Grafana label_replace for service-name in metrics, and multiple tracing/OTLP + documentation + stability fixes.' + - 'Compression middleware behavior improvements: better Accept-Encoding handling + (including weights) and correct status code forwarding when Brotli compression + is disabled.' + - 'Plugins internal change: removed goexport dependency and added _initialize + (plugin loading/runtime change).' + breaking_changes: + - "Potentially breaking for monitoring: the v3 migration guide notes missing\ + \ metrics removal\u2014verify any dashboards/alerts that rely on Traefik metrics\ + \ that may have been removed/renamed in v3.x." + - 'Kubernetes API version expectations: documentation removes mentions of traefik.io/v1; + ensure your CRDs/manifests align with the supported API versions for Traefik + v3 (commonly traefik.io/v1alpha1 depending on resource).' chart_version: 31.1.0 - images: ['docker.io/traefik:v3.1.3'] + images: + - docker.io/traefik:v3.1.3 eolAt: '2024-10-28' - version: 3.0.2 - kube: ['1.31', '1.30', '1.29', '1.28'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: null chart_version: 28.3.0 - images: ['docker.io/traefik:v3.0.2'] + images: + - docker.io/traefik:v3.0.2 eolAt: '2024-07-15' - version: 2.11.13 - kube: ['1.33', '1.32', '1.31', '1.30'] + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.11.10 - kube: ['1.32', '1.31', '1.30', '1.29'] + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.11.4 - kube: ['1.31', '1.30', '1.29', '1.28'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.10.3 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: null @@ -23670,262 +31974,492 @@ addons: helm_repository_url: https://vmware-tanzu.github.io/helm-charts versions: - version: 1.18.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null - version: 1.18.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null - version: 1.17.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Velero v1.17 modernizes fs-backup to a micro-service architecture - (new controllers/pods for PVB/PVR data paths), improving concurrency control, - cancel/resume behavior, and steadier node-agent resource usage.', 'Windows - coverage expands: fs-backup now supports Windows workloads; additional Windows - tolerations added.', 'Adds Kubernetes VolumeGroupSnapshot (beta upstream) - support for CSI snapshot backup and CSI snapshot data movement, including - documentation and label-key configuration.', 'Adds PriorityClassName support - across server, node-agent, data mover pods, and repository maintenance jobs.', - Adds node-agent load-soothing via PrepareQueueLength to limit how many data-mover-related - pods are created/pending at once., 'Improves resiliency: data movements - (PVB/PVR, DU/DD) can resume after node-agent restarts; cancellation/orphan - handling improved; server restart handling improved.', Adds resource policy - includeExcludePolicy support (reusable include/exclude filters in a resource - policy ConfigMap)., Removes Restic as a valid uploader type for new installs/backups; - retains restore compatibility until v1.19 via legacy PVR controller., Moves - repository maintenance job configuration from velero server flags to a ConfigMap; - server flags removed accordingly., 'Behavior change: during PVC restore, - selected-node annotation is now always removed when no node mapping exists - (previously might be preserved).', 'Dependency bumps: Go 1.24.6, Kopia 0.21.1; - various controller/runtime/library updates and observability/metrics additions - (e.g., BSL availability gauge, BSL status checks).'] - features: ['Modernized fs-backup to a micro-service architecture with concurrency - control and improved resiliency (cancel/resume, survive node-agent restarts).', - fs-backup now supports backing up/restoring Windows workloads., Supports Kubernetes - VolumeGroupSnapshot for consistent point-in-time snapshots across multiple - volumes (CSI snapshot + CSI data movement)., PriorityClass support across - Velero components so workloads can be scheduled with appropriate priority., - Node-agent PrepareQueueLength to throttle data-mover pod creation and reduce - Pending pod storms in large clusters., Resource policy now supports reusable - include/exclude filters via includeExcludePolicy.] - breaking_changes: ['Restic deprecation: `--uploader-type=restic` is no longer - a valid install configuration in v1.17; you can still restore older Restic-based - backups until v1.19.', Repository maintenance job settings removed from - Velero server flags and must be configured via the maintenance job ConfigMap - instead., 'PVC restore behavior change: `selected-node` annotation is always - removed when no node mapping exists (previously could be preserved if the - node existed).'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Velero v1.17 modernizes fs-backup to a micro-service architecture (new controllers/pods + for PVB/PVR data paths), improving concurrency control, cancel/resume behavior, + and steadier node-agent resource usage. + - 'Windows coverage expands: fs-backup now supports Windows workloads; additional + Windows tolerations added.' + - Adds Kubernetes VolumeGroupSnapshot (beta upstream) support for CSI snapshot + backup and CSI snapshot data movement, including documentation and label-key + configuration. + - Adds PriorityClassName support across server, node-agent, data mover pods, + and repository maintenance jobs. + - Adds node-agent load-soothing via PrepareQueueLength to limit how many data-mover-related + pods are created/pending at once. + - 'Improves resiliency: data movements (PVB/PVR, DU/DD) can resume after node-agent + restarts; cancellation/orphan handling improved; server restart handling improved.' + - Adds resource policy includeExcludePolicy support (reusable include/exclude + filters in a resource policy ConfigMap). + - Removes Restic as a valid uploader type for new installs/backups; retains + restore compatibility until v1.19 via legacy PVR controller. + - Moves repository maintenance job configuration from velero server flags to + a ConfigMap; server flags removed accordingly. + - 'Behavior change: during PVC restore, selected-node annotation is now always + removed when no node mapping exists (previously might be preserved).' + - 'Dependency bumps: Go 1.24.6, Kopia 0.21.1; various controller/runtime/library + updates and observability/metrics additions (e.g., BSL availability gauge, + BSL status checks).' + features: + - Modernized fs-backup to a micro-service architecture with concurrency control + and improved resiliency (cancel/resume, survive node-agent restarts). + - fs-backup now supports backing up/restoring Windows workloads. + - Supports Kubernetes VolumeGroupSnapshot for consistent point-in-time snapshots + across multiple volumes (CSI snapshot + CSI data movement). + - PriorityClass support across Velero components so workloads can be scheduled + with appropriate priority. + - Node-agent PrepareQueueLength to throttle data-mover pod creation and reduce + Pending pod storms in large clusters. + - Resource policy now supports reusable include/exclude filters via includeExcludePolicy. + breaking_changes: + - 'Restic deprecation: `--uploader-type=restic` is no longer a valid install + configuration in v1.17; you can still restore older Restic-based backups until + v1.19.' + - Repository maintenance job settings removed from Velero server flags and must + be configured via the maintenance job ConfigMap instead. + - 'PVC restore behavior change: `selected-node` annotation is always removed + when no node mapping exists (previously could be preserved if the node existed).' chart_version: 11.3.2 - images: ['docker.io/bitnamilegacy/kubectl:1.35', 'velero/velero:v1.17.1'] + images: + - docker.io/bitnamilegacy/kubectl:1.35 + - velero/velero:v1.17.1 - version: 1.16.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Windows cluster support: Velero components (node-agent, data mover - pods, maintenance jobs) can run on both Linux and Windows nodes, and the - built-in data mover can back up/restore Windows workloads (with documented - limitations).', 'Parallel ItemBlock backup: item blocks (and their pre/post - hooks) can be processed concurrently; parallelism is controlled by the new - server flag `--item-block-worker-count` (default 1).', 'Data mover restore - scalability for WaitForFirstConsumer: new node-agent config flag `ignoreDelayBinding` - allows restores to distribute evenly across nodes instead of being constrained - to the volume-attached node.', 'Improved observability for data mover: additional - logging of intermediate object statuses on failures and errors during cleanup, - enabled by default in node-agent logs.', 'CSI snapshot usability improvement: - retained VolumeSnapshotContent objects are no longer included in backups, - reducing unnecessary sync/restore of CSI objects across clusters.', 'Backup - repository maintenance improvements: adds `RecentMaintenance` history to - BackupRepository CRs, recaptures running maintenance jobs after server restart, - skips maintenance/init for readOnly BSLs, and adds configurable `fullMaintenanceInterval` - (normalGC/fastGC/eagerGC).', 'Volume Policy enhancement: supports filtering - volumes by PVC labels.', 'Resource status restore per object: annotation - `velero.io/restore-status` can control whether to restore status for a specific - object.', 'Velero restore helper binary merged into main Velero image (velero/velero - image now includes velero, velero-helper, velero-restore-helper).'] - breaking_changes: ['If you enable parallel ItemBlock processing via `--item-block-worker-count` - > 1, expect changed backup execution characteristics (more concurrency and - resource usage); validate cluster/API server capacity and any custom plugins/hooks - for concurrency safety.', 'Windows support has functional limitations: fs-backup - is not supported for Windows workloads; security descriptors/NTFS extended - attributes are not backed up/restored, so non-admin workloads may not be - supported as expected.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Windows cluster support: Velero components (node-agent, data mover pods, + maintenance jobs) can run on both Linux and Windows nodes, and the built-in + data mover can back up/restore Windows workloads (with documented limitations).' + - 'Parallel ItemBlock backup: item blocks (and their pre/post hooks) can be + processed concurrently; parallelism is controlled by the new server flag `--item-block-worker-count` + (default 1).' + - 'Data mover restore scalability for WaitForFirstConsumer: new node-agent config + flag `ignoreDelayBinding` allows restores to distribute evenly across nodes + instead of being constrained to the volume-attached node.' + - 'Improved observability for data mover: additional logging of intermediate + object statuses on failures and errors during cleanup, enabled by default + in node-agent logs.' + - 'CSI snapshot usability improvement: retained VolumeSnapshotContent objects + are no longer included in backups, reducing unnecessary sync/restore of CSI + objects across clusters.' + - 'Backup repository maintenance improvements: adds `RecentMaintenance` history + to BackupRepository CRs, recaptures running maintenance jobs after server + restart, skips maintenance/init for readOnly BSLs, and adds configurable `fullMaintenanceInterval` + (normalGC/fastGC/eagerGC).' + - 'Volume Policy enhancement: supports filtering volumes by PVC labels.' + - 'Resource status restore per object: annotation `velero.io/restore-status` + can control whether to restore status for a specific object.' + - Velero restore helper binary merged into main Velero image (velero/velero + image now includes velero, velero-helper, velero-restore-helper). + breaking_changes: + - If you enable parallel ItemBlock processing via `--item-block-worker-count` + > 1, expect changed backup execution characteristics (more concurrency and + resource usage); validate cluster/API server capacity and any custom plugins/hooks + for concurrency safety. + - 'Windows support has functional limitations: fs-backup is not supported for + Windows workloads; security descriptors/NTFS extended attributes are not backed + up/restored, so non-admin workloads may not be supported as expected.' chart_version: 10.1.3 - images: ['docker.io/bitnamilegacy/kubectl:1.35', 'velero/velero:v1.16.2'] + images: + - docker.io/bitnamilegacy/kubectl:1.35 + - velero/velero:v1.16.2 - version: 1.15.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Data mover micro service: CSI snapshot data movement now runs in - dedicated backup/restore pods instead of node-agent hostPath access, improving - security isolation, resource control, and resilience.', Item Block + ItemBlockAction - (IBA) plugin model added to group related resources (built-in for Pods/PVCs) - in preparation for future multi-threaded backups; in 1.15 the model exists - but processing is still single-threaded., 'Repository maintenance jobs: - you can now steer maintenance jobs to specific nodes via a new repository - maintenance configuration ConfigMap.', 'BackupPVC config enhancements for - data-mover pods: support read-only mounting (can speed up expose on some - storage like Ceph) and choosing a dedicated StorageClass for BackupPVCs.', - 'Backup repository cache sizing: new backup repository configuration ConfigMap - lets you cap client-side cache per repository to avoid ephemeral-storage - eviction.', 'Performance/stability improvements: fixes a server memory leak - after plugin calls; passes client QPS/burst settings to plugins; Kopia maintenance - memory usage improved via upstream changes.'] - breaking_changes: ['Restic uploader path for filesystem backups is deprecated - starting in 1.15: backups/restores still succeed but warnings appear when - using --uploader-type=restic or restic-based fs-backup paths; plan migration - away from restic.', node-agent config ConfigMap name is no longer fixed; - if you use a non-default name you must set the node-agent server parameter - node-agent-configmap to match., 'Repository maintenance job settings are - moving from Velero server flags to a new repository maintenance job configuration - ConfigMap; if both are set, ConfigMap values win (flags remain for backward - compatibility).', Changing PVC selected-node feature is deprecated and will - be removed in a future release; avoid relying on it.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Data mover micro service: CSI snapshot data movement now runs in dedicated + backup/restore pods instead of node-agent hostPath access, improving security + isolation, resource control, and resilience.' + - Item Block + ItemBlockAction (IBA) plugin model added to group related resources + (built-in for Pods/PVCs) in preparation for future multi-threaded backups; + in 1.15 the model exists but processing is still single-threaded. + - 'Repository maintenance jobs: you can now steer maintenance jobs to specific + nodes via a new repository maintenance configuration ConfigMap.' + - 'BackupPVC config enhancements for data-mover pods: support read-only mounting + (can speed up expose on some storage like Ceph) and choosing a dedicated StorageClass + for BackupPVCs.' + - 'Backup repository cache sizing: new backup repository configuration ConfigMap + lets you cap client-side cache per repository to avoid ephemeral-storage eviction.' + - 'Performance/stability improvements: fixes a server memory leak after plugin + calls; passes client QPS/burst settings to plugins; Kopia maintenance memory + usage improved via upstream changes.' + breaking_changes: + - 'Restic uploader path for filesystem backups is deprecated starting in 1.15: + backups/restores still succeed but warnings appear when using --uploader-type=restic + or restic-based fs-backup paths; plan migration away from restic.' + - node-agent config ConfigMap name is no longer fixed; if you use a non-default + name you must set the node-agent server parameter node-agent-configmap to + match. + - Repository maintenance job settings are moving from Velero server flags to + a new repository maintenance job configuration ConfigMap; if both are set, + ConfigMap values win (flags remain for backward compatibility). + - Changing PVC selected-node feature is deprecated and will be removed in a + future release; avoid relying on it. chart_version: 8.7.2 - images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.15.2'] + images: + - docker.io/bitnami/kubectl:1.35 + - velero/velero:v1.15.2 - version: 1.14.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Moves kopia/restic repository maintenance out of the Velero server - pod into separate Kubernetes Jobs, reducing OOM risk and allowing configurable - job resource requests.', 'Extends VolumePolicies to support additional actions - (e.g., `fs-backup` and `snapshot`) so you can control per-volume backup - method without modifying workloads.', Adds node selection for data-movement - (datamover) pods via a ConfigMap to constrain where high-resource/long-running - datamover pods are scheduled., Persists VolumeInfo metadata for restores - (not just backups) and enhances `velero restore describe` to show more volume-handling - details., Introduces a new Restore workflow phase `Finalizing` to ensure - PV label restoration and post-restore hooks run after volume data movement - completes., "Adds certificate-based authentication for Azure service principals\ - \ as an alternative to client-secret auth, aligning with Azure\u2019s recommended\ - \ phishing-resistant approach."] - breaking_changes: [CSI plugin code is now merged into the main Velero repo and - is installed by default as an internal plugin; do not install it separately - via `velero install --plugins` for v1.14., 'Default CPU/memory requests - and limits for the node-agent are removed, making node-agent pods BestEffort - unless you explicitly set resources; this can change scheduling/eviction - behavior.', 'Backup namespace filtering behavior changes when `includedNamespaces`/`excludedNamespaces` - are unset but label selectors are set: only namespaces containing matching - resources are included (previously all namespaces were included).', 'Restores - may now end `PartiallyFailed` in cases where PV patching during `Finalizing` - is blocked (e.g., PV stuck `Pending`), whereas earlier versions might report - `Complete`.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Moves kopia/restic repository maintenance out of the Velero server pod into + separate Kubernetes Jobs, reducing OOM risk and allowing configurable job + resource requests. + - Extends VolumePolicies to support additional actions (e.g., `fs-backup` and + `snapshot`) so you can control per-volume backup method without modifying + workloads. + - Adds node selection for data-movement (datamover) pods via a ConfigMap to + constrain where high-resource/long-running datamover pods are scheduled. + - Persists VolumeInfo metadata for restores (not just backups) and enhances + `velero restore describe` to show more volume-handling details. + - Introduces a new Restore workflow phase `Finalizing` to ensure PV label restoration + and post-restore hooks run after volume data movement completes. + - "Adds certificate-based authentication for Azure service principals as an\ + \ alternative to client-secret auth, aligning with Azure\u2019s recommended\ + \ phishing-resistant approach." + breaking_changes: + - CSI plugin code is now merged into the main Velero repo and is installed by + default as an internal plugin; do not install it separately via `velero install + --plugins` for v1.14. + - Default CPU/memory requests and limits for the node-agent are removed, making + node-agent pods BestEffort unless you explicitly set resources; this can change + scheduling/eviction behavior. + - 'Backup namespace filtering behavior changes when `includedNamespaces`/`excludedNamespaces` + are unset but label selectors are set: only namespaces containing matching + resources are included (previously all namespaces were included).' + - Restores may now end `PartiallyFailed` in cases where PV patching during `Finalizing` + is blocked (e.g., PV stuck `Pending`), whereas earlier versions might report + `Complete`. chart_version: 7.2.2 - images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.14.1'] + images: + - docker.io/bitnami/kubectl:1.35 + - velero/velero:v1.14.1 - version: 1.13.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Resource Modifiers gained JSON Merge Patch and Strategic Merge Patch - support, enabling more flexible restore-time resource edits from the same - ConfigMap rules.', Node-agent concurrency controls were added so you can - cap/shape how many filesystem backup and CSI snapshot data-mover operations - run per node (globally and per-node)., Kopia uploader now supports configurable - parallel file upload options to speed up filesystem backups and CSI snapshot - data movement., Restores can optionally write sparse files for fs-restore - and CSI snapshot data movement to improve performance/space usage in some - cases., "`velero backup describe` output was enhanced with a new \u201C\ - Backup Volumes\u201D section and now shows CSI snapshot data movement details.", - 'Backups now write a new VolumeInfo metadata file in the repository to record - PV/PVC volume backup method, snapshot info, and status; used to drive PV - restore decisions.', Improved resilience of CSI snapshot data movement across - Velero pod/node-agent restarts so operations are less likely to get stuck - after restarts., Backup/restore hook execution details are now tracked in - CR status (HooksAttempted/HooksFailed) and shown in describe output., AWS - SDK for Go was bumped to v2 for better CPU/memory performance., Azure AD/Workload - Identity support was extended to Kopia operations (filesystem backup/data - mover/etc.) in addition to native snapshots., Runtime bumped to Go 1.21.6 - and Kopia bumped to 0.15.0 (plus other dependency bumps for CVEs).] - breaking_changes: ['CLI output change: `velero backup describe` reorganized/changed - formatting; scripts parsing the old output may break.', 'API type change: - `DataUploadSpec.DataMoverConfig` changed from `*map[string]string` to `map[string]string`; - any custom tooling/controllers using this field must be updated.', '`velero - install` now enables informer cache by default (previously disabled); this - can increase Velero pod memory usage and may require raising memory limits - or explicitly disabling via `--disable-informer-cache`.'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Resource Modifiers gained JSON Merge Patch and Strategic Merge Patch support, + enabling more flexible restore-time resource edits from the same ConfigMap + rules. + - Node-agent concurrency controls were added so you can cap/shape how many filesystem + backup and CSI snapshot data-mover operations run per node (globally and per-node). + - Kopia uploader now supports configurable parallel file upload options to speed + up filesystem backups and CSI snapshot data movement. + - Restores can optionally write sparse files for fs-restore and CSI snapshot + data movement to improve performance/space usage in some cases. + - "`velero backup describe` output was enhanced with a new \u201CBackup Volumes\u201D\ + \ section and now shows CSI snapshot data movement details." + - Backups now write a new VolumeInfo metadata file in the repository to record + PV/PVC volume backup method, snapshot info, and status; used to drive PV restore + decisions. + - Improved resilience of CSI snapshot data movement across Velero pod/node-agent + restarts so operations are less likely to get stuck after restarts. + - Backup/restore hook execution details are now tracked in CR status (HooksAttempted/HooksFailed) + and shown in describe output. + - AWS SDK for Go was bumped to v2 for better CPU/memory performance. + - Azure AD/Workload Identity support was extended to Kopia operations (filesystem + backup/data mover/etc.) in addition to native snapshots. + - Runtime bumped to Go 1.21.6 and Kopia bumped to 0.15.0 (plus other dependency + bumps for CVEs). + breaking_changes: + - 'CLI output change: `velero backup describe` reorganized/changed formatting; + scripts parsing the old output may break.' + - 'API type change: `DataUploadSpec.DataMoverConfig` changed from `*map[string]string` + to `map[string]string`; any custom tooling/controllers using this field must + be updated.' + - '`velero install` now enables informer cache by default (previously disabled); + this can increase Velero pod memory usage and may require raising memory limits + or explicitly disabling via `--disable-informer-cache`.' chart_version: 6.7.0 - images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.13.2'] + images: + - docker.io/bitnami/kubectl:1.35 + - velero/velero:v1.13.2 - version: 1.12.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['CSI Snapshot Data Movement: can move CSI snapshot contents out of - the source cluster/storage into durable backup storage and restore later - (including cross-environment/cloud scenarios).', 'Resource Modifiers (JSON - Substitutions): define match filters and JSON patch operations to mutate - resources during restore without writing a custom RestoreItemAction plugin.', - 'Multiple VolumeSnapshotClasses support in the Velero CSI plugin: allows choosing - a specific VolumeSnapshotClass per backup instead of relying on a single - labeled class.', 'Restore finalizer cleanup: `velero restore delete` now - also cleans up restore-associated data in the backup storage location.', - 'Runtime/deps refresh: Golang bumped to 1.20.7 and Kopia bumped to 0.13.x - along with other dependency updates.'] - breaking_changes: ['Default `uploader-type` changes from `restic` to `kopia`, - which can change filesystem-backup behavior and repository expectations - if you relied on restic defaults.', 'CSI snapshot timing/timeout behavior - changed: snapshot handle creation uses `backup.spec.csiSnapshotTimeout` - (was a fixed 10m) and ReadyToUse waiting uses operation timeouts (default - 4h).', Helm chart v4.0.0+ supports multiple BackupStorageLocations (BSL) - and VolumeSnapshotLocations (VSL) and changes their values schema from map - to slice; this is not backward compatible and should be migrated before - upgrading., Finalizers added to Velero CRs (restore/dataupload/datadownload) - can cause `kubectl delete namespace velero` to hang; use `velero uninstall` - or remove/handle finalizers before namespace deletion.] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'CSI Snapshot Data Movement: can move CSI snapshot contents out of the source + cluster/storage into durable backup storage and restore later (including cross-environment/cloud + scenarios).' + - 'Resource Modifiers (JSON Substitutions): define match filters and JSON patch + operations to mutate resources during restore without writing a custom RestoreItemAction + plugin.' + - 'Multiple VolumeSnapshotClasses support in the Velero CSI plugin: allows choosing + a specific VolumeSnapshotClass per backup instead of relying on a single labeled + class.' + - 'Restore finalizer cleanup: `velero restore delete` now also cleans up restore-associated + data in the backup storage location.' + - 'Runtime/deps refresh: Golang bumped to 1.20.7 and Kopia bumped to 0.13.x + along with other dependency updates.' + breaking_changes: + - Default `uploader-type` changes from `restic` to `kopia`, which can change + filesystem-backup behavior and repository expectations if you relied on restic + defaults. + - 'CSI snapshot timing/timeout behavior changed: snapshot handle creation uses + `backup.spec.csiSnapshotTimeout` (was a fixed 10m) and ReadyToUse waiting + uses operation timeouts (default 4h).' + - Helm chart v4.0.0+ supports multiple BackupStorageLocations (BSL) and VolumeSnapshotLocations + (VSL) and changes their values schema from map to slice; this is not backward + compatible and should be migrated before upgrading. + - Finalizers added to Velero CRs (restore/dataupload/datadownload) can cause + `kubectl delete namespace velero` to hang; use `velero uninstall` or remove/handle + finalizers before namespace deletion. chart_version: 5.2.2 - images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.12.3'] + images: + - docker.io/bitnami/kubectl:1.35 + - velero/velero:v1.12.3 - version: 1.11.0 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', - '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null chart_version: 5.0.2 - images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.11.1'] + images: + - docker.io/bitnami/kubectl:1.35 + - velero/velero:v1.11.1 - version: 1.10.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19', '1.18'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null - version: 1.9.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19', '1.18'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null - version: 1.8.0 - kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', - '1.19', '1.18'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' requirements: [] incompatibilities: [] summary: null @@ -23936,87 +32470,146 @@ addons: eolApiSlug: vitess versions: - version: 23.0.0 - kube: ['1.34', '1.33', '1.32', '1.31'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null - version: 22.0.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null - version: 21.0.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null - version: 20.0.0 - kube: ['1.28', '1.27', '1.26', '1.25'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 19.0.0 - kube: ['1.28', '1.27', '1.26', '1.25'] + kube: + - '1.28' + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: null - version: 18.0.0 - kube: ['1.25', '1.24', '1.23', '1.22'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 17.0.0 - kube: ['1.25', '1.24', '1.23', '1.22'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 16.0.0 - kube: ['1.24', '1.23', '1.22'] + kube: + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 15.0.0 - kube: ['1.24', '1.23', '1.22'] + kube: + - '1.24' + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null - version: 14.0.0 - kube: ['1.22', '1.21', '1.20'] + kube: + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: null - version: 13.0.0 - kube: ['1.22', '1.21', '1.20'] + kube: + - '1.22' + - '1.21' + - '1.20' requirements: [] incompatibilities: [] summary: null - version: 12.0.0 - kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' + - '1.18' + - '1.17' requirements: [] incompatibilities: [] summary: null - version: 10.0.0 - kube: ['1.17', '1.16', '1.15'] + kube: + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null - version: 9.0.0 - kube: ['1.17', '1.16', '1.15'] + kube: + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null - version: 8.0.0 - kube: ['1.17', '1.16', '1.15'] + kube: + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null - version: 7.0.0 - kube: ['1.17', '1.16', '1.15'] + kube: + - '1.17' + - '1.16' + - '1.15' requirements: [] incompatibilities: [] summary: null - version: 6.0.0 - kube: ['1.15', '1.14', '1.13'] + kube: + - '1.15' + - '1.14' + - '1.13' requirements: [] incompatibilities: [] summary: null @@ -24029,67 +32622,91 @@ addons: eolApiSlug: gatekeeper versions: - version: 3.23.1 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No new user-facing features in v3.23.1; this is primarily a stabilization - patch focused on ValidatingAdmissionPolicy (VAP) generation/reconciliation - behavior and some dependency/security backports.] + features: + - No new user-facing features in v3.23.1; this is primarily a stabilization + patch focused on ValidatingAdmissionPolicy (VAP) generation/reconciliation + behavior and some dependency/security backports. breaking_changes: [] chart_version: 3.23.1 - images: ['curlimages/curl:8.20.0', 'openpolicyagent/gatekeeper-crds:v3.23.1', - 'openpolicyagent/gatekeeper:v3.23.1'] + images: + - curlimages/curl:8.20.0 + - openpolicyagent/gatekeeper-crds:v3.23.1 + - openpolicyagent/gatekeeper:v3.23.1 - version: 3.23.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Semantic log lines now include a structured marker field to help\ - \ log parsers distinguish \u201Csemantic\u201D entries.", 'Remote cluster - mode now supports status resource routing, improving how status objects - are handled across clusters.', 'Mutation ApplyTo specs support a new `operations` - field so you can scope mutations by admission operation (e.g., CREATE/UPDATE/DELETE).'] + features: + - "Semantic log lines now include a structured marker field to help log parsers\ + \ distinguish \u201Csemantic\u201D entries." + - Remote cluster mode now supports status resource routing, improving how status + objects are handled across clusters. + - Mutation ApplyTo specs support a new `operations` field so you can scope mutations + by admission operation (e.g., CREATE/UPDATE/DELETE). breaking_changes: [] chart_version: 3.23.0 - images: ['curlimages/curl:8.20.0', 'openpolicyagent/gatekeeper-crds:v3.23.0', - 'openpolicyagent/gatekeeper:v3.23.0'] + images: + - curlimages/curl:8.20.0 + - openpolicyagent/gatekeeper-crds:v3.23.0 + - openpolicyagent/gatekeeper:v3.23.0 - version: 3.22.2 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No chart-specific changes are called out in the provided notes\ - \ for v3.22.2; it\u2019s an application-level bugfix release.", "From v3.22.0,\ - \ there were some chart-related items included in the app notes (e.g., metrics\ - \ backend configuration options; missing flags exposed as Helm values; namespace\ - \ exemption label merge). If you\u2019re upgrading from 3.22.0 these are\ - \ already in place, but verify your values file doesn\u2019t need to start\ - \ setting newly-exposed options explicitly."] - features: [v3.22.2 introduces no new Gatekeeper features; it is a patch release., - 'v3.22.0 enabled `sync-vap-enforcement-scope` by default, improving ValidatingAdmissionPolicy - (VAP) enforcement scope sync behavior out of the box.', v3.22.0 added namespace - context to both CEL (`namespaceObject`) and Rego (`input.namespace`) for - namespace-aware decisions in admission and audit., v3.22.0 added `gator - bench` for benchmarking policy performance (latency/throughput/memory) and - `gator policy` for managing policies from gatekeeper-library/bundles., v3.22.0 - added an option to disable the audit `fake-reader` sidecar when using audit - file-based logging and introduced `--enable-remote-cluster` for running - Gatekeeper outside the managed cluster.] - breaking_changes: ['Potential behavior change in v3.22.0: `sync-vap-enforcement-scope` - is now true by default, which can change how VAP resources reflect constraint - enforcement actions without additional configuration. Validate this aligns - with your expectations if you rely on VAP integration.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No chart-specific changes are called out in the provided notes for v3.22.2;\ + \ it\u2019s an application-level bugfix release." + - "From v3.22.0, there were some chart-related items included in the app notes\ + \ (e.g., metrics backend configuration options; missing flags exposed as Helm\ + \ values; namespace exemption label merge). If you\u2019re upgrading from\ + \ 3.22.0 these are already in place, but verify your values file doesn\u2019\ + t need to start setting newly-exposed options explicitly." + features: + - v3.22.2 introduces no new Gatekeeper features; it is a patch release. + - v3.22.0 enabled `sync-vap-enforcement-scope` by default, improving ValidatingAdmissionPolicy + (VAP) enforcement scope sync behavior out of the box. + - v3.22.0 added namespace context to both CEL (`namespaceObject`) and Rego (`input.namespace`) + for namespace-aware decisions in admission and audit. + - v3.22.0 added `gator bench` for benchmarking policy performance (latency/throughput/memory) + and `gator policy` for managing policies from gatekeeper-library/bundles. + - v3.22.0 added an option to disable the audit `fake-reader` sidecar when using + audit file-based logging and introduced `--enable-remote-cluster` for running + Gatekeeper outside the managed cluster. + breaking_changes: + - 'Potential behavior change in v3.22.0: `sync-vap-enforcement-scope` is now + true by default, which can change how VAP resources reflect constraint enforcement + actions without additional configuration. Validate this aligns with your expectations + if you rely on VAP integration.' chart_version: 3.22.2 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.22.2', - 'openpolicyagent/gatekeeper:v3.22.2'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.22.2 + - openpolicyagent/gatekeeper:v3.22.2 - version: 3.22.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: @@ -24109,55 +32726,72 @@ addons: \ exemption labels behavior changed/merged** to align with GKE recommendations\ \ (#4348). If you use namespace exemption labels, validate the resulting selector/labels\ \ after upgrade.\n" - chart_updates: ['Helm chart: metrics backend configuration options were added - (#4282).', 'Helm chart: namespace exemption labels were merged to fix GKE - recommendation (#4348).', 'Helm chart: missing flags were surfaced as Helm - values (#4385).'] - features: ['`sync-vap-enforcement-scope` is enabled by default so VAP resources - reflect constraint enforcement actions without extra configuration.', 'Policies - now get namespace context: CEL can read `namespaceObject` and Rego can read - `input.namespace` for namespace-scoped decisions in admission and audit.', - You can disable the forced `fake-reader` audit sidecar when using audit file-based - logging if you already have your own log collection., 'New `gator bench` - command benchmarks policy performance (latency percentiles, throughput, - memory profiling, concurrency) to catch regressions in CI/CD.', 'New `gator - policy` command manages policies from gatekeeper-library (install/upgrade/uninstall), - supports bundles, enforcement overrides, and dry-run previews.', "Gatekeeper\ - \ can run out-of-cluster with `--enable-remote-cluster`, avoiding crashes\ - \ when the Gatekeeper pod isn\u2019t present in the managed cluster.", 'External - data provider timeouts are enforced on the mutation path (default 5s), reducing - risk of long-running calls exhausting webhook timeouts/resources.'] - breaking_changes: ['Behavior change: `sync-vap-enforcement-scope` now defaults - to true; environments expecting the old default may see different VAP/enforcement - alignment immediately after upgrade.', 'If you depended on the presence/behavior - of the audit `fake-reader` sidecar for file-based logging, the new ability - to disable it may change your pod composition (and any tooling that assumes - that container exists).', Namespace exemption label handling changed to - match GKE recommendations; label-based exemptions may match differently - until validated.] + chart_updates: + - 'Helm chart: metrics backend configuration options were added (#4282).' + - 'Helm chart: namespace exemption labels were merged to fix GKE recommendation + (#4348).' + - 'Helm chart: missing flags were surfaced as Helm values (#4385).' + features: + - '`sync-vap-enforcement-scope` is enabled by default so VAP resources reflect + constraint enforcement actions without extra configuration.' + - 'Policies now get namespace context: CEL can read `namespaceObject` and Rego + can read `input.namespace` for namespace-scoped decisions in admission and + audit.' + - You can disable the forced `fake-reader` audit sidecar when using audit file-based + logging if you already have your own log collection. + - New `gator bench` command benchmarks policy performance (latency percentiles, + throughput, memory profiling, concurrency) to catch regressions in CI/CD. + - New `gator policy` command manages policies from gatekeeper-library (install/upgrade/uninstall), + supports bundles, enforcement overrides, and dry-run previews. + - "Gatekeeper can run out-of-cluster with `--enable-remote-cluster`, avoiding\ + \ crashes when the Gatekeeper pod isn\u2019t present in the managed cluster." + - External data provider timeouts are enforced on the mutation path (default + 5s), reducing risk of long-running calls exhausting webhook timeouts/resources. + breaking_changes: + - 'Behavior change: `sync-vap-enforcement-scope` now defaults to true; environments + expecting the old default may see different VAP/enforcement alignment immediately + after upgrade.' + - If you depended on the presence/behavior of the audit `fake-reader` sidecar + for file-based logging, the new ability to disable it may change your pod + composition (and any tooling that assumes that container exists). + - Namespace exemption label handling changed to match GKE recommendations; label-based + exemptions may match differently until validated. chart_version: 3.22.0 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.22.0', - 'openpolicyagent/gatekeeper:v3.22.0'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.22.0 + - openpolicyagent/gatekeeper:v3.22.0 - version: 3.21.1 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Adds a timeout enforcement for External Data provider requests - (bug fix)., "Dependency/security bumps: containerd 1.7.28\u21921.7.29, golang.org/x/crypto\ - \ 0.43.0\u21920.45.0, kubectl bumped to resolve a CVE, and Go toolchain\ - \ bump (commit 7534a62\u219204741b0)."] - features: [No new user-facing features in 3.21.1; it is primarily a bugfix and - dependency/security update release.] - breaking_changes: [No breaking changes called out in the 3.21.1 application - release notes compared to 3.21.0.] + chart_updates: + - Adds a timeout enforcement for External Data provider requests (bug fix). + - "Dependency/security bumps: containerd 1.7.28\u21921.7.29, golang.org/x/crypto\ + \ 0.43.0\u21920.45.0, kubectl bumped to resolve a CVE, and Go toolchain bump\ + \ (commit 7534a62\u219204741b0)." + features: + - No new user-facing features in 3.21.1; it is primarily a bugfix and dependency/security + update release. + breaking_changes: + - No breaking changes called out in the 3.21.1 application release notes compared + to 3.21.0. chart_version: 3.21.1 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.21.1', - 'openpolicyagent/gatekeeper:v3.21.1'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.21.1 + - openpolicyagent/gatekeeper:v3.21.1 eolAt: '2026-07-09' - version: 3.21.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -24177,49 +32811,66 @@ addons: \ notable change): optional in 3.21.0 but will **default to true in v3.22**\ \ and later be removed. Decide now whether to enable it in 3.21.0 to match\ \ future behavior and avoid a surprise scope change.\n" - chart_updates: [PodSecurityPolicy manifests were removed from the Helm chart - (PSP is deprecated/removed upstream)., 'Chart adds configuration hooks for - automounting SA tokens, deployment annotations, and injecting extra volumes/volumeMounts.', - Chart adds `extraEnvs` support for injecting environment variables into Gatekeeper - components., Chart includes changes to support dual-stack webhook Service - behavior in clusters using dual-stack networking.] - features: ["`--sync-vap-enforcement-scope` flag introduced to align ValidatingAdmissionPolicy\ - \ (VAP) enforcement scope with Gatekeeper\u2019s webhook/config/namespace\ - \ exemptions for consistent enforcement.", 'ConstraintTemplates can now - specify which operations (CREATE/UPDATE/DELETE) they apply to, enabling - operation-level enforcement granularity.', External Data / Provider API - gains new metrics and status reporting for improved observability., Webhook - Service adds dual-stack support for IPv4/IPv6 clusters., 'Helm chart supports - configurable automountServiceAccountToken, deployment annotations, extra - volumes/volumeMounts, and `extraEnvs` injection.'] - breaking_changes: [Helm chart removes PodSecurityPolicy resources; clusters - or installs depending on PSP must transition to Pod Security Admission or - alternative controls., 'VAP behavior is trending toward a breaking change - in v3.22+: if you currently set `--sync-vap-enforcement-scope=false`, future - versions will change how Gatekeeper generates/scopes VAP resources (flag - will default true then be removed).'] + chart_updates: + - PodSecurityPolicy manifests were removed from the Helm chart (PSP is deprecated/removed + upstream). + - Chart adds configuration hooks for automounting SA tokens, deployment annotations, + and injecting extra volumes/volumeMounts. + - Chart adds `extraEnvs` support for injecting environment variables into Gatekeeper + components. + - Chart includes changes to support dual-stack webhook Service behavior in clusters + using dual-stack networking. + features: + - "`--sync-vap-enforcement-scope` flag introduced to align ValidatingAdmissionPolicy\ + \ (VAP) enforcement scope with Gatekeeper\u2019s webhook/config/namespace\ + \ exemptions for consistent enforcement." + - ConstraintTemplates can now specify which operations (CREATE/UPDATE/DELETE) + they apply to, enabling operation-level enforcement granularity. + - External Data / Provider API gains new metrics and status reporting for improved + observability. + - Webhook Service adds dual-stack support for IPv4/IPv6 clusters. + - Helm chart supports configurable automountServiceAccountToken, deployment + annotations, extra volumes/volumeMounts, and `extraEnvs` injection. + breaking_changes: + - Helm chart removes PodSecurityPolicy resources; clusters or installs depending + on PSP must transition to Pod Security Admission or alternative controls. + - 'VAP behavior is trending toward a breaking change in v3.22+: if you currently + set `--sync-vap-enforcement-scope=false`, future versions will change how + Gatekeeper generates/scopes VAP resources (flag will default true then be + removed).' chart_version: 3.21.0 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.21.0', - 'openpolicyagent/gatekeeper:v3.21.0'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.21.0 + - openpolicyagent/gatekeeper:v3.21.0 eolAt: '2026-07-09' - version: 3.20.1 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Patch/minor app release update from Gatekeeper v3.20.0 to v3.20.1; - no functional chart behavior changes called out in the provided notes., - 'Component/toolchain refresh: kubectl and Go versions bumped via cherry-picks; - internal frameworks dependency bumped to v0.18.1.'] + chart_updates: + - Patch/minor app release update from Gatekeeper v3.20.0 to v3.20.1; no functional + chart behavior changes called out in the provided notes. + - 'Component/toolchain refresh: kubectl and Go versions bumped via cherry-picks; + internal frameworks dependency bumped to v0.18.1.' features: [] breaking_changes: [] chart_version: 3.20.1 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.20.1', - 'openpolicyagent/gatekeeper:v3.20.1'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.20.1 + - openpolicyagent/gatekeeper:v3.20.1 eolAt: '2026-03-09' - version: 3.20.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -24247,29 +32898,38 @@ addons: \ VAP resource generation, you\u2019ll likely need to set the relevant flags/values\ \ to disable it (and validate your operations include `generate` only where\ \ desired).\n" - chart_updates: [Introduces/uses a new `Connection` CRD to configure connections - to violation export backends (replacing a ConfigMap-based approach)., Webhook - rules updated to include the `pods/resize` subresource; Helm templating - gained a knob/variable to manage mutating subresources., Webhook startup - behavior changed by removing the webhook readinessProbe at pod start (affects - rendered Deployment/Pod spec).] - features: [New driver to export violations to disk (useful for local retention - or sidecar pickup)., VAP (Validating Admission Policy) integration is now - beta and enabled by default; Gatekeeper can generate VAP/VAPB resources - for CEL-based native validation., Export connections are now modeled via - a `Connection` custom resource instead of a ConfigMap.] - breaking_changes: ['If you previously configured export connections via a ConfigMap, - you must migrate to the new `Connection` CRD or exports may stop working.', - "Because VAP generation is enabled by default in v3.20.0, new VAP/VAPB resources\ - \ may be created automatically (and require appropriate RBAC/operations\ - \ configuration), which can change admission behavior if you weren\u2019\ - t previously using VAP."] + chart_updates: + - Introduces/uses a new `Connection` CRD to configure connections to violation + export backends (replacing a ConfigMap-based approach). + - Webhook rules updated to include the `pods/resize` subresource; Helm templating + gained a knob/variable to manage mutating subresources. + - Webhook startup behavior changed by removing the webhook readinessProbe at + pod start (affects rendered Deployment/Pod spec). + features: + - New driver to export violations to disk (useful for local retention or sidecar + pickup). + - VAP (Validating Admission Policy) integration is now beta and enabled by default; + Gatekeeper can generate VAP/VAPB resources for CEL-based native validation. + - Export connections are now modeled via a `Connection` custom resource instead + of a ConfigMap. + breaking_changes: + - If you previously configured export connections via a ConfigMap, you must + migrate to the new `Connection` CRD or exports may stop working. + - "Because VAP generation is enabled by default in v3.20.0, new VAP/VAPB resources\ + \ may be created automatically (and require appropriate RBAC/operations configuration),\ + \ which can change admission behavior if you weren\u2019t previously using\ + \ VAP." chart_version: 3.20.0 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.20.0', - 'openpolicyagent/gatekeeper:v3.20.0'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.20.0 + - openpolicyagent/gatekeeper:v3.20.0 eolAt: '2026-03-09' - version: 3.19.1 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -24283,50 +32943,65 @@ addons: \ constraints** (introduced in v3.19.0). If you rely on referential constraints,\ \ confirm the default behavior in your current values/manifests and set the\ \ flag explicitly if needed." - chart_updates: [v3.19.1 is a patch release with no user-facing feature additions; - it primarily contains a bug fix related to deleting Gatekeeper resources - when the delete operation is enabled., 'CI/test updates only: v3.19.1 bumps - Kubernetes versions used in testing/CRD Dockerfile; no direct runtime impact - expected.'] - features: [(v3.19.0) Gatekeeper ConstraintTemplates can use OPA **Rego v1** - syntax via the updated Rego driver., '(v3.19.0) Pub/Sub was generalized - into an **export mechanism**, enabling additional violation export backends - (e.g., disk).', (v3.19.0) `gator test` gained a `--deny-only` flag to focus - on deny results.] - breaking_changes: ['(v3.19.0) **Breaking/behavioral change:** `--operation=generate` - is now required for CRD and VAP/VAPB generation. Missing this flag can prevent - expected generation behavior and may impact upgrades/installations that - depended on implicit generation.'] + chart_updates: + - v3.19.1 is a patch release with no user-facing feature additions; it primarily + contains a bug fix related to deleting Gatekeeper resources when the delete + operation is enabled. + - 'CI/test updates only: v3.19.1 bumps Kubernetes versions used in testing/CRD + Dockerfile; no direct runtime impact expected.' + features: + - (v3.19.0) Gatekeeper ConstraintTemplates can use OPA **Rego v1** syntax via + the updated Rego driver. + - (v3.19.0) Pub/Sub was generalized into an **export mechanism**, enabling additional + violation export backends (e.g., disk). + - (v3.19.0) `gator test` gained a `--deny-only` flag to focus on deny results. + breaking_changes: + - (v3.19.0) **Breaking/behavioral change:** `--operation=generate` is now required + for CRD and VAP/VAPB generation. Missing this flag can prevent expected generation + behavior and may impact upgrades/installations that depended on implicit generation. chart_version: 3.19.1 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.19.1', - 'openpolicyagent/gatekeeper:v3.19.1'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.19.1 + - openpolicyagent/gatekeeper:v3.19.1 eolAt: '2025-11-19' - version: 3.19.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [No Helm chart-specific changelog was provided in the notes; - treat this as an application upgrade summary only., v3.19.0 adds/adjusts - operational flags and mechanisms (notably generation operations and export - mechanism changes) that may require deployment arg updates in your Helm - values if you set extraArgs/extraContainers.] - features: [OPA Rego v1 syntax support is now available for ConstraintTemplates - (via updated Rego driver)., 'Pub/Sub violation distribution has been generalized - into an export mechanism to enable additional backends (e.g., disk) for - exporting violations.', '`gator test` gained a `--deny-only` flag to focus - tests on deny outcomes.'] - breaking_changes: ["`--operation=generate` is now required to guard CRD and\ - \ VAP/VAPB generation; ensure your singleton deployment (commonly gatekeeper-audit)\ - \ includes `--operation=generate`, and if you don\u2019t run audit you must\ - \ add it to the controller-manager deployment."] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart-specific changelog was provided in the notes; treat this as + an application upgrade summary only. + - v3.19.0 adds/adjusts operational flags and mechanisms (notably generation + operations and export mechanism changes) that may require deployment arg updates + in your Helm values if you set extraArgs/extraContainers. + features: + - OPA Rego v1 syntax support is now available for ConstraintTemplates (via updated + Rego driver). + - Pub/Sub violation distribution has been generalized into an export mechanism + to enable additional backends (e.g., disk) for exporting violations. + - '`gator test` gained a `--deny-only` flag to focus tests on deny outcomes.' + breaking_changes: + - "`--operation=generate` is now required to guard CRD and VAP/VAPB generation;\ + \ ensure your singleton deployment (commonly gatekeeper-audit) includes `--operation=generate`,\ + \ and if you don\u2019t run audit you must add it to the controller-manager\ + \ deployment." chart_version: 3.19.0 - images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.19.0', - 'openpolicyagent/gatekeeper:v3.19.0'] + images: + - curlimages/curl:8.12.0 + - openpolicyagent/gatekeeper-crds:v3.19.0 + - openpolicyagent/gatekeeper:v3.19.0 eolAt: '2025-11-19' - version: 3.18.3 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -24339,26 +33014,34 @@ addons: \ (VAP/VAPB) generation**.\n- **Values that exist since 3.18.0:** Helm chart\ \ supports `logStatsAdmission` and `logStatsAudit` values (new in 3.18.0).\ \ No additional values changes were called out in the 3.18.3 notes you provided." - chart_updates: ['3.18.0 chart: added Helm values for `logStatsAdmission` and - `logStatsAudit`.', '3.18.x: no chart template changes were explicitly listed - in the 3.18.3 snippet beyond cherry-picked bugfixes; treat as patch-level - maintenance update.'] - features: [(3.18.0) CEL-based policies enforced through Gatekeeper (ValidatingAdmissionPolicy - support) reached GA., (3.18.0) Added support for `generate` operation and - waiting for VAPB generation (generation controller behavior)., (3.18.0) - Added config pod status reporting (observability/status improvements)., - (3.18.0) Helm chart gained `logStatsAdmission` / `logStatsAudit` toggles for - stats logging.] - breaking_changes: ['`--operation=generate` is now required on a singleton deployment - to handle CRD and VAP/VAPB generation; without it, generated artifacts may - not be created/guarded as expected. This impacts deployments that previously - relied on default operations behavior.'] + chart_updates: + - '3.18.0 chart: added Helm values for `logStatsAdmission` and `logStatsAudit`.' + - '3.18.x: no chart template changes were explicitly listed in the 3.18.3 snippet + beyond cherry-picked bugfixes; treat as patch-level maintenance update.' + features: + - (3.18.0) CEL-based policies enforced through Gatekeeper (ValidatingAdmissionPolicy + support) reached GA. + - (3.18.0) Added support for `generate` operation and waiting for VAPB generation + (generation controller behavior). + - (3.18.0) Added config pod status reporting (observability/status improvements). + - (3.18.0) Helm chart gained `logStatsAdmission` / `logStatsAudit` toggles for + stats logging. + breaking_changes: + - '`--operation=generate` is now required on a singleton deployment to handle + CRD and VAP/VAPB generation; without it, generated artifacts may not be created/guarded + as expected. This impacts deployments that previously relied on default operations + behavior.' chart_version: 3.18.3 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.18.3', - 'openpolicyagent/gatekeeper:v3.18.3'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.18.3 + - openpolicyagent/gatekeeper:v3.18.3 eolAt: '2025-07-24' - version: 3.18.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -24378,77 +33061,97 @@ addons: \ alpha flags unless explicitly set through Helm\u201D. If you previously\ \ relied on alpha feature gates being enabled implicitly, you may need to\ \ set the corresponding Helm flags explicitly." - chart_updates: [CEL-based policies (Kubernetes native validation / VAP integration) - moved from **beta** to **GA** in 3.18.0., 'A new operations model requirement - was introduced: generation (CRDs, VAP/VAPB) is now gated behind the explicit - `generate` operation.', 'Helm chart gained new knobs for stats logging (`logStatsAdmission`, - `logStatsAudit`) and added `commonLabels` support on Deployments.', 'Several - chart/manifest quality fixes: PDB lint fix; NetworkPolicy ingress rule Helm - warning fix.', Internal refactors around CEL driver/framework extraction; - OPA bumped to 0.68.0; CI now pushes images to ghcr.io as well.] - features: ['CEL-based policy enforcement via ValidatingAdmissionPolicy (VAP) - is now GA, making the Kubernetes-native validation path a first-class, production-ready - option.', 'Gatekeeper now supports an explicit `generate` operation and - can wait for ValidatingAdmissionPolicyBinding (VAPB) generation, improving - determinism around generated resources.', 'Helm chart adds `logStatsAdmission` - and `logStatsAudit` to control stats logging in admission/audit components, - and adds `commonLabels` for consistent labeling across Deployments.', Gator - gains additional capabilities (sync test support and expansion in `gator - verify`) useful for policy testing workflows.] - breaking_changes: ['**Generation is now opt-in via operations**: you must enable - `--operation=generate` on whichever Gatekeeper deployment is responsible - for generating CRDs and VAP/VAPB resources, or generation will not occur.', - "If you were using Gatekeeper\u2019s VAP generation via annotations (older\ - \ behavior highlighted in 3.17.0 notes), you must migrate to the `generateVAP`\ - \ fields in ConstraintTemplates/Constraints; annotations are no longer the\ - \ mechanism."] + chart_updates: + - CEL-based policies (Kubernetes native validation / VAP integration) moved + from **beta** to **GA** in 3.18.0. + - 'A new operations model requirement was introduced: generation (CRDs, VAP/VAPB) + is now gated behind the explicit `generate` operation.' + - Helm chart gained new knobs for stats logging (`logStatsAdmission`, `logStatsAudit`) + and added `commonLabels` support on Deployments. + - 'Several chart/manifest quality fixes: PDB lint fix; NetworkPolicy ingress + rule Helm warning fix.' + - Internal refactors around CEL driver/framework extraction; OPA bumped to 0.68.0; + CI now pushes images to ghcr.io as well. + features: + - CEL-based policy enforcement via ValidatingAdmissionPolicy (VAP) is now GA, + making the Kubernetes-native validation path a first-class, production-ready + option. + - Gatekeeper now supports an explicit `generate` operation and can wait for + ValidatingAdmissionPolicyBinding (VAPB) generation, improving determinism + around generated resources. + - Helm chart adds `logStatsAdmission` and `logStatsAudit` to control stats logging + in admission/audit components, and adds `commonLabels` for consistent labeling + across Deployments. + - Gator gains additional capabilities (sync test support and expansion in `gator + verify`) useful for policy testing workflows. + breaking_changes: + - '**Generation is now opt-in via operations**: you must enable `--operation=generate` + on whichever Gatekeeper deployment is responsible for generating CRDs and + VAP/VAPB resources, or generation will not occur.' + - "If you were using Gatekeeper\u2019s VAP generation via annotations (older\ + \ behavior highlighted in 3.17.0 notes), you must migrate to the `generateVAP`\ + \ fields in ConstraintTemplates/Constraints; annotations are no longer the\ + \ mechanism." chart_version: 3.18.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.18.0', - 'openpolicyagent/gatekeeper:v3.18.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.18.0 + - openpolicyagent/gatekeeper:v3.18.0 eolAt: '2025-07-24' - version: 3.17.2 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Gatekeeper 3.17 introduces/solidifies Kubernetes-native validation - (CEL/VAP) support and related manifest/chart wiring: CEL-based policies - via ValidatingAdmissionPolicy are beta; VAP/VAPBinding generation moved - from annotations to explicit fields in ConstraintTemplate/Constraint; and - constraint enforcement can now be scoped per enforcement point via `spec.scopedEnforcementActions`.', - Helm chart gains knobs to make the ServiceAccount name configurable and optionally - disable SA creation (useful when binding to pre-created RBAC/IRSA/GSA)., - 'Helm chart adds optional RollingUpdate strategy parameters for the controller-manager/audit - deployments, enabling finer control of maxUnavailable/maxSurge during upgrades.', - 'Controller-manager and audit deployments can now receive separate podLabels, - improving labeling/selection and observability alignment.', 'Various CEL/VAP - wiring fixes: include CEL flags on audit deployment; only set webhook matchConditions - when non-empty; updated VAP/VAPBinding API generation behavior (0.30 API; - create v1 or v1beta1 VAP/VAPB) and avoid setting alpha flags unless explicitly - enabled via Helm.', '3.17.2 is a patch release with a key bugfix: fixes - a nil-pointer when converting VAPBinding from v1beta1 to v1, plus security/library - updates (crypto/net).'] - features: ["CEL-based policies enforced via Gatekeeper\u2019s ValidatingAdmissionPolicy\ - \ integration (beta in 3.17.0).", 'Constraints can now specify different - enforcement actions per enforcement point (webhook, audit, gator, VAP) using - `spec.scopedEnforcementActions`.', Support for Kubernetes CONNECT operations - in request matching., 'More flexible Helm operations: configurable ServiceAccount - (and ability to opt out of creating it), plus optional RollingUpdate strategy - tuning, and separate podLabels for controller-manager vs audit.'] - breaking_changes: ['If you previously generated VAP/VAPBinding via annotations, - 3.17.0 changes this to use explicit fields in ConstraintTemplate and Constraint; - you must update those resources or VAP generation may stop working/behave - differently.', 'VAP/VAPBinding generation behavior and API versions are - more strict/explicit in 3.17.x (v1 vs v1beta1 selection and alpha flags - only when configured), so clusters/templates relying on prior implicit defaults - may need review.'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Gatekeeper 3.17 introduces/solidifies Kubernetes-native validation (CEL/VAP) + support and related manifest/chart wiring: CEL-based policies via ValidatingAdmissionPolicy + are beta; VAP/VAPBinding generation moved from annotations to explicit fields + in ConstraintTemplate/Constraint; and constraint enforcement can now be scoped + per enforcement point via `spec.scopedEnforcementActions`.' + - Helm chart gains knobs to make the ServiceAccount name configurable and optionally + disable SA creation (useful when binding to pre-created RBAC/IRSA/GSA). + - Helm chart adds optional RollingUpdate strategy parameters for the controller-manager/audit + deployments, enabling finer control of maxUnavailable/maxSurge during upgrades. + - Controller-manager and audit deployments can now receive separate podLabels, + improving labeling/selection and observability alignment. + - 'Various CEL/VAP wiring fixes: include CEL flags on audit deployment; only + set webhook matchConditions when non-empty; updated VAP/VAPBinding API generation + behavior (0.30 API; create v1 or v1beta1 VAP/VAPB) and avoid setting alpha + flags unless explicitly enabled via Helm.' + - '3.17.2 is a patch release with a key bugfix: fixes a nil-pointer when converting + VAPBinding from v1beta1 to v1, plus security/library updates (crypto/net).' + features: + - "CEL-based policies enforced via Gatekeeper\u2019s ValidatingAdmissionPolicy\ + \ integration (beta in 3.17.0)." + - Constraints can now specify different enforcement actions per enforcement + point (webhook, audit, gator, VAP) using `spec.scopedEnforcementActions`. + - Support for Kubernetes CONNECT operations in request matching. + - 'More flexible Helm operations: configurable ServiceAccount (and ability to + opt out of creating it), plus optional RollingUpdate strategy tuning, and + separate podLabels for controller-manager vs audit.' + breaking_changes: + - If you previously generated VAP/VAPBinding via annotations, 3.17.0 changes + this to use explicit fields in ConstraintTemplate and Constraint; you must + update those resources or VAP generation may stop working/behave differently. + - VAP/VAPBinding generation behavior and API versions are more strict/explicit + in 3.17.x (v1 vs v1beta1 selection and alpha flags only when configured), + so clusters/templates relying on prior implicit defaults may need review. chart_version: 3.17.2 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.17.2', - 'openpolicyagent/gatekeeper:v3.17.2'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.17.2 + - openpolicyagent/gatekeeper:v3.17.2 eolAt: '2025-04-09' - version: 3.17.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -24471,31 +33174,40 @@ addons: \ relied on Helm enabling those feature gates implicitly, you may now need\ \ to set them explicitly (or ensure your cluster supports the beta/stable\ \ API you want).\n" - chart_updates: [Expose configurable ServiceAccount name + allow disabling SA - creation., Add optional `rollingUpdate` strategy parameters to the Helm - chart., Split pod label configuration between controller-manager and audit - Deployments., Stop enabling alpha VAP/VAPB feature-gates implicitly unless - explicitly set via Helm., 'Update generated manifests to include YAML document - separators (affects rendered output, not behavior).'] - features: [CEL-based policies enforced through Gatekeeper (via Kubernetes ValidatingAdmissionPolicy - integration) are **beta** in 3.17; Gatekeeper can generate/enforce CEL/VAP - resources., 'New `scopedEnforcementActions` lets you enforce different actions - per enforcement point (webhook, audit, gator, VAP) within the same Constraint.', - Support for Kubernetes `CONNECT` operations was added to admission handling., - 'Improved control over VAP generation intent: Gatekeeper checks template intent - before generating VAPBindings.'] - breaking_changes: ["If you used VAP generation via **annotations**, those are\ - \ no longer the mechanism in 3.17\u2014policy manifests must be updated\ - \ to the new fields-based configuration.", 'If you depended on Helm implicitly - setting **alpha** feature flags for VAP/VAPB generation, that default behavior - is removed; you may need to explicitly configure feature gates or rely on - the appropriate Kubernetes API version support.'] + chart_updates: + - Expose configurable ServiceAccount name + allow disabling SA creation. + - Add optional `rollingUpdate` strategy parameters to the Helm chart. + - Split pod label configuration between controller-manager and audit Deployments. + - Stop enabling alpha VAP/VAPB feature-gates implicitly unless explicitly set + via Helm. + - Update generated manifests to include YAML document separators (affects rendered + output, not behavior). + features: + - CEL-based policies enforced through Gatekeeper (via Kubernetes ValidatingAdmissionPolicy + integration) are **beta** in 3.17; Gatekeeper can generate/enforce CEL/VAP + resources. + - New `scopedEnforcementActions` lets you enforce different actions per enforcement + point (webhook, audit, gator, VAP) within the same Constraint. + - Support for Kubernetes `CONNECT` operations was added to admission handling. + - 'Improved control over VAP generation intent: Gatekeeper checks template intent + before generating VAPBindings.' + breaking_changes: + - "If you used VAP generation via **annotations**, those are no longer the mechanism\ + \ in 3.17\u2014policy manifests must be updated to the new fields-based configuration." + - If you depended on Helm implicitly setting **alpha** feature flags for VAP/VAPB + generation, that default behavior is removed; you may need to explicitly configure + feature gates or rely on the appropriate Kubernetes API version support. chart_version: 3.17.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.17.0', - 'openpolicyagent/gatekeeper:v3.17.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.17.0 + - openpolicyagent/gatekeeper:v3.17.0 eolAt: '2025-04-09' - version: 3.16.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -24525,25 +33237,34 @@ addons: moving to/adding `matchConditions` improves correctness or performance. ' - chart_updates: ['Helm: added `disableAudit` option to disable the audit deployment/job/component.', - 'Helm: added ability to enable/configure VAP integration (alpha).', 'Helm: - added `matchConditions` support in ValidatingWebhookConfiguration and MutatingWebhookConfiguration - manifests.'] - features: ['Alpha: integration with Kubernetes Validating Admission Policy (VAP), - including support for generating VAP artifacts and enabling it via Helm.', - 'Operational flexibility: ability to disable Gatekeeper audit via a Helm option - (`disableAudit`).', 'Webhook configurability: support for Kubernetes webhook - `matchConditions` to refine when Gatekeeper webhooks trigger.'] - breaking_changes: ['`validate-template-rego` flag has been removed; Gatekeeper - will no longer validate ConstraintTemplate Rego via that flag. Use Gator - for shift-left template validation to avoid unexpected failures/behavior - changes in CI/CD or admission workflows.'] + chart_updates: + - 'Helm: added `disableAudit` option to disable the audit deployment/job/component.' + - 'Helm: added ability to enable/configure VAP integration (alpha).' + - 'Helm: added `matchConditions` support in ValidatingWebhookConfiguration and + MutatingWebhookConfiguration manifests.' + features: + - 'Alpha: integration with Kubernetes Validating Admission Policy (VAP), including + support for generating VAP artifacts and enabling it via Helm.' + - 'Operational flexibility: ability to disable Gatekeeper audit via a Helm option + (`disableAudit`).' + - 'Webhook configurability: support for Kubernetes webhook `matchConditions` + to refine when Gatekeeper webhooks trigger.' + breaking_changes: + - '`validate-template-rego` flag has been removed; Gatekeeper will no longer + validate ConstraintTemplate Rego via that flag. Use Gator for shift-left template + validation to avoid unexpected failures/behavior changes in CI/CD or admission + workflows.' chart_version: 3.16.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.16.0', - 'openpolicyagent/gatekeeper:v3.16.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.16.0 + - openpolicyagent/gatekeeper:v3.16.0 eolAt: '2024-12-12' - version: 3.15.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -24558,48 +33279,64 @@ addons: \ explicit Helm values changes were called out in the provided notes for v3.15.0.\ \ (Some Helm-related exposure was in v3.14.0, e.g. external data provider\ \ cache TTL, but that\u2019s already in your current version.)" - chart_updates: [Adds/introduces **SyncSets** support (alpha) including a new - SyncSet controller and readiness tracking (`#3030`)., 'Switches telemetry/instrumentation - plumbing: **moving to OpenTelemetry from OpenCensus** (`#3011`). This may - impact how metrics/traces are emitted/collected depending on your setup.', - 'CI/build change: **drops arm/v7 builds for the CRD image** (`#3074`), which - can affect users running Gatekeeper components on 32-bit ARM nodes.', 'Validation - hardening: Gatekeeper now **only validates Gatekeeper resources**, adds - support for validating DELETE config operations, and adds name length checks/limits - for certain resources (e.g., ExpansionTemplate names <64).'] - features: ['**SyncSets (alpha)**: New mechanism to replicate/sync data into - Gatekeeper via SyncSets, plus readiness reporting so you can tell when required - data has been replicated.', '**Improved resource validation behaviors**: - Additional validation around Gatekeeper resources and operations (including - DELETE validation and stricter naming constraints) to prevent invalid configs - from being accepted.'] - breaking_changes: ['**PodSecurityPolicy default behavior changed**: PSP is disabled - by default in v3.15.0; clusters relying on Gatekeeper-created PSP objects - will need to adjust installation/values or move to PSA.', "**arm/v7 CRD\ - \ image no longer built**: If you deploy the CRD image on 32-bit ARM (arm/v7),\ - \ you\u2019ll need an alternative architecture or image strategy after upgrading."] + chart_updates: + - Adds/introduces **SyncSets** support (alpha) including a new SyncSet controller + and readiness tracking (`#3030`). + - 'Switches telemetry/instrumentation plumbing: **moving to OpenTelemetry from + OpenCensus** (`#3011`). This may impact how metrics/traces are emitted/collected + depending on your setup.' + - 'CI/build change: **drops arm/v7 builds for the CRD image** (`#3074`), which + can affect users running Gatekeeper components on 32-bit ARM nodes.' + - 'Validation hardening: Gatekeeper now **only validates Gatekeeper resources**, + adds support for validating DELETE config operations, and adds name length + checks/limits for certain resources (e.g., ExpansionTemplate names <64).' + features: + - '**SyncSets (alpha)**: New mechanism to replicate/sync data into Gatekeeper + via SyncSets, plus readiness reporting so you can tell when required data + has been replicated.' + - '**Improved resource validation behaviors**: Additional validation around + Gatekeeper resources and operations (including DELETE validation and stricter + naming constraints) to prevent invalid configs from being accepted.' + breaking_changes: + - '**PodSecurityPolicy default behavior changed**: PSP is disabled by default + in v3.15.0; clusters relying on Gatekeeper-created PSP objects will need to + adjust installation/values or move to PSA.' + - "**arm/v7 CRD image no longer built**: If you deploy the CRD image on 32-bit\ + \ ARM (arm/v7), you\u2019ll need an alternative architecture or image strategy\ + \ after upgrading." chart_version: 3.15.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.15.0', - 'openpolicyagent/gatekeeper:v3.15.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.15.0 + - openpolicyagent/gatekeeper:v3.15.0 eolAt: '2024-08-21' - version: 3.14.2 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['v3.14.1: Audit and controller-manager pods gained updated labels, - which may affect label selectors used by monitoring/NetworkPolicies.', 'v3.14.2: - No new functional features; this patch release is primarily security dependency - updates addressing multiple CVEs/advisories.'] + features: + - 'v3.14.1: Audit and controller-manager pods gained updated labels, which may + affect label selectors used by monitoring/NetworkPolicies.' + - 'v3.14.2: No new functional features; this patch release is primarily security + dependency updates addressing multiple CVEs/advisories.' breaking_changes: [] chart_version: 3.14.2 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.2', - 'openpolicyagent/gatekeeper:v3.14.2'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.14.2 + - openpolicyagent/gatekeeper:v3.14.2 eolAt: '2024-05-09' - version: 3.14.1 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -24628,28 +33365,38 @@ addons: - **Audit cert rotation enabled by default** in `v3.14.0` (PR #2875). If your environment has strict cert/secret management expectations, confirm the generated/rotated cert behavior is acceptable.' - chart_updates: ['`v3.14.1` is a patch release with a small surface area: adds - pod labels and includes a panic-logging fix.', '`v3.14.0` contains the bulk - of chart/app changes for this upgrade path, including label standardization - and new/changed flags exposed via Helm.', 'Default behaviors to note from - `v3.14.0`: audit cert rotation enabled by default; external data provider - caching behavior clarified/fixed.'] - features: [(v3.14.1) Audit and controller-manager pods updated to include additional - pod labels; mainly affects observability/selection/label-based policies., - (v3.14.0) Improved experimental Validating Admission Policy (VAP) support - and updated bundled OPA to v0.57.1., (v3.14.0) Support multiple sync sources - and enhancements to replay/testing output., (v3.14.0) External data provider - response cache TTL configurable; TTL=0 disables caching.] - breaking_changes: ['No explicit breaking changes are called out in the provided - notes for v3.14.0 or v3.14.1. However, label changes (recommended labels - + new pod labels) can be *operationally breaking* if you rely on exact label - matches/selectors in policies, monitoring, or automation.'] + chart_updates: + - '`v3.14.1` is a patch release with a small surface area: adds pod labels and + includes a panic-logging fix.' + - '`v3.14.0` contains the bulk of chart/app changes for this upgrade path, including + label standardization and new/changed flags exposed via Helm.' + - 'Default behaviors to note from `v3.14.0`: audit cert rotation enabled by + default; external data provider caching behavior clarified/fixed.' + features: + - (v3.14.1) Audit and controller-manager pods updated to include additional + pod labels; mainly affects observability/selection/label-based policies. + - (v3.14.0) Improved experimental Validating Admission Policy (VAP) support + and updated bundled OPA to v0.57.1. + - (v3.14.0) Support multiple sync sources and enhancements to replay/testing + output. + - (v3.14.0) External data provider response cache TTL configurable; TTL=0 disables + caching. + breaking_changes: + - No explicit breaking changes are called out in the provided notes for v3.14.0 + or v3.14.1. However, label changes (recommended labels + new pod labels) can + be *operationally breaking* if you rely on exact label matches/selectors in + policies, monitoring, or automation. chart_version: 3.14.1 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.1', - 'openpolicyagent/gatekeeper:v3.14.1'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.14.1 + - openpolicyagent/gatekeeper:v3.14.1 eolAt: '2024-05-09' - version: 3.14.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -24666,28 +33413,38 @@ addons: \ Helm values. Also note behavior: **TTL=0 disables the cache**.\n\nNo explicit\ \ breaking Helm values removals/renames were present in the provided notes;\ \ treat the above as additive changes and validate with `helm diff`." - chart_updates: [Updated OPA dependency to **v0.57.1**., Improved experimental - **Validating Admission Policy (VAP)** support (CEL-based / native validation - demo and driver improvements)., Constraint framework upgraded to include - a new **Kubernetes Native Validation** driver schema., Support for **multiple - sync sources** (sync subsystem enhancements)., Audit certificate rotation - enabled by default (bug fix) and other chart/controller flag fixes around - webhook name flags.] - features: ['Adds recommended Helm/Kubernetes application labels to resources, - improving consistency with common tooling and dashboards.', Allows configuring - the controller-manager Deployment `revisionHistoryLimit` through Helm values., - 'Adds support for multiple sync sources, improving how Gatekeeper syncs external - or cluster objects into OPA.', Upgrades the constraint framework with a - new Kubernetes Native Validation driver schema (relevant to VAP/CEL workflows)., - Exposes external data provider response cache TTL via Helm; TTL can be tuned - or set to 0 to disable caching.] + chart_updates: + - Updated OPA dependency to **v0.57.1**. + - Improved experimental **Validating Admission Policy (VAP)** support (CEL-based + / native validation demo and driver improvements). + - Constraint framework upgraded to include a new **Kubernetes Native Validation** + driver schema. + - Support for **multiple sync sources** (sync subsystem enhancements). + - Audit certificate rotation enabled by default (bug fix) and other chart/controller + flag fixes around webhook name flags. + features: + - Adds recommended Helm/Kubernetes application labels to resources, improving + consistency with common tooling and dashboards. + - Allows configuring the controller-manager Deployment `revisionHistoryLimit` + through Helm values. + - Adds support for multiple sync sources, improving how Gatekeeper syncs external + or cluster objects into OPA. + - Upgrades the constraint framework with a new Kubernetes Native Validation + driver schema (relevant to VAP/CEL workflows). + - Exposes external data provider response cache TTL via Helm; TTL can be tuned + or set to 0 to disable caching. breaking_changes: [] chart_version: 3.14.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.0', - 'openpolicyagent/gatekeeper:v3.14.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.14.0 + - openpolicyagent/gatekeeper:v3.14.0 eolAt: '2024-05-09' - version: 3.13.2 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -24699,23 +33456,32 @@ addons: \ **deployment strategy** for `controller-manager`.\n - Support adding **PriorityClass**\ \ to Jobs.\n - Pre-upgrade hook job: retries configured (helps reliability\ \ during upgrades).\n" - chart_updates: ['v3.13.2 release is functionally identical to v3.13.1, but **adds/publishes - the Helm chart artifact** for the release tag.', 'In 3.13.0 line, chart-related - fixes/robustness improvements mentioned include webhook retry logic for - Helm probes and retry configuration on the pre-upgrade hook job.'] - features: ['Audit: added PubSub support for audit eventing/integration.', ExpansionTemplates - graduated to **beta** (more stable API/behavior expectations)., Added an - experimental **ValidatingAdmissionPolicy (VAP) driver** prototype., Added - support for **External Data Provider audit response cache** (performance/availability - improvement)., 'Added **observability statistics/metrics** for admission, - audit, and gator CLI.'] + chart_updates: + - v3.13.2 release is functionally identical to v3.13.1, but **adds/publishes + the Helm chart artifact** for the release tag. + - In 3.13.0 line, chart-related fixes/robustness improvements mentioned include + webhook retry logic for Helm probes and retry configuration on the pre-upgrade + hook job. + features: + - 'Audit: added PubSub support for audit eventing/integration.' + - ExpansionTemplates graduated to **beta** (more stable API/behavior expectations). + - Added an experimental **ValidatingAdmissionPolicy (VAP) driver** prototype. + - Added support for **External Data Provider audit response cache** (performance/availability + improvement). + - Added **observability statistics/metrics** for admission, audit, and gator + CLI. breaking_changes: [] chart_version: 3.13.2 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.13.2', - 'openpolicyagent/gatekeeper:v3.13.2'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.13.2 + - openpolicyagent/gatekeeper:v3.13.2 eolAt: '2024-02-05' - version: 3.13.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24735,30 +33501,40 @@ addons: may behave differently (more resilient rather than failing fast). ' - chart_updates: [Adds support for configuring the controller-manager Deployment - strategy (chart-level capability)., Adds `webhookURL` configuration option - to the chart., Improves Helm hook jobs/probe-webhook behavior with retries - (more robust upgrades).] - features: ['Audit gained PubSub support, enabling external event-driven integrations - for audit output/processing.', 'ExpansionTemplate moved to beta and expansion - gained recursive expansion capabilities, improving workload validation workflows.', - Experimental Kubernetes ValidatingAdmissionPolicy (VAP) driver/prototype was - added as a step toward CEL-based admission integration., 'External Data - Provider Audit Cache was added to cache external data responses during audit, - reducing repeated calls and improving performance.', 'New observability - statistics are available for admission, audit, and the gator CLI for improved - monitoring and troubleshooting.'] - breaking_changes: [ExpansionTemplate CRD graduation to **beta** may involve - CRD schema/behavior changes; verify your existing ExpansionTemplates against - the new CRD and re-apply CRDs during upgrade., 'Gatekeeper dependencies - were upgraded to Kubernetes v1.27.2 / controller-runtime v0.15.0; if you - run very old Kubernetes versions, confirm compatibility before upgrading.'] + chart_updates: + - Adds support for configuring the controller-manager Deployment strategy (chart-level + capability). + - Adds `webhookURL` configuration option to the chart. + - Improves Helm hook jobs/probe-webhook behavior with retries (more robust upgrades). + features: + - Audit gained PubSub support, enabling external event-driven integrations for + audit output/processing. + - ExpansionTemplate moved to beta and expansion gained recursive expansion capabilities, + improving workload validation workflows. + - Experimental Kubernetes ValidatingAdmissionPolicy (VAP) driver/prototype was + added as a step toward CEL-based admission integration. + - External Data Provider Audit Cache was added to cache external data responses + during audit, reducing repeated calls and improving performance. + - New observability statistics are available for admission, audit, and the gator + CLI for improved monitoring and troubleshooting. + breaking_changes: + - ExpansionTemplate CRD graduation to **beta** may involve CRD schema/behavior + changes; verify your existing ExpansionTemplates against the new CRD and re-apply + CRDs during upgrade. + - Gatekeeper dependencies were upgraded to Kubernetes v1.27.2 / controller-runtime + v0.15.0; if you run very old Kubernetes versions, confirm compatibility before + upgrading. chart_version: 3.13.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.13.0', - 'openpolicyagent/gatekeeper:v3.13.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.13.0 + - openpolicyagent/gatekeeper:v3.13.0 eolAt: '2024-02-05' - version: 3.12.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24777,26 +33553,38 @@ addons: \ templates; this can show up as resource diffs on upgrade.\n\n_No explicit\ \ breaking Helm values removals are called out in the provided notes, but\ \ expect diffs due to the above additions/templating fixes._" - chart_updates: [Adds a NetworkPolicy manifest for the controller-manager (Helm - chart feature)., Probe webhook job/container behavior updated to run with - `curl` as entrypoint., Fixes Helm static templates to include missing namespaces - (may change rendered manifests)., Adds support to configure the WebhookConfiguration - name; updates pre-install CRD image handling.] - features: ['New `AssignImage` mutator enables image mutation use-cases (e.g., - rewriting images to an approved registry).', "Gatekeeper can emit admission/audit\ - \ events into the **involved object\u2019s namespace**, improving discoverability\ - \ during debugging.", OPA dependency updated to **v0.49.2** (behavior/performance/security - changes come from OPA)., Multi-engine groundwork added to support future - integration with Kubernetes CEL `ValidatingAdmissionPolicy`., New `--exempt-namespace-suffix` - flag allows exempting namespaces by suffix pattern., 'Logging improvements: - ability to write logs to a custom file and more verbose audit logging.'] + chart_updates: + - Adds a NetworkPolicy manifest for the controller-manager (Helm chart feature). + - Probe webhook job/container behavior updated to run with `curl` as entrypoint. + - Fixes Helm static templates to include missing namespaces (may change rendered + manifests). + - Adds support to configure the WebhookConfiguration name; updates pre-install + CRD image handling. + features: + - New `AssignImage` mutator enables image mutation use-cases (e.g., rewriting + images to an approved registry). + - "Gatekeeper can emit admission/audit events into the **involved object\u2019\ + s namespace**, improving discoverability during debugging." + - OPA dependency updated to **v0.49.2** (behavior/performance/security changes + come from OPA). + - Multi-engine groundwork added to support future integration with Kubernetes + CEL `ValidatingAdmissionPolicy`. + - New `--exempt-namespace-suffix` flag allows exempting namespaces by suffix + pattern. + - 'Logging improvements: ability to write logs to a custom file and more verbose + audit logging.' breaking_changes: [] chart_version: 3.12.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.12.0', - 'openpolicyagent/gatekeeper:v3.12.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.12.0 + - openpolicyagent/gatekeeper:v3.12.0 eolAt: '2023-11-01' - version: 3.11.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24826,29 +33614,37 @@ addons: \ you will likely need to provide CA bundles and client certs/keys (via chart\ \ values or secrets) and ensure the provider endpoints are HTTPS with proper\ \ trust.\n" - chart_updates: [Gatekeeper migrated away from PodSecurityPolicy (PSP) toward - Pod Security Admission (PSA) in the v3.10 timeframe; ensure your chart install - no longer expects PSP resources on Kubernetes >=1.25., 'Helm chart includes - enhancements for scheduling (topology spread), hook jobs configurability/labels, - and better webhook/probe configurability from v3.10.', v3.11 chart bugfixes - improve Helm hook job installation behavior and correct pod security label - handling.] - features: [External Data promoted to beta; external data providers must now - be accessed with TLS/mTLS., 'Gator CLI promoted to beta; adds tracing support, - AdmissionReview support, and the ability to specify an OCI image for test/expand - workflows.', Audit logs can include resource labels (helpful for correlating - violations).] - breaking_changes: ['If you use External Data, TLS/mTLS is now required for provider - communication; non-TLS provider endpoints/configs will stop working until - updated.', 'If you previously depended on PSP objects being installed by - the chart, Kubernetes v1.25+ clusters will require PSA-based configuration - instead (PSP removal may require policy/process changes).'] + chart_updates: + - Gatekeeper migrated away from PodSecurityPolicy (PSP) toward Pod Security + Admission (PSA) in the v3.10 timeframe; ensure your chart install no longer + expects PSP resources on Kubernetes >=1.25. + - Helm chart includes enhancements for scheduling (topology spread), hook jobs + configurability/labels, and better webhook/probe configurability from v3.10. + - v3.11 chart bugfixes improve Helm hook job installation behavior and correct + pod security label handling. + features: + - External Data promoted to beta; external data providers must now be accessed + with TLS/mTLS. + - Gator CLI promoted to beta; adds tracing support, AdmissionReview support, + and the ability to specify an OCI image for test/expand workflows. + - Audit logs can include resource labels (helpful for correlating violations). + breaking_changes: + - If you use External Data, TLS/mTLS is now required for provider communication; + non-TLS provider endpoints/configs will stop working until updated. + - If you previously depended on PSP objects being installed by the chart, Kubernetes + v1.25+ clusters will require PSA-based configuration instead (PSP removal + may require policy/process changes). chart_version: 3.11.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.11.0', - 'openpolicyagent/gatekeeper:v3.11.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.11.0 + - openpolicyagent/gatekeeper:v3.11.0 eolAt: '2023-08-08' - version: 3.10.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24876,32 +33672,43 @@ addons: \ values.\n* If you experienced probe-related restarts/timeouts, consider\ \ tuning the new **probe timeout** values.\n* If you run multiple replicas\ \ across zones/nodes, consider enabling **topology spread** for HA.\n" - chart_updates: [Chart updates to support Kubernetes v1.25+ by removing PodSecurityPolicy - resources and aligning with Pod Security Admission (PSA)., 'Helm chart enhancements - to make operational settings configurable: probe timeout configuration, - webhook configuration annotations, controller topology spread constraints, - and more hook-job options/standardized labels.', Chart fixes related to - labeling exempted namespaces and general helm upgrade reliability (helm - upgrade test additions)., 'Chart changes to explicitly specify `curl` usage - in webhook probing job, improving portability across images/environments.'] - features: [PodSecurityPolicy removal and migration guidance toward Pod Security - Admission for Kubernetes v1.25+ clusters., 'Mutation promoted to stable - (v1), indicating API/behavior stability for mutation features.', 'Alpha - feature introduced: validation of workload resources (new workload-focused - validation capability).', 'Operational and security hardening knobs: ability - to inject external certs and configure minimum TLS version for the controller - manager.', 'Helm usability improvements: configurable webhook annotations, - probe timeout tuning, and topology spread constraints for controller scheduling.', - New audit metric `audit_last_run_end_time` to improve observability of audit - execution.] - breaking_changes: [Clusters relying on PodSecurityPolicy (especially Kubernetes - v1.25+) must migrate to Pod Security Admission; PSP resources are removed - in this release and will no longer be applied/created by the chart.] + chart_updates: + - Chart updates to support Kubernetes v1.25+ by removing PodSecurityPolicy resources + and aligning with Pod Security Admission (PSA). + - 'Helm chart enhancements to make operational settings configurable: probe + timeout configuration, webhook configuration annotations, controller topology + spread constraints, and more hook-job options/standardized labels.' + - Chart fixes related to labeling exempted namespaces and general helm upgrade + reliability (helm upgrade test additions). + - Chart changes to explicitly specify `curl` usage in webhook probing job, improving + portability across images/environments. + features: + - PodSecurityPolicy removal and migration guidance toward Pod Security Admission + for Kubernetes v1.25+ clusters. + - Mutation promoted to stable (v1), indicating API/behavior stability for mutation + features. + - 'Alpha feature introduced: validation of workload resources (new workload-focused + validation capability).' + - 'Operational and security hardening knobs: ability to inject external certs + and configure minimum TLS version for the controller manager.' + - 'Helm usability improvements: configurable webhook annotations, probe timeout + tuning, and topology spread constraints for controller scheduling.' + - New audit metric `audit_last_run_end_time` to improve observability of audit + execution. + breaking_changes: + - Clusters relying on PodSecurityPolicy (especially Kubernetes v1.25+) must + migrate to Pod Security Admission; PSP resources are removed in this release + and will no longer be applied/created by the chart. chart_version: 3.10.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.10.0', - 'openpolicyagent/gatekeeper:v3.10.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.10.0 + - openpolicyagent/gatekeeper:v3.10.0 - version: 3.9.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24929,30 +33736,39 @@ addons: \n> Note: The provided notes don\u2019t include exact Helm value keys; use\ \ `helm show values` for the target chart version and diff your current `values.yaml`\ \ against it." - chart_updates: [Adds post-upgrade job to label exempted namespaces (and fixes - templating for that label)., Adds webhook `objectSelector` support in chart - templates., Adds gatekeeper-webhook post-install hook., Allows overriding - securityContexts; adds podSecurityContext value support., Adds ability to - configure affinity for `upgradeCRDs` jobs and to set job annotations., Adds - Helm chart support for selecting metrics backend / exporters.] - features: [External Data gains TLS/mTLS support for calling external providers., - Gatekeeper can validate Kubernetes subresources (more granular admission control)., - Adds OpenCensus and Stackdriver exporters for metrics/telemetry., Performance - improvements including automaxprocs integration and earlier compilation/memory - optimizations from 3.8.x., 'Helm chart gains richer webhook targeting controls - (objectSelector, custom rules, reinvocationPolicy) and improved upgrade/uninstall - hooks.'] - breaking_changes: ['Avoid deploying **Gatekeeper v3.8.0**: it is marked **DO - NOT USE** due to a bug that can cause unenforced violations when using the - `config` resource without sync; upgrade via **v3.8.1+** before moving to - v3.9.0.', 'If you rely on namespace exemption behavior, the introduction - of namespace labeling and related hooks/jobs may change how exemptions are - applied; verify labels and RBAC for the upgrade job/webhook hooks before - upgrading.'] + chart_updates: + - Adds post-upgrade job to label exempted namespaces (and fixes templating for + that label). + - Adds webhook `objectSelector` support in chart templates. + - Adds gatekeeper-webhook post-install hook. + - Allows overriding securityContexts; adds podSecurityContext value support. + - Adds ability to configure affinity for `upgradeCRDs` jobs and to set job annotations. + - Adds Helm chart support for selecting metrics backend / exporters. + features: + - External Data gains TLS/mTLS support for calling external providers. + - Gatekeeper can validate Kubernetes subresources (more granular admission control). + - Adds OpenCensus and Stackdriver exporters for metrics/telemetry. + - Performance improvements including automaxprocs integration and earlier compilation/memory + optimizations from 3.8.x. + - Helm chart gains richer webhook targeting controls (objectSelector, custom + rules, reinvocationPolicy) and improved upgrade/uninstall hooks. + breaking_changes: + - 'Avoid deploying **Gatekeeper v3.8.0**: it is marked **DO NOT USE** due to + a bug that can cause unenforced violations when using the `config` resource + without sync; upgrade via **v3.8.1+** before moving to v3.9.0.' + - If you rely on namespace exemption behavior, the introduction of namespace + labeling and related hooks/jobs may change how exemptions are applied; verify + labels and RBAC for the upgrade job/webhook hooks before upgrading. chart_version: 3.9.0 - images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.9.0', 'openpolicyagent/gatekeeper:v3.9.0'] + images: + - curlimages/curl:7.83.1 + - openpolicyagent/gatekeeper-crds:v3.9.0 + - openpolicyagent/gatekeeper:v3.9.0 - version: 3.8.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -24988,32 +33804,45 @@ addons: > Note: v3.8.0 is marked **DO NOT USE** upstream due to an enforcement bug when using `config` without sync; prefer **v3.8.1+** for the upgrade.' - chart_updates: ["Performance-focused release: significant improvements to constraint\ - \ template compilation (~16%) and major reductions in webhook CPU/memory\ - \ (1.5x\u20134x) plus audit memory (~2x).", Adds a TLS checker for the webhook - and bumps default TLS min version to 1.3., Adds metric and operational improvements - around mutation (conflicting mutators metric; mutation-status operation)., - Improves matching capabilities (suffix-based matching; additional webhook - label exemptions)., 'CLI/tooling changes: `gktest` renamed to `gator`; `gator - test` renamed to `gator verify` (docs/UX updates).', Dependency updates - include upgrading embedded OPA to **v0.39.0**.] - features: ['External Data now supports **mutation**, enabling mutation responses - driven by external providers.', 'New Prometheus metric for **conflicting - mutators**, improving observability of mutation configuration issues.', - Customizable webhook configuration rules and reinvocation policy allow tighter - integration with cluster admission policies., Suffix-based resource matching - expands how constraints/targets can match resource kinds/names.] - breaking_changes: ['**Do not deploy v3.8.0**: upstream warns of a bug that can - cause **unenforced violations** when using the `config` resource without - sync; upgrade to **v3.8.1+** instead.', Default minimum TLS for webhooks - changes to **TLS 1.3**; clusters/components that only support TLS 1.2 may - fail webhook calls unless you explicitly configure the min TLS version., - 'CLI rename: `gator test` becomes `gator verify` (and `gktest` renamed to - `gator`), which can break scripts/CI pipelines relying on old command names.'] + chart_updates: + - "Performance-focused release: significant improvements to constraint template\ + \ compilation (~16%) and major reductions in webhook CPU/memory (1.5x\u2013\ + 4x) plus audit memory (~2x)." + - Adds a TLS checker for the webhook and bumps default TLS min version to 1.3. + - Adds metric and operational improvements around mutation (conflicting mutators + metric; mutation-status operation). + - Improves matching capabilities (suffix-based matching; additional webhook + label exemptions). + - 'CLI/tooling changes: `gktest` renamed to `gator`; `gator test` renamed to + `gator verify` (docs/UX updates).' + - Dependency updates include upgrading embedded OPA to **v0.39.0**. + features: + - External Data now supports **mutation**, enabling mutation responses driven + by external providers. + - New Prometheus metric for **conflicting mutators**, improving observability + of mutation configuration issues. + - Customizable webhook configuration rules and reinvocation policy allow tighter + integration with cluster admission policies. + - Suffix-based resource matching expands how constraints/targets can match resource + kinds/names. + breaking_changes: + - '**Do not deploy v3.8.0**: upstream warns of a bug that can cause **unenforced + violations** when using the `config` resource without sync; upgrade to **v3.8.1+** + instead.' + - Default minimum TLS for webhooks changes to **TLS 1.3**; clusters/components + that only support TLS 1.2 may fail webhook calls unless you explicitly configure + the min TLS version. + - 'CLI rename: `gator test` becomes `gator verify` (and `gktest` renamed to + `gator`), which can break scripts/CI pipelines relying on old command names.' chart_version: 3.8.0 - images: ['openpolicyagent/gatekeeper-crds:v3.8.0', 'openpolicyagent/gatekeeper:v3.8.0'] + images: + - openpolicyagent/gatekeeper-crds:v3.8.0 + - openpolicyagent/gatekeeper:v3.8.0 - version: 3.7.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -25032,29 +33861,40 @@ addons: - No explicit value key removals were called out in the provided notes; validate your existing `values.yaml` against the new chart defaults before upgrading.' - chart_updates: ['Mutation feature status updated: mutation is now **Beta** in - v3.7.0 (was earlier stage in v3.6.x).', 'New mutator type: **ModifySet** - mutator added.', 'New alpha feature: **External Data** for validation added - (gated behind a flag).', 'Webhook TLS hardening: minimum TLS version raised - to **1.2**; configurable via `--tls-min-version` (with TLS 1.3 planned as - default in v3.8.0).', 'Audit memory improvements: audit can write cache - to disk to reduce memory usage; Helm adds knobs for RAM-disk option.', 'New - alpha tooling: **Gator CLI** introduced for local testing of ConstraintTemplates/Constraints - without a Kubernetes cluster.'] - features: ['Mutation is now Beta, making mutation capabilities more production-ready - and supported than prior versions.', 'ModifySet mutator added, enabling - set-style modifications as part of mutation.', External Data for validation - (alpha) allows Gatekeeper policies to consult out-of-process providers for - decisions., Gator CLI (alpha) provides a way to test templates/constraints - locally without Kubernetes., Audit memory usage reduced via cache-to-disk - capability; optional RAM-disk support via Helm values.] - breaking_changes: [Webhook TLS minimum version is now TLS 1.2; clients using - TLS 1.0/1.1 will fail to connect unless updated. (You can configure the - minimum via `--tls-min-version`.)] + chart_updates: + - 'Mutation feature status updated: mutation is now **Beta** in v3.7.0 (was + earlier stage in v3.6.x).' + - 'New mutator type: **ModifySet** mutator added.' + - 'New alpha feature: **External Data** for validation added (gated behind a + flag).' + - 'Webhook TLS hardening: minimum TLS version raised to **1.2**; configurable + via `--tls-min-version` (with TLS 1.3 planned as default in v3.8.0).' + - 'Audit memory improvements: audit can write cache to disk to reduce memory + usage; Helm adds knobs for RAM-disk option.' + - 'New alpha tooling: **Gator CLI** introduced for local testing of ConstraintTemplates/Constraints + without a Kubernetes cluster.' + features: + - Mutation is now Beta, making mutation capabilities more production-ready and + supported than prior versions. + - ModifySet mutator added, enabling set-style modifications as part of mutation. + - External Data for validation (alpha) allows Gatekeeper policies to consult + out-of-process providers for decisions. + - Gator CLI (alpha) provides a way to test templates/constraints locally without + Kubernetes. + - Audit memory usage reduced via cache-to-disk capability; optional RAM-disk + support via Helm values. + breaking_changes: + - Webhook TLS minimum version is now TLS 1.2; clients using TLS 1.0/1.1 will + fail to connect unless updated. (You can configure the minimum via `--tls-min-version`.) chart_version: 3.7.0 - images: ['openpolicyagent/gatekeeper-crds:v3.7.0', 'openpolicyagent/gatekeeper:v3.7.0'] + images: + - openpolicyagent/gatekeeper-crds:v3.7.0 + - openpolicyagent/gatekeeper:v3.7.0 - version: 3.6.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -25067,34 +33907,45 @@ addons: - **PDB API version auto-selection:** Helm chart dynamically selects the **PodDisruptionBudget\ \ API version** based on cluster version; remove any workarounds/overrides\ \ you carried for older/newer K8s.\n" - chart_updates: [ConstraintTemplate CRD moves to **v1** (requires CRD update - in the cluster)., Gatekeeper and controller-runtime metrics are unified - into a **single endpoint** (affects scraping/ServiceMonitor/Prometheus config)., - 'Mutation subsystem improvements: large **System.Mutate runtime reduction**, - watch/constraint controller **race condition fixes**, and new mutation features - (namespace prefix matching; integer `keyValue` support in mutation path - parser).', Removed **non-specific webhook request metrics**; request duration - metric buckets updated (upper limit 3s)., Adds metrics reporting for mutation., - Updates Kubernetes dependency/support matrix (notably K8s v1.22 updates).] - features: ['ConstraintTemplate CRD is now served as v1, modernizing the API - and aligning with newer Kubernetes CRD versions.', Mutation performance - improved significantly (reported ~87% reduction for System.Mutate runtime)., - Namespace and excludedNamespaces matching now supports prefix-based matching - for more flexible scoping., 'Mutation path parser/mutators support integer - keyValue, enabling more precise mutations on numeric keys.', 'Helm chart - improvements: configurable controller-manager/audit ports and hooks to upgrade - CRDs.', 'Metrics enhancements: unified metrics endpoint and mutation metrics - reporting.'] - breaking_changes: ['**ConstraintTemplate CRD moves to v1**; clusters must have - updated CRDs before/with the upgrade, and any tooling expecting the older - CRD version may need adjustment.', 'Metrics surface changes: **non-specific - webhook request metrics removed** and metrics endpoint behavior changes - (unified endpoint), which can break existing dashboards/alerts/scrape configs.'] + chart_updates: + - ConstraintTemplate CRD moves to **v1** (requires CRD update in the cluster). + - Gatekeeper and controller-runtime metrics are unified into a **single endpoint** + (affects scraping/ServiceMonitor/Prometheus config). + - 'Mutation subsystem improvements: large **System.Mutate runtime reduction**, + watch/constraint controller **race condition fixes**, and new mutation features + (namespace prefix matching; integer `keyValue` support in mutation path parser).' + - Removed **non-specific webhook request metrics**; request duration metric + buckets updated (upper limit 3s). + - Adds metrics reporting for mutation. + - Updates Kubernetes dependency/support matrix (notably K8s v1.22 updates). + features: + - ConstraintTemplate CRD is now served as v1, modernizing the API and aligning + with newer Kubernetes CRD versions. + - Mutation performance improved significantly (reported ~87% reduction for System.Mutate + runtime). + - Namespace and excludedNamespaces matching now supports prefix-based matching + for more flexible scoping. + - Mutation path parser/mutators support integer keyValue, enabling more precise + mutations on numeric keys. + - 'Helm chart improvements: configurable controller-manager/audit ports and + hooks to upgrade CRDs.' + - 'Metrics enhancements: unified metrics endpoint and mutation metrics reporting.' + breaking_changes: + - '**ConstraintTemplate CRD moves to v1**; clusters must have updated CRDs before/with + the upgrade, and any tooling expecting the older CRD version may need adjustment.' + - 'Metrics surface changes: **non-specific webhook request metrics removed** + and metrics endpoint behavior changes (unified endpoint), which can break + existing dashboards/alerts/scrape configs.' chart_version: 3.6.0 - images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper-crds:v3.6.0', - 'openpolicyagent/gatekeeper:v3.6.0'] + images: + - line/kubectl-kustomize:1.20.4-4.0.5 + - openpolicyagent/gatekeeper-crds:v3.6.0 + - openpolicyagent/gatekeeper:v3.6.0 - version: 3.5.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -25111,23 +33962,34 @@ addons: - **v3.5.0 webhook defaults**: v3.5.0 adds default configs to the `MutatingWebhookConfiguration`; review any custom webhook settings/overrides to ensure they still match your desired behavior.' - chart_updates: [Helm v2 chart removed; Helm v3 chart is the supported path (v3.4.0)., - 'Helm: removed `crd-install` hook (v3.4.0).', 'Helm: mutation components added - to chart behind `experimentalEnableMutation` flag (v3.4.0).', 'Helm: removed - duplicate `affinity` key (bugfix in v3.4.0).', MutatingWebhookConfiguration - now ships with default configuration values (v3.5.0).] - features: [Kubernetes v1.22+ compatibility (v3.5.0)., Mutation support available - as an alpha feature and deployable via Helm with `experimentalEnableMutation` - (introduced in v3.4.0)., Improved user feedback for invalid inputs (v3.4.0).] - breaking_changes: [Helm v2 chart removed starting in v3.4.0; you must use Helm - v3 for install/upgrade going forward., Validation metrics `request_count` - and `request_duration_seconds` are deprecated in favor of `validation_request_count` - and `validation_request_duration_seconds` (introduced in v3.4.0); update - dashboards/alerts before the old names are removed in a future release.] + chart_updates: + - Helm v2 chart removed; Helm v3 chart is the supported path (v3.4.0). + - 'Helm: removed `crd-install` hook (v3.4.0).' + - 'Helm: mutation components added to chart behind `experimentalEnableMutation` + flag (v3.4.0).' + - 'Helm: removed duplicate `affinity` key (bugfix in v3.4.0).' + - MutatingWebhookConfiguration now ships with default configuration values (v3.5.0). + features: + - Kubernetes v1.22+ compatibility (v3.5.0). + - Mutation support available as an alpha feature and deployable via Helm with + `experimentalEnableMutation` (introduced in v3.4.0). + - Improved user feedback for invalid inputs (v3.4.0). + breaking_changes: + - Helm v2 chart removed starting in v3.4.0; you must use Helm v3 for install/upgrade + going forward. + - Validation metrics `request_count` and `request_duration_seconds` are deprecated + in favor of `validation_request_count` and `validation_request_duration_seconds` + (introduced in v3.4.0); update dashboards/alerts before the old names are + removed in a future release. chart_version: 3.5.0 - images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper:v3.5.0'] + images: + - line/kubectl-kustomize:1.20.4-4.0.5 + - openpolicyagent/gatekeeper:v3.5.0 - version: 3.4.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -25151,20 +34013,29 @@ addons: for deprecation** in favor of `validation_request_count` and `validation_request_duration_seconds`; update dashboards/alerts accordingly (not an immediate break in 3.4.0, but plan ahead).' - chart_updates: [Helm v2 chart support removed; Helm v3 chart is the supported - install/upgrade path., Helm chart gains support for mutation (alpha) behind - `experimentalEnableMutation`., 'Helm chart fix: removed duplicate `affinity` - key.', 'Helm chart change: removed `crd-install` hook (Helm v3 CRD handling).'] - features: [Mutation is available as an alpha feature and can be deployed via - experimental manifests or enabled in the Helm v3 chart with `experimentalEnableMutation`., - "Added better \u201Cinvalid input\u201D feedback to help users diagnose bad\ - \ policy/constraint inputs."] - breaking_changes: [Helm v2 chart has been removed as of v3.4.0; any Helm v2-based - install/upgrade process must be migrated to Helm v3.] + chart_updates: + - Helm v2 chart support removed; Helm v3 chart is the supported install/upgrade + path. + - Helm chart gains support for mutation (alpha) behind `experimentalEnableMutation`. + - 'Helm chart fix: removed duplicate `affinity` key.' + - 'Helm chart change: removed `crd-install` hook (Helm v3 CRD handling).' + features: + - Mutation is available as an alpha feature and can be deployed via experimental + manifests or enabled in the Helm v3 chart with `experimentalEnableMutation`. + - "Added better \u201Cinvalid input\u201D feedback to help users diagnose bad\ + \ policy/constraint inputs." + breaking_changes: + - Helm v2 chart has been removed as of v3.4.0; any Helm v2-based install/upgrade + process must be migrated to Helm v3. chart_version: 3.4.0 - images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper:v3.4.0'] + images: + - line/kubectl-kustomize:1.20.4-4.0.5 + - openpolicyagent/gatekeeper:v3.4.0 - version: 3.3.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: @@ -25194,47 +34065,61 @@ addons: on your desired behavior. ' - chart_updates: ['Helm chart feature additions focused on configurability: optional - namespace creation, configurable PriorityClass, read-only root filesystem - option, tunable webhook timeouts/delete behavior, configurable validation - webhook workers, and ability to set different settings for audit vs controller - components.'] - features: ['Helm chart can optionally create the namespace, improving compatibility - with GitOps or pre-provisioned namespaces.', PriorityClass can be set for - controller-manager and audit deployments to control scheduling precedence., - New `readiness-retries` flag allows tuning how many readiness checks/retries - Gatekeeper performs before declaring failure., 'Config resource is now validated - to be named `config`, reducing misconfiguration drift.', 'Audit and controller - can now have different settings, enabling more precise performance vs enforcement - tuning.', Admission validation webhook worker count is configurable to control - concurrency and throughput., 'Experimental mutation system improvements: - CRD validation, mutation cache, assign/assignmetadata controllers, and better - mutation webhook behavior.'] + chart_updates: + - 'Helm chart feature additions focused on configurability: optional namespace + creation, configurable PriorityClass, read-only root filesystem option, tunable + webhook timeouts/delete behavior, configurable validation webhook workers, + and ability to set different settings for audit vs controller components.' + features: + - Helm chart can optionally create the namespace, improving compatibility with + GitOps or pre-provisioned namespaces. + - PriorityClass can be set for controller-manager and audit deployments to control + scheduling precedence. + - New `readiness-retries` flag allows tuning how many readiness checks/retries + Gatekeeper performs before declaring failure. + - Config resource is now validated to be named `config`, reducing misconfiguration + drift. + - Audit and controller can now have different settings, enabling more precise + performance vs enforcement tuning. + - Admission validation webhook worker count is configurable to control concurrency + and throughput. + - 'Experimental mutation system improvements: CRD validation, mutation cache, + assign/assignmetadata controllers, and better mutation webhook behavior.' breaking_changes: [] chart_version: 3.3.0 - images: ['openpolicyagent/gatekeeper:v3.3.0'] + images: + - openpolicyagent/gatekeeper:v3.3.0 - version: 3.2.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Gatekeeper library was moved out of the main Gatekeeper repository - into its own repository: https://github.com/open-policy-agent/gatekeeper-library.'] - breaking_changes: ['If you relied on Gatekeeper constraint templates/constraints - from the in-repo library or referenced it as part of your upgrade process, - you now need to pull those artifacts from the separate gatekeeper-library - repository instead.'] + features: + - 'Gatekeeper library was moved out of the main Gatekeeper repository into its + own repository: https://github.com/open-policy-agent/gatekeeper-library.' + breaking_changes: + - If you relied on Gatekeeper constraint templates/constraints from the in-repo + library or referenced it as part of your upgrade process, you now need to + pull those artifacts from the separate gatekeeper-library repository instead. chart_version: 3.2.0 - images: ['openpolicyagent/gatekeeper:v3.2.0'] + images: + - openpolicyagent/gatekeeper:v3.2.0 - version: 3.1.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 3.1.0 - images: ['openpolicyagent/gatekeeper:v3.1.0'] + images: + - openpolicyagent/gatekeeper:v3.1.0 name: gatekeeper - icon: https://docs.tigera.io/img/calico-logo.webp git_url: https://github.com/projectcalico/calico @@ -25244,183 +34129,266 @@ addons: eolApiSlug: calico versions: - version: 3.32.2 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details provided in the supplied notes; both releases - reference external GitHub release-notes files for specifics.] + features: + - No feature details provided in the supplied notes; both releases reference + external GitHub release-notes files for specifics. breaking_changes: [] chart_version: 3.32.2 - images: ['quay.io/tigera/operator:v1.42.6'] + images: + - quay.io/tigera/operator:v1.42.6 - version: 3.32.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release artifacts now explicitly include separate CRD Helm charts - (`crd.projectcalico.org/v1` and a tech-preview `projectcalico.org/v3`) alongside - the tigera-operator chart, which may change how you manage CRDs during upgrades.', - 'Calico v3.32.0 introduces a new set of images/binaries/manifests packaged - in `release-v3.32.0.tgz` and updated `tigera-operator-v3.32.0.tgz`, indicating - component image/tag updates across the stack.'] - breaking_changes: ['No breaking changes were included in the provided notes - excerpt; review the linked v3.32.0 release-notes markdown for any upgrade-impacting - changes (API/CRD, configuration defaults, deprecations).'] + features: + - Release artifacts now explicitly include separate CRD Helm charts (`crd.projectcalico.org/v1` + and a tech-preview `projectcalico.org/v3`) alongside the tigera-operator chart, + which may change how you manage CRDs during upgrades. + - Calico v3.32.0 introduces a new set of images/binaries/manifests packaged + in `release-v3.32.0.tgz` and updated `tigera-operator-v3.32.0.tgz`, indicating + component image/tag updates across the stack. + breaking_changes: + - No breaking changes were included in the provided notes excerpt; review the + linked v3.32.0 release-notes markdown for any upgrade-impacting changes (API/CRD, + configuration defaults, deprecations). chart_version: 3.32.0 - images: ['quay.io/tigera/operator:v1.42.0'] + images: + - quay.io/tigera/operator:v1.42.0 - version: 3.31.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Upgrade Calico/tigera-operator bundle from v3.30.0 to v3.31.0 (new - release artifacts for Linux/Windows, OpenShift bundle, and updated calicoctl - binaries).'] + features: + - Upgrade Calico/tigera-operator bundle from v3.30.0 to v3.31.0 (new release + artifacts for Linux/Windows, OpenShift bundle, and updated calicoctl binaries). breaking_changes: [] chart_version: 3.31.0 - images: ['quay.io/tigera/operator:v1.40.0'] + images: + - quay.io/tigera/operator:v1.40.0 - version: 3.30.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release artifact updates for Calico v3.30.0 including updated tigera-operator - Helm chart bundle and associated images/manifests., Updated calicoctl and - Windows artifacts published as part of the v3.30.0 release bundle.] + features: + - Release artifact updates for Calico v3.30.0 including updated tigera-operator + Helm chart bundle and associated images/manifests. + - Updated calicoctl and Windows artifacts published as part of the v3.30.0 release + bundle. breaking_changes: [] chart_version: 3.30.0 - images: ['quay.io/tigera/operator:v1.38.0'] + images: + - quay.io/tigera/operator:v1.38.0 eolAt: '2026-04-30' - version: 3.29.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Bumped Calico and tigera-operator chart artifacts from v3.28.0 to - v3.29.0 (new release bundles and Helm chart tarball).] - breaking_changes: [No breaking changes were provided in the supplied notes; - review the v3.29.0 release notes document and tigera-operator chart changelog - for any API/values deprecations before upgrading.] + features: + - Bumped Calico and tigera-operator chart artifacts from v3.28.0 to v3.29.0 + (new release bundles and Helm chart tarball). + breaking_changes: + - No breaking changes were provided in the supplied notes; review the v3.29.0 + release notes document and tigera-operator chart changelog for any API/values + deprecations before upgrading. chart_version: 3.29.0 - images: ['quay.io/tigera/operator:v1.36.0'] + images: + - quay.io/tigera/operator:v1.36.0 eolAt: '2025-10-21' - version: 3.28.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Bumps Calico release from v3.27.0 to v3.28.0 (new images/binaries/manifests - and tigera-operator Helm chart tarball).] + features: + - Bumps Calico release from v3.27.0 to v3.28.0 (new images/binaries/manifests + and tigera-operator Helm chart tarball). breaking_changes: [] chart_version: 3.28.0 - images: ['quay.io/tigera/operator:v1.34.0'] + images: + - quay.io/tigera/operator:v1.34.0 eolAt: '2025-05-05' - version: 3.27.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Calico release v3.27.0 (includes tigera-operator-v3.27.0 Helm chart) - published 2023-12-15; upgrade from v3.26.0 changes the Calico components - to 3.27.0 images/manifests bundled in the release artifact.] - breaking_changes: [No breaking changes or feature details were provided in the - supplied notes beyond artifact listings; review the full v3.27.0 release - notes markdown to identify any required config or API changes before upgrading.] + features: + - Calico release v3.27.0 (includes tigera-operator-v3.27.0 Helm chart) published + 2023-12-15; upgrade from v3.26.0 changes the Calico components to 3.27.0 images/manifests + bundled in the release artifact. + breaking_changes: + - No breaking changes or feature details were provided in the supplied notes + beyond artifact listings; review the full v3.27.0 release notes markdown to + identify any required config or API changes before upgrading. chart_version: 3.27.0 - images: ['quay.io/tigera/operator:v1.32.3'] + images: + - quay.io/tigera/operator:v1.32.3 eolAt: '2024-10-29' - version: 3.26.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release artifacts updated to Calico v3.26.0, including tigera-operator - Helm v3 chart package and updated binaries/images/manifests bundle.', Added - an OpenShift manifest bundle (ocp.tgz) to the v3.26.0 release assets list - (in addition to the standard release tarball and Helm chart).] + features: + - Release artifacts updated to Calico v3.26.0, including tigera-operator Helm + v3 chart package and updated binaries/images/manifests bundle. + - Added an OpenShift manifest bundle (ocp.tgz) to the v3.26.0 release assets + list (in addition to the standard release tarball and Helm chart). breaking_changes: [] chart_version: 3.26.0 - images: ['quay.io/tigera/operator:v1.30.0'] + images: + - quay.io/tigera/operator:v1.30.0 eolAt: '2024-05-11' - version: 3.25.0 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Bumps Tigera Operator / Calico Helm chart artifact from `tigera-operator-v3.24.1.tgz`\ - \ to `tigera-operator-v3.25.0.tgz` (chart package size ~106KB \u2192 ~107KB)."] - features: ['New Calico release v3.25.0 available with updated container images, - binaries, manifests, and Helm chart artifact (`release-v3.25.0.tgz`, `tigera-operator-v3.25.0.tgz`).'] + chart_updates: + - "Bumps Tigera Operator / Calico Helm chart artifact from `tigera-operator-v3.24.1.tgz`\ + \ to `tigera-operator-v3.25.0.tgz` (chart package size ~106KB \u2192 ~107KB)." + features: + - New Calico release v3.25.0 available with updated container images, binaries, + manifests, and Helm chart artifact (`release-v3.25.0.tgz`, `tigera-operator-v3.25.0.tgz`). breaking_changes: [] chart_version: 3.25.0 - images: ['quay.io/tigera/operator:v1.29.0'] + images: + - quay.io/tigera/operator:v1.29.0 eolAt: '2023-12-15' - version: 3.24.1 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release artifacts updated to Calico v3.24.1 including updated container - images, binaries, manifests, and the tigera-operator Helm v3 chart package.'] + features: + - Release artifacts updated to Calico v3.24.1 including updated container images, + binaries, manifests, and the tigera-operator Helm v3 chart package. breaking_changes: [] chart_version: 3.24.1 - images: ['quay.io/tigera/operator:v1.28.1'] + images: + - quay.io/tigera/operator:v1.28.1 - version: 3.23.4 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Version bump of the tigera-operator Helm chart packaged with - Calico from v3.22.5 to v3.23.4 (chart artifact `tigera-operator-v3.23.4.tgz`).] - features: [Upgrade Calico/Tigera components from the v3.22 series to the v3.23 - series (operator/chart version bump).] - breaking_changes: [No breaking changes are stated in the provided release-note - excerpts; review the full v3.23 release notes for any required manual steps - before upgrading.] + chart_updates: + - Version bump of the tigera-operator Helm chart packaged with Calico from v3.22.5 + to v3.23.4 (chart artifact `tigera-operator-v3.23.4.tgz`). + features: + - Upgrade Calico/Tigera components from the v3.22 series to the v3.23 series + (operator/chart version bump). + breaking_changes: + - No breaking changes are stated in the provided release-note excerpts; review + the full v3.23 release notes for any required manual steps before upgrading. chart_version: 3.23.4 - images: ['quay.io/tigera/operator:v1.27.14'] + images: + - quay.io/tigera/operator:v1.27.14 - version: 3.22.5 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Calico v3.22.5 release package provides updated container images/binaries/manifests - and a tigera-operator Helm chart bundle (`tigera-operator-v3.22.5.tgz`).] - breaking_changes: [No breaking changes were provided in the supplied release - note excerpts; consult the full v3.21/v3.22 release notes to identify any - upgrade-impacting changes between 3.20.6 and 3.22.5.] + features: + - Calico v3.22.5 release package provides updated container images/binaries/manifests + and a tigera-operator Helm chart bundle (`tigera-operator-v3.22.5.tgz`). + breaking_changes: + - No breaking changes were provided in the supplied release note excerpts; consult + the full v3.21/v3.22 release notes to identify any upgrade-impacting changes + between 3.20.6 and 3.22.5. chart_version: 3.22.5 - images: ['quay.io/tigera/operator:v1.25.13'] + images: + - quay.io/tigera/operator:v1.25.13 - version: 3.20.6 - kube: ['1.30', '1.29', '1.28', '1.27'] + kube: + - '1.30' + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 3.20.6 - images: ['quay.io/tigera/operator:v1.20.9'] + images: + - quay.io/tigera/operator:v1.20.9 name: tigera-operator - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/argo-cd/plural/icons/argo-stacked-color-square.png?raw=true git_url: https://github.com/argoproj/argo-cd @@ -25429,575 +34397,763 @@ addons: eolApiSlug: argocd versions: - version: 3.5.2 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['ApplicationSet: restores `ignoreApplicationDifferences` behavior - after normalization, which improves diff/sync accuracy when using AppSet-generated - apps.', 'Repository/Helm sources: fixes handling of an untyped Helm source - in `UpdateRevisionForPaths`, reducing errors when path-based revision updates - run against Helm repos.', 'UI: applications and appset pages receive small - improvements (operation state visible in app list; remove kind filter on - appset page).', 'Dependency: Dex updated to v2.45.1 (may include security/bug - fixes from Dex).'] + features: + - 'ApplicationSet: restores `ignoreApplicationDifferences` behavior after normalization, + which improves diff/sync accuracy when using AppSet-generated apps.' + - 'Repository/Helm sources: fixes handling of an untyped Helm source in `UpdateRevisionForPaths`, + reducing errors when path-based revision updates run against Helm repos.' + - 'UI: applications and appset pages receive small improvements (operation state + visible in app list; remove kind filter on appset page).' + - 'Dependency: Dex updated to v2.45.1 (may include security/bug fixes from Dex).' breaking_changes: [] chart_version: 10.8.1 - images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', - 'quay.io/argoproj/argocd:v3.5.2'] + images: + - ecr-public.aws.com/docker/library/redis:8.6.4-alpine + - ghcr.io/dexidp/dex:v2.45.1 + - quay.io/argoproj/argocd:v3.5.2 - version: 3.5.1 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['No new features in v3.5.1; this is a patch release focused on stability, - performance, and security hardening.'] + features: + - No new features in v3.5.1; this is a patch release focused on stability, performance, + and security hardening. breaking_changes: [] chart_version: 10.4.0 - images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', - 'quay.io/argoproj/argocd:v3.5.1'] + images: + - ecr-public.aws.com/docker/library/redis:8.6.4-alpine + - ghcr.io/dexidp/dex:v2.45.1 + - quay.io/argoproj/argocd:v3.5.1 - version: 3.5.0 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Helm rendering now uses Helm 4, which may change manifest output - and requires validating chart compatibility and any custom tooling/plugins - tied to Helm 3.', 'ApplicationSet controller can manage applications concurrently, - improving performance for large numbers of generated Applications but increasing - burstiness against the Kubernetes API.', Webhook-triggered application refreshes - now support configurable jitter to reduce thundering-herd refresh spikes., - 'Repo-server gains mTLS support, enabling mutual TLS between Argo CD components - and the repo-server for hardened transport security.', 'Source Integrity - checking is introduced (CLI support and hydrator opt-in for dry sources, - alpha), enabling signature/integrity verification of sources with policy-driven - enforcement.', 'UI gains deeper ApplicationSet visibility: AppSet appears - in the Application resource tree, has preview apps and an Apps tab, and - additional filtering options (repo URL, target revision).', 'Helm valueFiles - now support wildcard glob patterns, allowing simpler configuration for multi-environment - values overlays.', 'Server cache behavior is tightened: objects from non-allowed - namespaces are dropped before entering cache, improving isolation in multi-namespace - setups.', Authentication improvements include optional relaxed strict impersonation - enforcement and better OIDC session handling (refresh tokens to renew expired - sessions).] - breaking_changes: ['Migration from Helm 3 to Helm 4 is a major tooling change - that can affect manifest rendering/output; test all Helm-based applications - and custom plugins, and verify repo-server image/tooling expectations.', - 'If you rely on ApplicationSet cluster generator Kubernetes version labels - from earlier behavior (3.4 series note), ensure secrets use the vMajor.Minor.Patch - format under argocd.argoproj.io/kubernetes-version; mismatches can break - cluster selection logic.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Helm rendering now uses Helm 4, which may change manifest output and requires + validating chart compatibility and any custom tooling/plugins tied to Helm + 3. + - ApplicationSet controller can manage applications concurrently, improving + performance for large numbers of generated Applications but increasing burstiness + against the Kubernetes API. + - Webhook-triggered application refreshes now support configurable jitter to + reduce thundering-herd refresh spikes. + - Repo-server gains mTLS support, enabling mutual TLS between Argo CD components + and the repo-server for hardened transport security. + - Source Integrity checking is introduced (CLI support and hydrator opt-in for + dry sources, alpha), enabling signature/integrity verification of sources + with policy-driven enforcement. + - 'UI gains deeper ApplicationSet visibility: AppSet appears in the Application + resource tree, has preview apps and an Apps tab, and additional filtering + options (repo URL, target revision).' + - Helm valueFiles now support wildcard glob patterns, allowing simpler configuration + for multi-environment values overlays. + - 'Server cache behavior is tightened: objects from non-allowed namespaces are + dropped before entering cache, improving isolation in multi-namespace setups.' + - Authentication improvements include optional relaxed strict impersonation + enforcement and better OIDC session handling (refresh tokens to renew expired + sessions). + breaking_changes: + - Migration from Helm 3 to Helm 4 is a major tooling change that can affect + manifest rendering/output; test all Helm-based applications and custom plugins, + and verify repo-server image/tooling expectations. + - If you rely on ApplicationSet cluster generator Kubernetes version labels + from earlier behavior (3.4 series note), ensure secrets use the vMajor.Minor.Patch + format under argocd.argoproj.io/kubernetes-version; mismatches can break cluster + selection logic. chart_version: 10.3.2 - images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', - 'quay.io/argoproj/argocd:v3.5.0'] + images: + - ecr-public.aws.com/docker/library/redis:8.6.4-alpine + - ghcr.io/dexidp/dex:v2.45.1 + - quay.io/argoproj/argocd:v3.5.0 - version: 3.4.1 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Cluster generator K8s version label format changes to match Helm: - ApplicationSets using Cluster Generator with `argocd.argoproj.io/auto-label-cluster-info` - must switch from `Major.Minor` to `argocd.argoproj.io/kubernetes-version` - in `vMajor.Minor.Patch` format.', 'ApplicationSet improvements: status now - includes a Health field, plus new watch/listResourceEvents APIs and multiple - UI enhancements for AppSets.', 'Controller features: can pause reconciliation - for a specific cluster via an annotation; adds application-level sync option - for Prune+Delete.', 'Helm rendering enhancement: supports wildcard/glob - patterns for `valueFiles`; also supports custom User-Agent headers when - fetching Helm repos.', 'Hydrator enhancements: configurable authorName/Email - for hydration commits and multiple correctness fixes; UI adds hydrator support - in app create/summary.', 'Observability/security: adds OpenTelemetry instrumentation - for auth/handlers; disables gRPC DNS TXT lookups by default; adds tighter - cert/known-hosts limits during stream parsing.'] - breaking_changes: ['Cluster version format change impacts ApplicationSet Cluster - Generators: update any selectors/templating that rely on Kubernetes version - labels to use `argocd.argoproj.io/kubernetes-version` with `vMajor.Minor.Patch` - (e.g., `v1.30.2`) instead of `Major.Minor` (e.g., `1.30`).'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Cluster generator K8s version label format changes to match Helm: ApplicationSets + using Cluster Generator with `argocd.argoproj.io/auto-label-cluster-info` + must switch from `Major.Minor` to `argocd.argoproj.io/kubernetes-version` + in `vMajor.Minor.Patch` format.' + - 'ApplicationSet improvements: status now includes a Health field, plus new + watch/listResourceEvents APIs and multiple UI enhancements for AppSets.' + - 'Controller features: can pause reconciliation for a specific cluster via + an annotation; adds application-level sync option for Prune+Delete.' + - 'Helm rendering enhancement: supports wildcard/glob patterns for `valueFiles`; + also supports custom User-Agent headers when fetching Helm repos.' + - 'Hydrator enhancements: configurable authorName/Email for hydration commits + and multiple correctness fixes; UI adds hydrator support in app create/summary.' + - 'Observability/security: adds OpenTelemetry instrumentation for auth/handlers; + disables gRPC DNS TXT lookups by default; adds tighter cert/known-hosts limits + during stream parsing.' + breaking_changes: + - 'Cluster version format change impacts ApplicationSet Cluster Generators: + update any selectors/templating that rely on Kubernetes version labels to + use `argocd.argoproj.io/kubernetes-version` with `vMajor.Minor.Patch` (e.g., + `v1.30.2`) instead of `Major.Minor` (e.g., `1.30`).' chart_version: 9.5.13 - images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.45.1', - 'quay.io/argoproj/argocd:v3.4.1'] + images: + - ecr-public.aws.com/docker/library/redis:8.2.3-alpine + - ghcr.io/dexidp/dex:v2.45.1 + - quay.io/argoproj/argocd:v3.4.1 - version: 3.3.8 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Server-Side Apply (SSA) becomes a central part of the 3.3 line, - including SSA diffs and automatic migration away from the legacy kubectl - client-side apply field manager.', 'ApplicationSet improvements include - new pprof endpoints, Progressive Sync maturity, status/resource count controls, - and multiple reconciliation/finalizer fixes.', 'New/expanded custom actions - and health checks (e.g., CloudNativePG actions, PR merge action, more KEDA/Ceph/Crossplane/GatewayAPI-related - health logic) improve operational workflows and UI feedback.', Repository - integration enhancements such as GitHub App auth without installation ID - and optional shallow clones reduce friction and improve performance.] - breaking_changes: ['If Argo CD is managing its own installation (app-of-apps/self-managed), - the upgrade may fail unless the managing Application uses `ServerSideApply=true`; - some environments may also need the temporary workaround `ClientSideApplyMigration=false` - to avoid a client-side apply migration error.', 'Behavior changes around - apply/diff (SSA, server-side dry-run, apply-out-of-sync-only, replace/force - options) can alter sync outcomes; validate sync options and test against - critical apps before rolling out broadly.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Server-Side Apply (SSA) becomes a central part of the 3.3 line, including + SSA diffs and automatic migration away from the legacy kubectl client-side + apply field manager. + - ApplicationSet improvements include new pprof endpoints, Progressive Sync + maturity, status/resource count controls, and multiple reconciliation/finalizer + fixes. + - New/expanded custom actions and health checks (e.g., CloudNativePG actions, + PR merge action, more KEDA/Ceph/Crossplane/GatewayAPI-related health logic) + improve operational workflows and UI feedback. + - Repository integration enhancements such as GitHub App auth without installation + ID and optional shallow clones reduce friction and improve performance. + breaking_changes: + - If Argo CD is managing its own installation (app-of-apps/self-managed), the + upgrade may fail unless the managing Application uses `ServerSideApply=true`; + some environments may also need the temporary workaround `ClientSideApplyMigration=false` + to avoid a client-side apply migration error. + - Behavior changes around apply/diff (SSA, server-side dry-run, apply-out-of-sync-only, + replace/force options) can alter sync outcomes; validate sync options and + test against critical apps before rolling out broadly. chart_version: 9.5.10 - images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.45.1', - 'quay.io/argoproj/argocd:v3.3.8'] + images: + - ecr-public.aws.com/docker/library/redis:8.2.3-alpine + - ghcr.io/dexidp/dex:v2.45.1 + - quay.io/argoproj/argocd:v3.3.8 - version: 3.3.0 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Argo CD 3.3.0 is a new minor release compared to 3.2.1, with - a major internal shift toward server-side apply (SSA) support and related - migration logic (e.g., client-side apply migration, server-side diffs).', - 'Install/upgrade guidance now recommends (or requires in some scenarios) `kubectl - apply --server-side --force-conflicts`, which hints at increased reliance - on SSA semantics and field ownership/managedFields.', 'Large volume of improvements - across sync engine behavior (ordering of Namespace/CRD creation, pruning - order), cluster cache scalability, UI enhancements, and additional built-in - health checks and custom actions.', 'If you are coming from 3.2.1 specifically, - note that 3.2.1 was primarily bugfixes (UI null-safety, repo-server git - detached concurrency fix) and docs tweaks; the big behavioral changes arrive - in 3.3.0.'] - features: ['Server-Side Apply and Server-Side Diffs: adds SSA manager configuration, - SSA support, and server-side diffing to improve accuracy and scalability - of diffs.', 'Self-managed Argo CD upgrade improvements: auto-migration logic - exists for kubectl client-side apply fields when moving to SSA workflows.', - 'Sync behavior enhancements: create Namespaces/CRDs earlier (before PreSync), - prune in reverse sync-wave order, and new/expanded sync options like ApplyOutOfSyncOnly - and Force via annotation.', 'Operational additions: many new/expanded custom - actions (e.g., CloudNativePG actions, PR merge action, KEDA pause) and more - health checks (Ceph, Crossplane updates, HPA v2, KEDA, ServiceBinding/Instance, - etc.).', 'Repo/credentials improvements: GitHub App auth support without - installation ID; Redis secret credentials can be provided via volume mounts; - shallow clone option for repos.', 'UX/CLI improvements: custom icons support, - better sync warnings, richer CLI completion (including PowerShell) and new - CLI flags/filters.'] - breaking_changes: ['If Argo CD manages itself (an Application deploys Argo CD), - you must set `ServerSideApply=true` on that Application or the upgrade can - fail.', 'In some self-managed setups (notably Kustomize), you may also need - `ClientSideApplyMigration=false` to avoid client-side apply migration errors - during sync.', 'The move toward SSA/managedFields can change diff/apply - behavior (field ownership conflicts, need for `--force-conflicts`), so expect - potential one-time reconciliation noise and conflict resolution work during/after - upgrade.'] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Argo CD 3.3.0 is a new minor release compared to 3.2.1, with a major internal + shift toward server-side apply (SSA) support and related migration logic (e.g., + client-side apply migration, server-side diffs). + - Install/upgrade guidance now recommends (or requires in some scenarios) `kubectl + apply --server-side --force-conflicts`, which hints at increased reliance + on SSA semantics and field ownership/managedFields. + - Large volume of improvements across sync engine behavior (ordering of Namespace/CRD + creation, pruning order), cluster cache scalability, UI enhancements, and + additional built-in health checks and custom actions. + - If you are coming from 3.2.1 specifically, note that 3.2.1 was primarily bugfixes + (UI null-safety, repo-server git detached concurrency fix) and docs tweaks; + the big behavioral changes arrive in 3.3.0. + features: + - 'Server-Side Apply and Server-Side Diffs: adds SSA manager configuration, + SSA support, and server-side diffing to improve accuracy and scalability of + diffs.' + - 'Self-managed Argo CD upgrade improvements: auto-migration logic exists for + kubectl client-side apply fields when moving to SSA workflows.' + - 'Sync behavior enhancements: create Namespaces/CRDs earlier (before PreSync), + prune in reverse sync-wave order, and new/expanded sync options like ApplyOutOfSyncOnly + and Force via annotation.' + - 'Operational additions: many new/expanded custom actions (e.g., CloudNativePG + actions, PR merge action, KEDA pause) and more health checks (Ceph, Crossplane + updates, HPA v2, KEDA, ServiceBinding/Instance, etc.).' + - 'Repo/credentials improvements: GitHub App auth support without installation + ID; Redis secret credentials can be provided via volume mounts; shallow clone + option for repos.' + - 'UX/CLI improvements: custom icons support, better sync warnings, richer CLI + completion (including PowerShell) and new CLI flags/filters.' + breaking_changes: + - If Argo CD manages itself (an Application deploys Argo CD), you must set `ServerSideApply=true` + on that Application or the upgrade can fail. + - In some self-managed setups (notably Kustomize), you may also need `ClientSideApplyMigration=false` + to avoid client-side apply migration errors during sync. + - The move toward SSA/managedFields can change diff/apply behavior (field ownership + conflicts, need for `--force-conflicts`), so expect potential one-time reconciliation + noise and conflict resolution work during/after upgrade. chart_version: 9.4.2 - images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.44.0', - 'quay.io/argoproj/argocd:v3.3.0'] + images: + - ecr-public.aws.com/docker/library/redis:8.2.3-alpine + - ghcr.io/dexidp/dex:v2.44.0 + - quay.io/argoproj/argocd:v3.3.0 - version: 3.2.1 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Repo Server: fixes a concurrency issue when processing detached - git states, reducing chance of stuck/failed refreshes in busy repos.', 'UI: - multiple small fixes (null-safe status panel rendering, prevent overlapping - elements, add resource units in tooltips, avoid rendering ApplicationSelector - when panel hidden).'] + features: + - 'Repo Server: fixes a concurrency issue when processing detached git states, + reducing chance of stuck/failed refreshes in busy repos.' + - 'UI: multiple small fixes (null-safe status panel rendering, prevent overlapping + elements, add resource units in tooltips, avoid rendering ApplicationSelector + when panel hidden).' breaking_changes: [] chart_version: 9.1.8 - images: ['ecr-public.aws.com/docker/library/redis:8.2.2-alpine', 'ghcr.io/dexidp/dex:v2.44.0', - 'quay.io/argoproj/argocd:v3.2.1'] + images: + - ecr-public.aws.com/docker/library/redis:8.2.2-alpine + - ghcr.io/dexidp/dex:v2.44.0 + - quay.io/argoproj/argocd:v3.2.1 eolAt: '2026-08-04' - version: 3.2.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Internal tooling bumps: embedded Helm upgraded to 3.18.4 (via - 3.18.3) and embedded Kustomize upgraded to 5.7.0.', 'New/updated health - check scripts and resource_customizations shipped with the release (CronJob - actions/health changes, plus additional CRD health checks such as Coralogix, - DatadogMetric, ClickHouse operator, ExtensionService, GitOps Promoter, 3scale, - etc.).', 'Security fix included: repository.GetDetailedProject no longer - exposes repository secrets.', 'Performance/behavioral fixes around auto-sync - loops and controller CPU (reduced settings DB calls), plus webhook handler - hardening (panic recovery; informer usage to reduce memory).', 'Source Hydrator - enhancements: commit message templating, credential templates, preserve - non-hydrated files, repo URL normalization, parallelized repo-server calls.'] - features: ['ApplicationSet: pprof endpoints added; progressive sync deletion - can happen in order; improved status/debug logging; concurrency ceiling - effectively removed.', 'CLI: server-side diff is supported; new `argocd - get-resource` command; password can be read from stdin / prompted for bcrypt - operations.', 'Controller: when retrying a failed sync, Argo CD can sync - a newer revision than the original failed revision.', 'Observability: OpenTelemetry - trace context propagation added for HTTP requests; new metrics to track - number of users.', 'Server/UI: gRPC health check endpoint for argocd-server; - UI improvements like sortable columns and prune option during rollback, - plus richer repo connection status messages.'] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Internal tooling bumps: embedded Helm upgraded to 3.18.4 (via 3.18.3) and + embedded Kustomize upgraded to 5.7.0.' + - New/updated health check scripts and resource_customizations shipped with + the release (CronJob actions/health changes, plus additional CRD health checks + such as Coralogix, DatadogMetric, ClickHouse operator, ExtensionService, GitOps + Promoter, 3scale, etc.). + - 'Security fix included: repository.GetDetailedProject no longer exposes repository + secrets.' + - Performance/behavioral fixes around auto-sync loops and controller CPU (reduced + settings DB calls), plus webhook handler hardening (panic recovery; informer + usage to reduce memory). + - 'Source Hydrator enhancements: commit message templating, credential templates, + preserve non-hydrated files, repo URL normalization, parallelized repo-server + calls.' + features: + - 'ApplicationSet: pprof endpoints added; progressive sync deletion can happen + in order; improved status/debug logging; concurrency ceiling effectively removed.' + - 'CLI: server-side diff is supported; new `argocd get-resource` command; password + can be read from stdin / prompted for bcrypt operations.' + - 'Controller: when retrying a failed sync, Argo CD can sync a newer revision + than the original failed revision.' + - 'Observability: OpenTelemetry trace context propagation added for HTTP requests; + new metrics to track number of users.' + - 'Server/UI: gRPC health check endpoint for argocd-server; UI improvements + like sortable columns and prune option during rollback, plus richer repo connection + status messages.' breaking_changes: [] chart_version: 9.1.4 - images: ['ecr-public.aws.com/docker/library/redis:8.2.2-alpine', 'ghcr.io/dexidp/dex:v2.44.0', - 'quay.io/argoproj/argocd:v3.2.0'] + images: + - ecr-public.aws.com/docker/library/redis:8.2.2-alpine + - ghcr.io/dexidp/dex:v2.44.0 + - quay.io/argoproj/argocd:v3.2.0 eolAt: '2026-08-04' - version: 3.1.1 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [No Helm chart-specific changelog was provided in the notes you - pasted; the v3.1.1 notes are application release notes only., "If you are\ - \ upgrading via Helm, verify the argo-cd Helm chart version that corresponds\ - \ to app v3.1.1 and review that chart\u2019s CHANGELOG for values/schema\ - \ changes, hook/job changes, and CRD handling."] - features: [No new user-facing features called out for v3.1.1; this is a patch - release focused on fixes and small manifest tweaks., Manifests add OCI-related - environment variables (helps OCI/registry integrations when using upstream - install manifests).] + chart_updates: + - No Helm chart-specific changelog was provided in the notes you pasted; the + v3.1.1 notes are application release notes only. + - "If you are upgrading via Helm, verify the argo-cd Helm chart version that\ + \ corresponds to app v3.1.1 and review that chart\u2019s CHANGELOG for values/schema\ + \ changes, hook/job changes, and CRD handling." + features: + - No new user-facing features called out for v3.1.1; this is a patch release + focused on fixes and small manifest tweaks. + - Manifests add OCI-related environment variables (helps OCI/registry integrations + when using upstream install manifests). breaking_changes: [] chart_version: 8.3.3 - images: ['ecr-public.aws.com/docker/library/redis:7.2.8-alpine', 'ghcr.io/dexidp/dex:v2.44.0', - 'quay.io/argoproj/argocd:v3.1.1'] + images: + - ecr-public.aws.com/docker/library/redis:7.2.8-alpine + - ghcr.io/dexidp/dex:v2.44.0 + - quay.io/argoproj/argocd:v3.1.1 eolAt: '2026-05-05' - version: 3.1.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Application version bump from v3.0.x to v3.1.0 (new images/manifests)., - 'Tooling bundled with Argo CD updated: Helm upgraded to 3.18.x; Kustomize - upgraded to 5.7.0.', 'Various health-check/resource customization additions - (Karpenter, Crossplane/Upbound, Kyverno, Logstash, RabbitMQ topology, OpenTelemetryCollector, - Grafana Operator, Gateway API, Contour HTTPProxy, etc.).', Security hardening - around static assets/commit-server traversal protection and other fixes., - UI enhancements including Progressive Sync integration and improved repo/pod - views., CLI improvements including plugin support and additional commands/aliases.] - features: ['CLI: adds official plugin support and a new whoami alias.', 'UI: - Progressive Sync feature integrated and additional usability improvements - (sorting, resource display toggles, autosync enabled field).', 'ApplicationSet: - enhancements such as Bitbucket Cloud PR generator target-branch support - and git file generator file-exclusion support.', 'Repo/OCI: OCI support - continues (beta) plus related UI polish and OCI client fixes; also adds - GitHub API rate limit metrics.', 'Operations/Health: many new built-in health - checks/resource customizations for popular CRDs (Crossplane, Kyverno, KEDA, - Grafana Operator, OpenTelemetryCollector, etc.).'] - breaking_changes: ['Potential API/schema change around SyncPolicy automated - sync: field is `enabled` (and a UI field was added); ensure any manifests/automation - referencing older field names are updated.', 'Toolchain bumps (Helm 3.18.x, - Kustomize 5.7.0) can change rendering/diff behavior compared to 3.0.x; validate - any edge-case charts/kustomize builds in staging.'] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Application version bump from v3.0.x to v3.1.0 (new images/manifests). + - 'Tooling bundled with Argo CD updated: Helm upgraded to 3.18.x; Kustomize + upgraded to 5.7.0.' + - Various health-check/resource customization additions (Karpenter, Crossplane/Upbound, + Kyverno, Logstash, RabbitMQ topology, OpenTelemetryCollector, Grafana Operator, + Gateway API, Contour HTTPProxy, etc.). + - Security hardening around static assets/commit-server traversal protection + and other fixes. + - UI enhancements including Progressive Sync integration and improved repo/pod + views. + - CLI improvements including plugin support and additional commands/aliases. + features: + - 'CLI: adds official plugin support and a new whoami alias.' + - 'UI: Progressive Sync feature integrated and additional usability improvements + (sorting, resource display toggles, autosync enabled field).' + - 'ApplicationSet: enhancements such as Bitbucket Cloud PR generator target-branch + support and git file generator file-exclusion support.' + - 'Repo/OCI: OCI support continues (beta) plus related UI polish and OCI client + fixes; also adds GitHub API rate limit metrics.' + - 'Operations/Health: many new built-in health checks/resource customizations + for popular CRDs (Crossplane, Kyverno, KEDA, Grafana Operator, OpenTelemetryCollector, + etc.).' + breaking_changes: + - 'Potential API/schema change around SyncPolicy automated sync: field is `enabled` + (and a UI field was added); ensure any manifests/automation referencing older + field names are updated.' + - Toolchain bumps (Helm 3.18.x, Kustomize 5.7.0) can change rendering/diff behavior + compared to 3.0.x; validate any edge-case charts/kustomize builds in staging. chart_version: 8.3.0 - images: ['ecr-public.aws.com/docker/library/redis:7.2.8-alpine', 'ghcr.io/dexidp/dex:v2.43.1', - 'quay.io/argoproj/argocd:v3.1.0'] + images: + - ecr-public.aws.com/docker/library/redis:7.2.8-alpine + - ghcr.io/dexidp/dex:v2.43.1 + - quay.io/argoproj/argocd:v3.1.0 eolAt: '2026-05-05' - version: 3.0.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Argo CD 3.0.0 is a major release with multiple default-behavior - changes (RBAC, diffing/compare, tracking method, logging, controller processing) - that can affect existing installations during upgrade.', 'Repo-server tooling - bumped (Helm 3.17.0, kubectl 1.32.1) and Kubernetes support updated (supports - Kubernetes 1.32; older versions removed from e2e).', 'Redis usage changed: - application health status is stored in Redis by default; Redis image upgraded - (7.0.15-alpine -> 7.2.7-alpine).', 'Security posture and supply chain: images - signed with cosign and SLSA3 provenance; some dependency CVE bumps included.', - Legacy repo support removed; behavior of ApplicationSet selectors and diff - ignore defaults changed; some deprecated metrics removed.] - features: [Azure Workload Identity support added for Git/OCI repositories and - for Microsoft Entra (Azure AD) SSO flows., 'Application controller now stores - application health status in Redis by default, improving performance/scalability - for large installs.', Batch event processing enabled by default in the controller - to reduce event storm impact., 'Helm tooling upgraded to Helm v3.17.0 and - kubectl upgraded to 1.32.x, improving compatibility with newer clusters.', - Bearer token authentication support added (including UI/Helm repo connect - flows)., 'Kustomize enhancements: ignore missing components and support - --include-templates for label processing.', 'UI improvements: better log - search (match case), log highlighting, sync-wave display, repo filtering, - and various UX fixes.', More metrics exposed (including additional kubectl - metrics and cluster name/labels in cluster metrics).] - breaking_changes: [RBAC enforcement for logs is enabled by default; users/roles - that previously could view logs may be denied until RBAC is updated., 'Fine-grained - RBAC inheritance is disabled by default, which can change effective permissions - for inherited roles/policies.', "Compare/diff defaults changed: compare\ - \ options default values updated, known interim resources excluded by default,\ - \ and Argo CD now ignores .status updates and other high-churn diffs by\ - \ default\u2014this can change sync/diff outcomes.", 'Default resource tracking - method changed to annotation, which can affect how existing resources are - associated with applications if you relied on the prior default.', 'Default - logging switched to JSON, which can break log parsers/alerts expecting text - logs.', Legacy repo support removed; any clusters/repos relying on legacy - repository handling must be migrated., Deprecated metrics removed; dashboards/alerts - referencing old metric names will break., 'ApplicationSet behavior change: - nested selectors are always applied, potentially altering generated ApplicationSets/app - selection.', Default jitter added (60s) which can change timing/behavior - of periodic operations and reconciliation cadence.] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Argo CD 3.0.0 is a major release with multiple default-behavior changes (RBAC, + diffing/compare, tracking method, logging, controller processing) that can + affect existing installations during upgrade. + - Repo-server tooling bumped (Helm 3.17.0, kubectl 1.32.1) and Kubernetes support + updated (supports Kubernetes 1.32; older versions removed from e2e). + - 'Redis usage changed: application health status is stored in Redis by default; + Redis image upgraded (7.0.15-alpine -> 7.2.7-alpine).' + - 'Security posture and supply chain: images signed with cosign and SLSA3 provenance; + some dependency CVE bumps included.' + - Legacy repo support removed; behavior of ApplicationSet selectors and diff + ignore defaults changed; some deprecated metrics removed. + features: + - Azure Workload Identity support added for Git/OCI repositories and for Microsoft + Entra (Azure AD) SSO flows. + - Application controller now stores application health status in Redis by default, + improving performance/scalability for large installs. + - Batch event processing enabled by default in the controller to reduce event + storm impact. + - Helm tooling upgraded to Helm v3.17.0 and kubectl upgraded to 1.32.x, improving + compatibility with newer clusters. + - Bearer token authentication support added (including UI/Helm repo connect + flows). + - 'Kustomize enhancements: ignore missing components and support --include-templates + for label processing.' + - 'UI improvements: better log search (match case), log highlighting, sync-wave + display, repo filtering, and various UX fixes.' + - More metrics exposed (including additional kubectl metrics and cluster name/labels + in cluster metrics). + breaking_changes: + - RBAC enforcement for logs is enabled by default; users/roles that previously + could view logs may be denied until RBAC is updated. + - Fine-grained RBAC inheritance is disabled by default, which can change effective + permissions for inherited roles/policies. + - "Compare/diff defaults changed: compare options default values updated, known\ + \ interim resources excluded by default, and Argo CD now ignores .status updates\ + \ and other high-churn diffs by default\u2014this can change sync/diff outcomes." + - Default resource tracking method changed to annotation, which can affect how + existing resources are associated with applications if you relied on the prior + default. + - Default logging switched to JSON, which can break log parsers/alerts expecting + text logs. + - Legacy repo support removed; any clusters/repos relying on legacy repository + handling must be migrated. + - Deprecated metrics removed; dashboards/alerts referencing old metric names + will break. + - 'ApplicationSet behavior change: nested selectors are always applied, potentially + altering generated ApplicationSets/app selection.' + - Default jitter added (60s) which can change timing/behavior of periodic operations + and reconciliation cadence. chart_version: 8.0.1 - images: ['ghcr.io/dexidp/dex:v2.42.1', 'public.ecr.aws/docker/library/redis:7.2.8-alpine', - 'quay.io/argoproj/argocd:v3.0.0'] + images: + - ghcr.io/dexidp/dex:v2.42.1 + - public.ecr.aws/docker/library/redis:7.2.8-alpine + - quay.io/argoproj/argocd:v3.0.0 eolAt: '2026-02-02' - version: 2.14.11 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Hydrator: webhook handling now understands `sourceHydrator` fields, - improving support for hydration workflows triggered via webhooks.'] + features: + - 'Hydrator: webhook handling now understands `sourceHydrator` fields, improving + support for hydration workflows triggered via webhooks.' breaking_changes: [] chart_version: 7.9.1 - images: ['ghcr.io/dexidp/dex:v2.42.1', 'public.ecr.aws/docker/library/redis:7.2.8-alpine', - 'quay.io/argoproj/argocd:v2.14.11'] + images: + - ghcr.io/dexidp/dex:v2.42.1 + - public.ecr.aws/docker/library/redis:7.2.8-alpine + - quay.io/argoproj/argocd:v2.14.11 eolAt: '2025-11-04' - version: 2.14.1 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["v2.14.1 release notes provided don\u2019t enumerate feature changes;\ - \ they mainly reference the full changelog diff from v2.14.0 to v2.14.1\ - \ and standard install/upgrade guidance.", 'v2.13.2 notes list bug fixes - in CLI core mode appset generation, multi-source sync ordering, API server - secret reads, repo deletion with invalid URLs, Bitbucket Cloud PR author - parsing, and a repo-server memory leak fix.'] - breaking_changes: ["No breaking changes are called out in the provided notes;\ - \ because you\u2019re crossing a minor version (2.13 \u2192 2.14), you should\ - \ still review the official Argo CD upgrading docs for any 2.14-specific\ - \ breaking changes not included here."] + features: + - "v2.14.1 release notes provided don\u2019t enumerate feature changes; they\ + \ mainly reference the full changelog diff from v2.14.0 to v2.14.1 and standard\ + \ install/upgrade guidance." + - v2.13.2 notes list bug fixes in CLI core mode appset generation, multi-source + sync ordering, API server secret reads, repo deletion with invalid URLs, Bitbucket + Cloud PR author parsing, and a repo-server memory leak fix. + breaking_changes: + - "No breaking changes are called out in the provided notes; because you\u2019\ + re crossing a minor version (2.13 \u2192 2.14), you should still review the\ + \ official Argo CD upgrading docs for any 2.14-specific breaking changes not\ + \ included here." chart_version: 7.8.0 - images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.2-alpine', - 'quay.io/argoproj/argocd:v2.14.1'] + images: + - ghcr.io/dexidp/dex:v2.41.1 + - public.ecr.aws/docker/library/redis:7.4.2-alpine + - quay.io/argoproj/argocd:v2.14.1 eolAt: '2025-11-04' - version: 2.13.2 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['(v2.13.0) UI extensions: Argo CD now supports configuring extensions - individually, allowing per-extension settings rather than a single shared - config.', '(v2.13.0) Self-heal exponential backoff: self-heal retries can - use an exponential backoff between attempts to reduce thrash during repeated - drift.'] + features: + - '(v2.13.0) UI extensions: Argo CD now supports configuring extensions individually, + allowing per-extension settings rather than a single shared config.' + - '(v2.13.0) Self-heal exponential backoff: self-heal retries can use an exponential + backoff between attempts to reduce thrash during repeated drift.' breaking_changes: [] chart_version: 7.7.12 - images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.1-alpine', - 'quay.io/argoproj/argocd:v2.13.2'] + images: + - ghcr.io/dexidp/dex:v2.41.1 + - public.ecr.aws/docker/library/redis:7.4.1-alpine + - quay.io/argoproj/argocd:v2.13.2 eolAt: '2025-08-13' - version: 2.13.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['v2.13.0: UI extensions can now be configured individually, allowing - more granular extension setup per extension rather than a single shared - config.', 'v2.13.0: Self-heal can use exponential backoff between attempts, - reducing thrash on frequently-drifting resources and smoothing controller - load.', 'v2.12.0: Added a custom health check for Cluster API AWSManagedControlPlane - resources (useful if you manage CAPI AWS clusters via Argo CD).'] + features: + - 'v2.13.0: UI extensions can now be configured individually, allowing more + granular extension setup per extension rather than a single shared config.' + - 'v2.13.0: Self-heal can use exponential backoff between attempts, reducing + thrash on frequently-drifting resources and smoothing controller load.' + - 'v2.12.0: Added a custom health check for Cluster API AWSManagedControlPlane + resources (useful if you manage CAPI AWS clusters via Argo CD).' breaking_changes: [] chart_version: 7.7.3 - images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.1-alpine', - 'quay.io/argoproj/argocd:v2.13.0'] + images: + - ghcr.io/dexidp/dex:v2.41.1 + - public.ecr.aws/docker/library/redis:7.4.1-alpine + - quay.io/argoproj/argocd:v2.13.0 eolAt: '2025-08-13' - version: 2.12.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Adds a custom health check for Cluster API\u2019s AWSManagedControlPlane\ - \ resource, improving health reporting for that CRD when managed by Argo\ - \ CD."] - breaking_changes: ['Known issue in 2.12.0: ApplicationSets using git generators - with a templated `spec.template.spec.project` can fail to reconcile due - to a bug in the new git signature verification feature (fixed in 2.12.2). - Consider upgrading to >=2.12.2 or avoiding that pattern during the upgrade.'] + features: + - "Adds a custom health check for Cluster API\u2019s AWSManagedControlPlane\ + \ resource, improving health reporting for that CRD when managed by Argo CD." + breaking_changes: + - 'Known issue in 2.12.0: ApplicationSets using git generators with a templated + `spec.template.spec.project` can fail to reconcile due to a bug in the new + git signature verification feature (fixed in 2.12.2). Consider upgrading to + >=2.12.2 or avoiding that pattern during the upgrade.' chart_version: 7.4.3 - images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', - 'quay.io/argoproj/argocd:v2.12.0'] + images: + - ghcr.io/dexidp/dex:v2.38.0 + - public.ecr.aws/docker/library/redis:7.2.4-alpine + - quay.io/argoproj/argocd:v2.12.0 eolAt: '2025-05-06' - version: 2.11.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Argo CD 2.11.0 is a new minor release over 2.10.7; release notes\ - \ provided here don\u2019t enumerate specific feature highlights beyond\ - \ standard installation, signing, and upgrade pointers."] - breaking_changes: [No breaking changes are listed in the provided release-note - excerpts; consult the full changelog diff and the official upgrading guide - for any minor-version upgrade considerations.] + features: + - "Argo CD 2.11.0 is a new minor release over 2.10.7; release notes provided\ + \ here don\u2019t enumerate specific feature highlights beyond standard installation,\ + \ signing, and upgrade pointers." + breaking_changes: + - No breaking changes are listed in the provided release-note excerpts; consult + the full changelog diff and the official upgrading guide for any minor-version + upgrade considerations. chart_version: 6.9.3 - images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', - 'quay.io/argoproj/argocd:v2.11.0'] + images: + - ghcr.io/dexidp/dex:v2.38.0 + - public.ecr.aws/docker/library/redis:7.2.4-alpine + - quay.io/argoproj/argocd:v2.11.0 eolAt: '2025-02-03' - version: 2.10.7 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['2.10.0 is the base for this patch-line upgrade; it introduced - multiple controller/server/repo-server features and fixes, plus a known - HA controller issue in 2.10.0 that is fixed in 2.10.1+.', v2.10.7 is a patch - release; the GitHub release page primarily points to the compare view (v2.10.6...v2.10.7) - rather than listing highlights on the page itself.] - features: ['In 2.10.0, Application Controller added sync jitter (to reduce sync - thundering herd) and a grace period for repo errors to avoid overly aggressive - Unknown sync states.', 'In 2.10.0, Argo CD added Server-Side Diff and improved - support for Server-Side Apply scenarios (notably around auto-creating namespaces).', - 'In 2.10.0, ApplicationSets gained advanced templating via templatePatch and - additional sprig functions (e.g., slugify).', 'In 2.10.0, Argo CD added - PostDelete hook support and improved UI capabilities (e.g., status panel - extensions, better prompts around pruning, recursive Helm values file detection).', - 'In 2.10.0, security/SSO improvements included PKCE web login flow and optional - OIDC UserInfo group-claim retrieval, plus better security logging when access - is blocked.'] - breaking_changes: [No explicit breaking changes are shown in the provided notes - for 2.10.0 or 2.10.7; treat this as 'none called out' rather than 'none - exist' and still follow the upstream upgrading guide when jumping minor - versions (not applicable here since it's a patch upgrade within 2.10).] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 2.10.0 is the base for this patch-line upgrade; it introduced multiple controller/server/repo-server + features and fixes, plus a known HA controller issue in 2.10.0 that is fixed + in 2.10.1+. + - v2.10.7 is a patch release; the GitHub release page primarily points to the + compare view (v2.10.6...v2.10.7) rather than listing highlights on the page + itself. + features: + - In 2.10.0, Application Controller added sync jitter (to reduce sync thundering + herd) and a grace period for repo errors to avoid overly aggressive Unknown + sync states. + - In 2.10.0, Argo CD added Server-Side Diff and improved support for Server-Side + Apply scenarios (notably around auto-creating namespaces). + - In 2.10.0, ApplicationSets gained advanced templating via templatePatch and + additional sprig functions (e.g., slugify). + - In 2.10.0, Argo CD added PostDelete hook support and improved UI capabilities + (e.g., status panel extensions, better prompts around pruning, recursive Helm + values file detection). + - In 2.10.0, security/SSO improvements included PKCE web login flow and optional + OIDC UserInfo group-claim retrieval, plus better security logging when access + is blocked. + breaking_changes: + - No explicit breaking changes are shown in the provided notes for 2.10.0 or + 2.10.7; treat this as 'none called out' rather than 'none exist' and still + follow the upstream upgrading guide when jumping minor versions (not applicable + here since it's a patch upgrade within 2.10). chart_version: 6.7.15 - images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', - 'quay.io/argoproj/argocd:v2.10.7'] + images: + - ghcr.io/dexidp/dex:v2.38.0 + - public.ecr.aws/docker/library/redis:7.2.4-alpine + - quay.io/argoproj/argocd:v2.10.7 eolAt: '2024-11-04' - version: 2.10.0 - kube: ['1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['No Helm chart changelog was provided in the notes you pasted - (these are Argo CD application release notes), so there are no chart-specific - template/RBAC/Service changes I can accurately call out from this input - alone.'] - features: ['Server-Side Diff: Argo CD can compute diffs using Kubernetes server-side - apply semantics, improving diff accuracy for SSA-managed fields.', 'PostDelete - hook support: adds a new hook type so you can run cleanup jobs after an - app is deleted.', 'Controller sync jitter: introduces jitter to reconciliation - timing to reduce thundering-herd behavior across many apps/controllers.', - 'UI status panel extensions: allows adding/using UI extensions in the application - status panel without modifying core UI.', 'OIDC UserInfo group claims (optional): - can query the OIDC UserInfo endpoint to populate group claims when they - are not present in the ID token.', "Kustomize Components support: supports\ - \ Kustomize \u201Ccomponents\u201D for more modular overlays.", 'Notifications - self-service: adds functionality enabling users to manage certain notifications - behavior via Argo CD.', 'Improved observability and networking options: - supports secured OTLP endpoints/headers for OpenTelemetry and adds support - for ALL_PROXY.'] - breaking_changes: ['Known issue (operationally impactful): Argo CD 2.10.0 has - a major issue with the application-controller when running in HA mode; upstream - indicates the fix is in 2.10.1, so upgrading straight to 2.10.0 in HA is - risky and may be effectively a breaking change for HA deployments.', "API\ - \ hardening change: content-type enforcement for API requests was introduced\ - \ (with an option to disable the check); clients/proxies that don\u2019\ - t set Content-Type correctly may start failing until adjusted."] + kube: + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart changelog was provided in the notes you pasted (these are Argo + CD application release notes), so there are no chart-specific template/RBAC/Service + changes I can accurately call out from this input alone. + features: + - 'Server-Side Diff: Argo CD can compute diffs using Kubernetes server-side + apply semantics, improving diff accuracy for SSA-managed fields.' + - 'PostDelete hook support: adds a new hook type so you can run cleanup jobs + after an app is deleted.' + - 'Controller sync jitter: introduces jitter to reconciliation timing to reduce + thundering-herd behavior across many apps/controllers.' + - 'UI status panel extensions: allows adding/using UI extensions in the application + status panel without modifying core UI.' + - 'OIDC UserInfo group claims (optional): can query the OIDC UserInfo endpoint + to populate group claims when they are not present in the ID token.' + - "Kustomize Components support: supports Kustomize \u201Ccomponents\u201D for\ + \ more modular overlays." + - 'Notifications self-service: adds functionality enabling users to manage certain + notifications behavior via Argo CD.' + - 'Improved observability and networking options: supports secured OTLP endpoints/headers + for OpenTelemetry and adds support for ALL_PROXY.' + breaking_changes: + - 'Known issue (operationally impactful): Argo CD 2.10.0 has a major issue with + the application-controller when running in HA mode; upstream indicates the + fix is in 2.10.1, so upgrading straight to 2.10.0 in HA is risky and may be + effectively a breaking change for HA deployments.' + - "API hardening change: content-type enforcement for API requests was introduced\ + \ (with an option to disable the check); clients/proxies that don\u2019t set\ + \ Content-Type correctly may start failing until adjusted." chart_version: 6.0.13 - images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.0.15-alpine', - 'quay.io/argoproj/argocd:v2.10.0'] + images: + - ghcr.io/dexidp/dex:v2.38.0 + - public.ecr.aws/docker/library/redis:7.0.15-alpine + - quay.io/argoproj/argocd:v2.10.0 eolAt: '2024-11-04' - version: 2.9.4 - kube: ['1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['No Helm chart changelog was provided in the notes you pasted, - so there are no chart-specific changes I can summarize from source data.'] - features: ['**v2.9.0** introduced a large set of new capabilities across Argo - CD and ApplicationSet, including PKCE auth flow for web logins, dynamic - cluster sharding/rebalancing (must be explicitly enabled), improved UI features - (e.g., recursive Helm values file detection), and multiple new/expanded - health checks for additional CRDs.', 'Operational/observability additions - in **v2.9.0** include more reconciliation timing metrics/log fields, additional - OpenTelemetry attributes support, and new knobs like `ARGOCD_CLUSTER_CACHE_LIST_PAGE_BUFFER_SIZE` - and GRPC keepalive configuration.'] - breaking_changes: ['**v2.9.4 includes a security fix (GHSA-92mw-q256-5vwg) that - introduces a breaking API change**; you must read the advisory and validate - any custom clients/integrations against the new API behavior before upgrading.', - '**v2.9.4 has a known issue causing major UI breakage** (many UI actions fail). - The upstream note says a fix will be available in 2.9.5, so consider skipping - 2.9.4 if the UI is critical.'] + kube: + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - No Helm chart changelog was provided in the notes you pasted, so there are + no chart-specific changes I can summarize from source data. + features: + - '**v2.9.0** introduced a large set of new capabilities across Argo CD and + ApplicationSet, including PKCE auth flow for web logins, dynamic cluster sharding/rebalancing + (must be explicitly enabled), improved UI features (e.g., recursive Helm values + file detection), and multiple new/expanded health checks for additional CRDs.' + - Operational/observability additions in **v2.9.0** include more reconciliation + timing metrics/log fields, additional OpenTelemetry attributes support, and + new knobs like `ARGOCD_CLUSTER_CACHE_LIST_PAGE_BUFFER_SIZE` and GRPC keepalive + configuration. + breaking_changes: + - '**v2.9.4 includes a security fix (GHSA-92mw-q256-5vwg) that introduces a + breaking API change**; you must read the advisory and validate any custom + clients/integrations against the new API behavior before upgrading.' + - '**v2.9.4 has a known issue causing major UI breakage** (many UI actions fail). + The upstream note says a fix will be available in 2.9.5, so consider skipping + 2.9.4 if the UI is critical.' chart_version: 5.53.1 - images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', - 'quay.io/argoproj/argocd:v2.9.4'] + images: + - ghcr.io/dexidp/dex:v2.37.0 + - public.ecr.aws/docker/library/redis:7.0.13-alpine + - quay.io/argoproj/argocd:v2.9.4 eolAt: '2024-08-05' - version: 2.9.0 - kube: ['1.28', '1.27', '1.26'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Upgrade Argo CD components from v2.8.4 to v2.9.0 (new container - images/manifests)., 'Redis image bumped to 7.0.14; various dependency bumps - (k8s/client-go, kustomize, helm, Go 1.21) that may change runtime behavior - and manifest generation edge cases.', Notifications engine upgraded (may - affect notification templates/triggers behavior)., 'Extensions: extension - configs can now be applied without restarting the API server (operational - behavior change).', ApplicationSet controller and generators received multiple - functional updates and bug fixes (behavior changes noted below).] - features: [PKCE authentication flow for web logins (OIDC) to improve security - and compatibility with providers requiring PKCE., 'ApplicationSet enhancements: - new template functions (fromYaml/fromYamlArray/toYaml), ignoreApplicationDifferences - support, label preservation options, and expanded SCM/webhook support (Azure - DevOps, GitLab improvements).', 'Git and repo behavior improvements: configurable - git requests and a grace period for repo errors to reduce flapping to Unknown - sync state.', Dynamic cluster sharding/rebalancing support to distribute - clusters across controller shards more evenly (must be explicitly enabled)., - 'UI/CLI improvements: Helm values files detected recursively; tree-view output - for several CLI commands; better log viewer (line wrap toggle).', 'Observability - improvements: new reconciliation timing fields in logs; extra OpenTelemetry - attributes support; new/extended metrics (e.g., autosync_enabled gauge).'] + kube: + - '1.28' + - '1.27' + - '1.26' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Upgrade Argo CD components from v2.8.4 to v2.9.0 (new container images/manifests). + - Redis image bumped to 7.0.14; various dependency bumps (k8s/client-go, kustomize, + helm, Go 1.21) that may change runtime behavior and manifest generation edge + cases. + - Notifications engine upgraded (may affect notification templates/triggers + behavior). + - 'Extensions: extension configs can now be applied without restarting the API + server (operational behavior change).' + - ApplicationSet controller and generators received multiple functional updates + and bug fixes (behavior changes noted below). + features: + - PKCE authentication flow for web logins (OIDC) to improve security and compatibility + with providers requiring PKCE. + - 'ApplicationSet enhancements: new template functions (fromYaml/fromYamlArray/toYaml), + ignoreApplicationDifferences support, label preservation options, and expanded + SCM/webhook support (Azure DevOps, GitLab improvements).' + - 'Git and repo behavior improvements: configurable git requests and a grace + period for repo errors to reduce flapping to Unknown sync state.' + - Dynamic cluster sharding/rebalancing support to distribute clusters across + controller shards more evenly (must be explicitly enabled). + - 'UI/CLI improvements: Helm values files detected recursively; tree-view output + for several CLI commands; better log viewer (line wrap toggle).' + - 'Observability improvements: new reconciliation timing fields in logs; extra + OpenTelemetry attributes support; new/extended metrics (e.g., autosync_enabled + gauge).' breaking_changes: [] chart_version: 5.51.1 - images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', - 'quay.io/argoproj/argocd:v2.9.0'] + images: + - ghcr.io/dexidp/dex:v2.37.0 + - public.ecr.aws/docker/library/redis:7.0.13-alpine + - quay.io/argoproj/argocd:v2.9.0 eolAt: '2024-08-05' - version: 2.8.4 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Includes several bugfixes in Argo CD 2.8.4: reverts ApplicationSet - application-name labels behavior; fixes handling of annotations for resources - with '':'' in the name; prevents ApplicationSet GoTemplate nil dereference - panics; stops appending '':443'' to server address when using grpc-web; - allows retrieving UI badges across namespaces; fixes GitLab SCM provider - transport creation; makes managed namespaces more resistant to being pruned; - expands the controller ClusterRole to permit cronjob and Argo Workflows - triggers.', Argo CD 2.8.3 (current) was a security patch release addressing - CVE-2023-40029 and CVE-2023-40584.] + features: + - 'Includes several bugfixes in Argo CD 2.8.4: reverts ApplicationSet application-name + labels behavior; fixes handling of annotations for resources with '':'' in + the name; prevents ApplicationSet GoTemplate nil dereference panics; stops + appending '':443'' to server address when using grpc-web; allows retrieving + UI badges across namespaces; fixes GitLab SCM provider transport creation; + makes managed namespaces more resistant to being pruned; expands the controller + ClusterRole to permit cronjob and Argo Workflows triggers.' + - Argo CD 2.8.3 (current) was a security patch release addressing CVE-2023-40029 + and CVE-2023-40584. breaking_changes: [] chart_version: 5.47.0 - images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', - 'quay.io/argoproj/argocd:v2.8.4'] + images: + - ghcr.io/dexidp/dex:v2.37.0 + - public.ecr.aws/docker/library/redis:7.0.13-alpine + - quay.io/argoproj/argocd:v2.8.4 eolAt: '2024-05-07' - version: 2.8.3 - kube: ['1.28', '1.27', '1.24'] + kube: + - '1.28' + - '1.27' + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 5.46.2 - images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.11-alpine', - 'quay.io/argoproj/argocd:v2.8.3'] + images: + - ghcr.io/dexidp/dex:v2.37.0 + - public.ecr.aws/docker/library/redis:7.0.11-alpine + - quay.io/argoproj/argocd:v2.8.3 eolAt: '2024-05-07' name: argo-cd - icon: https://avatars.githubusercontent.com/u/30269780?s=200&v=4 @@ -26007,283 +35163,396 @@ addons: chart_name: argo-workflows versions: - version: 4.1.2 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['MySQL persistence config now correctly applies driver-level options, - fixing previously ignored settings.', 'Several dependency bumps address - security fixes (fasthttp, cel-go, moby/go-archive).', 'Controller and sync-lock - behavior improved: better handling of UID changes, transient lock errors, - and shutdown/termination cases.', Server SSO session tokens now use symmetric - encryption., Artifact staging behavior corrected to re-enter workingDir - after init-less input staging., OpenTelemetry process owner detection is - skipped to avoid issues in some environments.] + features: + - MySQL persistence config now correctly applies driver-level options, fixing + previously ignored settings. + - Several dependency bumps address security fixes (fasthttp, cel-go, moby/go-archive). + - 'Controller and sync-lock behavior improved: better handling of UID changes, + transient lock errors, and shutdown/termination cases.' + - Server SSO session tokens now use symmetric encryption. + - Artifact staging behavior corrected to re-enter workingDir after init-less + input staging. + - OpenTelemetry process owner detection is skipped to avoid issues in some environments. breaking_changes: [] chart_version: 2.0.4 - images: ['quay.io/argoproj/argo-workflows-crdinstaller:v4.1.2', 'quay.io/argoproj/argocli:v4.1.2', - 'quay.io/argoproj/workflow-controller:v4.1.2'] + images: + - quay.io/argoproj/argo-workflows-crdinstaller:v4.1.2 + - quay.io/argoproj/argocli:v4.1.2 + - quay.io/argoproj/workflow-controller:v4.1.2 - version: 4.1.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided are generic \u201CQuick Start\u201D pages\ - \ and do not enumerate new features between v4.0.2 and v4.1.0.", 'v4.1.0 - adds a new quick-start manifest asset: `quick-start-telemetry.yaml` (indicates - telemetry quickstart support/docs were added).'] - breaking_changes: [No breaking changes are listed in the provided notes; they - refer readers to the upstream upgrading guide and changelog for breaking - changes/known issues.] + features: + - "Release notes provided are generic \u201CQuick Start\u201D pages and do not\ + \ enumerate new features between v4.0.2 and v4.1.0." + - 'v4.1.0 adds a new quick-start manifest asset: `quick-start-telemetry.yaml` + (indicates telemetry quickstart support/docs were added).' + breaking_changes: + - No breaking changes are listed in the provided notes; they refer readers to + the upstream upgrading guide and changelog for breaking changes/known issues. chart_version: 2.0.0 - images: ['quay.io/argoproj/argo-workflows-crdinstaller:v4.1.0', 'quay.io/argoproj/argocli:v4.1.0', - 'quay.io/argoproj/workflow-controller:v4.1.0'] + images: + - quay.io/argoproj/argo-workflows-crdinstaller:v4.1.0 + - quay.io/argoproj/argocli:v4.1.0 + - quay.io/argoproj/workflow-controller:v4.1.0 - version: 4.0.2 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v4.0.2 release notes provided here are a generic template (install - instructions/assets) and do not list specific new features; consult the - upstream changelog/blog for actual feature highlights between v3.7.0 and - v4.0.x.] - breaking_changes: [Breaking changes for the v4 major upgrade are not enumerated - in the provided notes; you must review the Argo Workflows upgrading guide - and CHANGELOG for v4.0.0+ before upgrading from v3.7.0.] + features: + - v4.0.2 release notes provided here are a generic template (install instructions/assets) + and do not list specific new features; consult the upstream changelog/blog + for actual feature highlights between v3.7.0 and v4.0.x. + breaking_changes: + - Breaking changes for the v4 major upgrade are not enumerated in the provided + notes; you must review the Argo Workflows upgrading guide and CHANGELOG for + v4.0.0+ before upgrading from v3.7.0. chart_version: 1.0.4 - images: ['quay.io/argoproj/argocli:v4.0.2', 'quay.io/argoproj/workflow-controller:v4.0.2', - 'registry.k8s.io/kubectl:v1.35.3'] + images: + - quay.io/argoproj/argocli:v4.0.2 + - quay.io/argoproj/workflow-controller:v4.0.2 + - registry.k8s.io/kubectl:v1.35.3 - version: 3.7.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release notes provided are generic and mostly cover installation/asset - links; no explicit new features listed for v3.7.0 vs v3.6.5 in the provided - text., 'CLI and controller/server install artifacts are updated to v3.7.0 - (new binaries, install.yaml).'] - breaking_changes: [No breaking changes are listed in the provided release notes; - you must consult the upstream changelog and the official upgrading guide - for v3.7.0 to identify any required manifest/CRD/API changes.] + features: + - Release notes provided are generic and mostly cover installation/asset links; + no explicit new features listed for v3.7.0 vs v3.6.5 in the provided text. + - CLI and controller/server install artifacts are updated to v3.7.0 (new binaries, + install.yaml). + breaking_changes: + - No breaking changes are listed in the provided release notes; you must consult + the upstream changelog and the official upgrading guide for v3.7.0 to identify + any required manifest/CRD/API changes. chart_version: 0.45.21 - images: ['quay.io/argoproj/argocli:v3.7.0', 'quay.io/argoproj/workflow-controller:v3.7.0'] + images: + - quay.io/argoproj/argocli:v3.7.0 + - quay.io/argoproj/workflow-controller:v3.7.0 - version: 3.6.5 - kube: ['1.31', '1.30', '1.29', '1.28'] + kube: + - '1.31' + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v3.6.5 is the recommended patch level versus v3.6.3 (which is explicitly - flagged as 'Do not use'; prefer v3.6.4 or later).] - breaking_changes: [v3.6.3 is marked as a known-bad release; treat upgrading - away from it as urgent and avoid deploying/rolling back to it.] + features: + - v3.6.5 is the recommended patch level versus v3.6.3 (which is explicitly flagged + as 'Do not use'; prefer v3.6.4 or later). + breaking_changes: + - v3.6.3 is marked as a known-bad release; treat upgrading away from it as urgent + and avoid deploying/rolling back to it. chart_version: 0.45.12 - images: ['quay.io/argoproj/argocli:v3.6.5', 'quay.io/argoproj/workflow-controller:v3.6.5'] + images: + - quay.io/argoproj/argocli:v3.6.5 + - quay.io/argoproj/workflow-controller:v3.6.5 - version: 3.6.3 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["No Helm chart changelog was provided in the notes you shared\ - \ (only upstream application GitHub release stubs for v3.6.0 and v3.6.3).\ - \ Treat this as an app version bump only; verify the chart version mapping\ - \ and read the chart\u2019s own CHANGELOG/values schema before upgrading.", - "Upstream release v3.6.3 is explicitly flagged: \u201CDo not use this version,\ - \ use v3.6.4 instead.\u201D Plan to skip 3.6.3 and target 3.6.4 (or later\ - \ 3.6.x) to avoid whatever issue prompted the warning.", 'Install manifests - (install.yaml) exist for both versions and are similar in size; no concrete - functional deltas are listed in the provided notes. Expect mostly patch-level - fixes between 3.6.0 and 3.6.3, but you must consult the detailed changelog/upgrading - guide for specifics.'] - features: [No specific new features were listed in the provided release notes - excerpts for v3.6.0 or v3.6.3 (they point to the blog/changelog instead).] - breaking_changes: ['No breaking changes were enumerated in the provided excerpts; - however, v3.6.3 has a known issue severe enough that upstream recommends - not using it (use v3.6.4 instead).'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "No Helm chart changelog was provided in the notes you shared (only upstream\ + \ application GitHub release stubs for v3.6.0 and v3.6.3). Treat this as an\ + \ app version bump only; verify the chart version mapping and read the chart\u2019\ + s own CHANGELOG/values schema before upgrading." + - "Upstream release v3.6.3 is explicitly flagged: \u201CDo not use this version,\ + \ use v3.6.4 instead.\u201D Plan to skip 3.6.3 and target 3.6.4 (or later\ + \ 3.6.x) to avoid whatever issue prompted the warning." + - Install manifests (install.yaml) exist for both versions and are similar in + size; no concrete functional deltas are listed in the provided notes. Expect + mostly patch-level fixes between 3.6.0 and 3.6.3, but you must consult the + detailed changelog/upgrading guide for specifics. + features: + - No specific new features were listed in the provided release notes excerpts + for v3.6.0 or v3.6.3 (they point to the blog/changelog instead). + breaking_changes: + - No breaking changes were enumerated in the provided excerpts; however, v3.6.3 + has a known issue severe enough that upstream recommends not using it (use + v3.6.4 instead). chart_version: 0.45.5 - images: ['quay.io/argoproj/argocli:v3.6.3', 'quay.io/argoproj/workflow-controller:v3.6.3'] + images: + - quay.io/argoproj/argocli:v3.6.3 + - quay.io/argoproj/workflow-controller:v3.6.3 - version: 3.6.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['The provided release notes for v3.6.0 vs v3.5.11 do not include - a detailed changelog; they mainly cover installation and assets, so no concrete - feature list can be derived from this text alone.'] - breaking_changes: [No explicit breaking changes are listed in the provided notes; - the release notes only point to the upgrading guide and main changelog for - details.] + features: + - The provided release notes for v3.6.0 vs v3.5.11 do not include a detailed + changelog; they mainly cover installation and assets, so no concrete feature + list can be derived from this text alone. + breaking_changes: + - No explicit breaking changes are listed in the provided notes; the release + notes only point to the upgrading guide and main changelog for details. chart_version: 0.45.0 - images: ['quay.io/argoproj/argocli:v3.6.0', 'quay.io/argoproj/workflow-controller:v3.6.0'] + images: + - quay.io/argoproj/argocli:v3.6.0 + - quay.io/argoproj/workflow-controller:v3.6.0 - version: 3.5.11 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional changes are listed in the provided release note excerpts; - both pages primarily contain installation instructions and links to the - full changelog/upgrading guide.] - breaking_changes: [No breaking changes are listed in the provided release note - excerpts; you must consult the Argo Workflows 3.5 upgrading guide and the - project CHANGELOG for any breaking changes between v3.5.6 and v3.5.11.] + features: + - No functional changes are listed in the provided release note excerpts; both + pages primarily contain installation instructions and links to the full changelog/upgrading + guide. + breaking_changes: + - No breaking changes are listed in the provided release note excerpts; you + must consult the Argo Workflows 3.5 upgrading guide and the project CHANGELOG + for any breaking changes between v3.5.6 and v3.5.11. chart_version: 0.42.5 - images: ['quay.io/argoproj/argocli:v3.5.11', 'quay.io/argoproj/workflow-controller:v3.5.11'] + images: + - quay.io/argoproj/argocli:v3.5.11 + - quay.io/argoproj/workflow-controller:v3.5.11 - version: 3.5.6 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided are generic (installation instructions, links)\ - \ and do not enumerate specific v3.5.4\u2013v3.5.6 features/fixes; treat\ - \ this as a patch-level upgrade within 3.5.x with expected bugfixes/security\ - \ updates.", Newer CLI/server/controller artifacts are available at v3.5.6; - ensure any pinned CLI downloads and image tags are updated accordingly.] - breaking_changes: ["No breaking changes are called out in the provided release\ - \ notes; however, you should still review the Argo Workflows 3.5 upgrading\ - \ guide and the upstream CHANGELOG for 3.5.4\u20133.5.6 to confirm there\ - \ are no behavior changes affecting your workflows."] + features: + - "Release notes provided are generic (installation instructions, links) and\ + \ do not enumerate specific v3.5.4\u2013v3.5.6 features/fixes; treat this\ + \ as a patch-level upgrade within 3.5.x with expected bugfixes/security updates." + - Newer CLI/server/controller artifacts are available at v3.5.6; ensure any + pinned CLI downloads and image tags are updated accordingly. + breaking_changes: + - "No breaking changes are called out in the provided release notes; however,\ + \ you should still review the Argo Workflows 3.5 upgrading guide and the upstream\ + \ CHANGELOG for 3.5.4\u20133.5.6 to confirm there are no behavior changes\ + \ affecting your workflows." chart_version: 0.41.6 - images: ['quay.io/argoproj/argocli:v3.5.6', 'quay.io/argoproj/workflow-controller:v3.5.6'] + images: + - quay.io/argoproj/argocli:v3.5.6 + - quay.io/argoproj/workflow-controller:v3.5.6 - version: 3.5.3 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No clear feature list provided in the pasted notes; v3.5.3 notes - shown are generic pointers to blog/changelog/upgrading guide and install - instructions., "Upgrade primarily appears to be a patch release (3.5.0 \u2192\ - \ 3.5.3) with unspecified fixes; consult upstream CHANGELOG for concrete\ - \ items."] - breaking_changes: [None called out in the provided v3.5.3 release snippet; treat - as low-risk but still verify against the 3.5 upgrading guide and CHANGELOG - for any late-breaking notes.] + features: + - No clear feature list provided in the pasted notes; v3.5.3 notes shown are + generic pointers to blog/changelog/upgrading guide and install instructions. + - "Upgrade primarily appears to be a patch release (3.5.0 \u2192 3.5.3) with\ + \ unspecified fixes; consult upstream CHANGELOG for concrete items." + breaking_changes: + - None called out in the provided v3.5.3 release snippet; treat as low-risk + but still verify against the 3.5 upgrading guide and CHANGELOG for any late-breaking + notes. chart_version: 0.40.5 - images: ['quay.io/argoproj/argocli:v3.5.3', 'quay.io/argoproj/workflow-controller:v3.5.3'] + images: + - quay.io/argoproj/argocli:v3.5.3 + - quay.io/argoproj/workflow-controller:v3.5.3 - version: 3.5.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v3.5.0 release notes provided here mostly link out to a 'What's New' - blog and changelog; no concrete feature list is included in the snippet - you provided.] - breaking_changes: ['No breaking changes are listed in the provided release-note - snippets; they point to the upgrading guide/installation guide for details, - so you must review that guide for 3.5.0-specific breaking changes before - upgrading.'] + features: + - v3.5.0 release notes provided here mostly link out to a 'What's New' blog + and changelog; no concrete feature list is included in the snippet you provided. + breaking_changes: + - No breaking changes are listed in the provided release-note snippets; they + point to the upgrading guide/installation guide for details, so you must review + that guide for 3.5.0-specific breaking changes before upgrading. chart_version: 0.37.1 - images: ['quay.io/argoproj/argocli:v3.5.0', 'quay.io/argoproj/workflow-controller:v3.5.0'] + images: + - quay.io/argoproj/argocli:v3.5.0 + - quay.io/argoproj/workflow-controller:v3.5.0 - version: 3.4.11 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Patch-level update within the v3.4.x line; release notes provided - here do not enumerate specific feature changes between v3.4.0 and v3.4.11., - Update includes newer controller/server images and a newer CLI binary matching - v3.4.11.] - breaking_changes: [No breaking changes are listed in the provided notes; you - should still review the official Argo Workflows upgrading guide for any - v3.4.x-specific caveats.] + features: + - Patch-level update within the v3.4.x line; release notes provided here do + not enumerate specific feature changes between v3.4.0 and v3.4.11. + - Update includes newer controller/server images and a newer CLI binary matching + v3.4.11. + breaking_changes: + - No breaking changes are listed in the provided notes; you should still review + the official Argo Workflows upgrading guide for any v3.4.x-specific caveats. chart_version: 0.34.0 - images: ['quay.io/argoproj/argocli:v3.4.11', 'quay.io/argoproj/workflow-controller:v3.4.11'] + images: + - quay.io/argoproj/argocli:v3.4.11 + - quay.io/argoproj/workflow-controller:v3.4.11 - version: 3.4.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v3.4.0 is a minor version bump over v3.3.2; the provided release - notes do not include a detailed feature list beyond pointing to the upstream - changelog/blog., 'New platform binaries/assets are published for v3.4.0 - (including darwin arm64), but this is primarily operational packaging info - rather than a runtime feature.'] - breaking_changes: ['No breaking changes are enumerated in the provided notes; - they are referenced as being documented in the installation guide/upgrading - docs, so you should review those before upgrading.'] + features: + - v3.4.0 is a minor version bump over v3.3.2; the provided release notes do + not include a detailed feature list beyond pointing to the upstream changelog/blog. + - New platform binaries/assets are published for v3.4.0 (including darwin arm64), + but this is primarily operational packaging info rather than a runtime feature. + breaking_changes: + - No breaking changes are enumerated in the provided notes; they are referenced + as being documented in the installation guide/upgrading docs, so you should + review those before upgrading. chart_version: 0.20.0 - images: ['quay.io/argoproj/argocli:v3.4.0', 'quay.io/argoproj/workflow-controller:v3.4.0'] + images: + - quay.io/argoproj/argocli:v3.4.0 + - quay.io/argoproj/workflow-controller:v3.4.0 - version: 3.3.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release notes provided are primarily quick-start/installation instructions - for v3.2.0 and v3.3.2; no concrete feature list is included in the pasted - notes. Consult the Argo Workflows CHANGELOG.md between v3.2.0 and v3.3.2 - for actual feature additions., 'v3.3.2 adds an SBOM asset (sbom.tar.gz) - to release artifacts, which may help with supply-chain/security auditing.'] - breaking_changes: [No breaking changes are listed in the pasted release notes. - You must review docs/upgrading.md and the CHANGELOG.md between v3.2.0 and - v3.3.2 for any behavioral or API changes before upgrading.] + features: + - Release notes provided are primarily quick-start/installation instructions + for v3.2.0 and v3.3.2; no concrete feature list is included in the pasted + notes. Consult the Argo Workflows CHANGELOG.md between v3.2.0 and v3.3.2 for + actual feature additions. + - v3.3.2 adds an SBOM asset (sbom.tar.gz) to release artifacts, which may help + with supply-chain/security auditing. + breaking_changes: + - No breaking changes are listed in the pasted release notes. You must review + docs/upgrading.md and the CHANGELOG.md between v3.2.0 and v3.3.2 for any behavioral + or API changes before upgrading. chart_version: 0.15.1 - images: ['quay.io/argoproj/argocli:v3.3.2', 'quay.io/argoproj/workflow-controller:v3.3.2'] + images: + - quay.io/argoproj/argocli:v3.3.2 + - quay.io/argoproj/workflow-controller:v3.3.2 - version: 3.2.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details are included in the provided v3.2.0 release notes - excerpt beyond links to the blog/CHANGELOG; treat this as a routine minor - upgrade pending review of the full CHANGELOG.] - breaking_changes: ["No breaking changes are listed in the provided notes; however,\ - \ v3.2.0 points to the upstream upgrading guide\u2014review it for any required\ - \ manifest/CRD changes before applying the new install.yaml/Helm chart."] + features: + - No feature details are included in the provided v3.2.0 release notes excerpt + beyond links to the blog/CHANGELOG; treat this as a routine minor upgrade + pending review of the full CHANGELOG. + breaking_changes: + - "No breaking changes are listed in the provided notes; however, v3.2.0 points\ + \ to the upstream upgrading guide\u2014review it for any required manifest/CRD\ + \ changes before applying the new install.yaml/Helm chart." chart_version: 0.8.2 - images: ['quay.io/argoproj/argocli:v3.2.0', 'quay.io/argoproj/workflow-controller:v3.2.0'] + images: + - quay.io/argoproj/argocli:v3.2.0 + - quay.io/argoproj/workflow-controller:v3.2.0 - version: 3.1.5 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["v3.1.5 release notes provided don\u2019t list specific new features\ - \ beyond standard installation/CLI download instructions.", 'v3.0.7 introduced - controller probes/health improvements (liveness probe; readiness timeout - increased to 30s; metrics/debug listen on :6060) and several UI/controller - bug fixes.'] - breaking_changes: ['v3.0.7: Argo Server enables TLS by default when a key is - available; can be disabled with `--secure=false`. Ingress may need backend-protocol - annotations set to HTTPS.', 'Known issues noted in v3.0.7: UI may try to - list workflows across namespaces; OpenShift may not support coordination - API needed for leader election; log archiving reported broken.'] + features: + - "v3.1.5 release notes provided don\u2019t list specific new features beyond\ + \ standard installation/CLI download instructions." + - v3.0.7 introduced controller probes/health improvements (liveness probe; readiness + timeout increased to 30s; metrics/debug listen on :6060) and several UI/controller + bug fixes. + breaking_changes: + - 'v3.0.7: Argo Server enables TLS by default when a key is available; can be + disabled with `--secure=false`. Ingress may need backend-protocol annotations + set to HTTPS.' + - 'Known issues noted in v3.0.7: UI may try to list workflows across namespaces; + OpenShift may not support coordination API needed for leader election; log + archiving reported broken.' chart_version: 0.4.1 - images: ['quay.io/argoproj/argocli:v3.1.5', 'quay.io/argoproj/workflow-controller:v3.1.5'] + images: + - quay.io/argoproj/argocli:v3.1.5 + - quay.io/argoproj/workflow-controller:v3.1.5 - version: 3.0.7 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 0.3.0 - images: ['quay.io/argoproj/argocli:v3.0.7', 'quay.io/argoproj/workflow-controller:v3.0.7'] + images: + - quay.io/argoproj/argocli:v3.0.7 + - quay.io/argoproj/workflow-controller:v3.0.7 name: argo-workflows - icon: https://avatars.githubusercontent.com/u/16866914 git_url: https://github.com/vectordotdev/vector/ @@ -26291,735 +35560,1013 @@ addons: helm_repository_url: https://helm.vector.dev/ versions: - version: 0.58.0 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Vector 0.58.0 is a new upstream release (published 2026-08-26) following - 0.57.0 (published 2026-07-14)., No concrete feature details are present - in the provided notes beyond links to full release notes.] - breaking_changes: ['0.57.0 is described as a security-focused release that includes - breaking changes, with options to restore previous behavior (details not - included in the excerpt).', No breaking-change details for 0.58.0 are included - in the provided excerpt; verify via the linked 0.58.0 release notes before - upgrading.] + features: + - Vector 0.58.0 is a new upstream release (published 2026-08-26) following 0.57.0 + (published 2026-07-14). + - No concrete feature details are present in the provided notes beyond links + to full release notes. + breaking_changes: + - 0.57.0 is described as a security-focused release that includes breaking changes, + with options to restore previous behavior (details not included in the excerpt). + - No breaking-change details for 0.58.0 are included in the provided excerpt; + verify via the linked 0.58.0 release notes before upgrading. chart_version: 0.58.0 - images: ['docker.io/timberio/vector:0.58.0-distroless-libc'] + images: + - docker.io/timberio/vector:0.58.0-distroless-libc - version: 0.57.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v0.57.0 is described as a security-focused release with changes intended - to improve security posture., The release notes indicate there are opt-in/compatibility - mechanisms to restore previous behavior after the security changes.] - breaking_changes: [v0.57.0 includes breaking changes related to the security-focused - updates; users may need to adjust configuration to preserve prior behavior - (exact items not provided in the excerpt).] + features: + - v0.57.0 is described as a security-focused release with changes intended to + improve security posture. + - The release notes indicate there are opt-in/compatibility mechanisms to restore + previous behavior after the security changes. + breaking_changes: + - v0.57.0 includes breaking changes related to the security-focused updates; + users may need to adjust configuration to preserve prior behavior (exact items + not provided in the excerpt). chart_version: 0.57.0 - images: ['docker.io/timberio/vector:0.57.0-distroless-libc'] + images: + - docker.io/timberio/vector:0.57.0-distroless-libc - version: 0.56.0 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['New `databricks_zerobus` sink for streaming logs into Databricks - Unity Catalog via Zerobus, including OAuth2 auth, schema fetching, and protobuf - batching.', New `delay` transform to hold events for a fixed duration or - conditionally (including VRL-based conditions)., HTTP-based sinks using - shared retry helpers now support a `retry_strategy` option to choose which - HTTP status codes should be retried (with an updated `http` sink example)., - '`vector` sink adds `zstd` compression alongside `gzip` for improved Vector-to-Vector - throughput and efficiency.', 'Major enhancements to `tag_cardinality_limit`: - per-tag limits, per-metric tracking isolation, global tracked-key cap, and - ability to opt metrics out of tracking.', '`aws_s3` sink Parquet encoding - now ships enabled in official binaries by default (no special build required).', - 'Fixes a CPU regression affecting sinks that use metric normalization (e.g., - `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`).', Restores - install support for RHEL/Rocky/Alma/CentOS Stream 8 that was broken in 0.55.0 - due to a glibc requirement bump., Unit tests gain optional `expected_event_count` - on outputs to assert how many events a transform emits.] - breaking_changes: ['`greptimedb_metrics` and `greptimedb_logs` sinks now require - GreptimeDB v1.x; GreptimeDB v0.x users must upgrade GreptimeDB before upgrading - Vector.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - New `databricks_zerobus` sink for streaming logs into Databricks Unity Catalog + via Zerobus, including OAuth2 auth, schema fetching, and protobuf batching. + - New `delay` transform to hold events for a fixed duration or conditionally + (including VRL-based conditions). + - HTTP-based sinks using shared retry helpers now support a `retry_strategy` + option to choose which HTTP status codes should be retried (with an updated + `http` sink example). + - '`vector` sink adds `zstd` compression alongside `gzip` for improved Vector-to-Vector + throughput and efficiency.' + - 'Major enhancements to `tag_cardinality_limit`: per-tag limits, per-metric + tracking isolation, global tracked-key cap, and ability to opt metrics out + of tracking.' + - '`aws_s3` sink Parquet encoding now ships enabled in official binaries by + default (no special build required).' + - Fixes a CPU regression affecting sinks that use metric normalization (e.g., + `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`). + - Restores install support for RHEL/Rocky/Alma/CentOS Stream 8 that was broken + in 0.55.0 due to a glibc requirement bump. + - Unit tests gain optional `expected_event_count` on outputs to assert how many + events a transform emits. + breaking_changes: + - '`greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x; + GreptimeDB v0.x users must upgrade GreptimeDB before upgrading Vector.' chart_version: 0.56.0 - images: ['docker.io/timberio/vector:0.56.0-distroless-libc'] + images: + - docker.io/timberio/vector:0.56.0-distroless-libc - version: 0.55.0 - kube: ['1.36', '1.35', '1.34'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['New `windows_event_log` source for collecting Windows Event Log - channels via the native Windows Event Log API, including pull-mode subscriptions, - bookmark-based checkpointing, and configurable field filtering.', '`aws_s3` - sink supports Apache Parquet batch encoding, with auto-generated or supplied - schema and configurable compression (Snappy/ZSTD/GZIP/LZ4/none).', '`azure_blob` - sink restores first-class Azure authentication support (Azure CLI, Managed - Identity, Workload Identity, and Managed Identity-based Client Assertion).', - '`datadog_metrics` sink defaults to Series v2 endpoint (`/api/v2/series`) - and uses `zstd` compression for Series v2 and Sketches; includes `series_api_version` - option to switch back to v1.', '`vector top` output accounting is corrected - for multi-output components and it now reports Memory Used as disabled when - allocation tracing is not enabled.', 'Improved internal metrics: new source-send - latency distributions, more accurate transform utilization (excludes downstream - waiting), and fixes to buffer utilization tracking; also fixes CPU regression - in `file` and `kubernetes_logs` sources introduced in 0.50.0.'] - breaking_changes: [Observability API has moved from GraphQL to gRPC; clients - and tooling that used `/graphql` or `/playground` (including `vector top`/`vector - tap` integrations) must be updated. `GET /health` is unchanged for Kubernetes - probes., Top-level `headers` option on `http` and `opentelemetry` sinks - has been removed; configurations must be adjusted accordingly., '`azure_logs_ingestion` - sink using Client Secret credentials now requires explicitly setting `azure_credential_kind`.'] + kube: + - '1.36' + - '1.35' + - '1.34' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - New `windows_event_log` source for collecting Windows Event Log channels via + the native Windows Event Log API, including pull-mode subscriptions, bookmark-based + checkpointing, and configurable field filtering. + - '`aws_s3` sink supports Apache Parquet batch encoding, with auto-generated + or supplied schema and configurable compression (Snappy/ZSTD/GZIP/LZ4/none).' + - '`azure_blob` sink restores first-class Azure authentication support (Azure + CLI, Managed Identity, Workload Identity, and Managed Identity-based Client + Assertion).' + - '`datadog_metrics` sink defaults to Series v2 endpoint (`/api/v2/series`) + and uses `zstd` compression for Series v2 and Sketches; includes `series_api_version` + option to switch back to v1.' + - '`vector top` output accounting is corrected for multi-output components and + it now reports Memory Used as disabled when allocation tracing is not enabled.' + - 'Improved internal metrics: new source-send latency distributions, more accurate + transform utilization (excludes downstream waiting), and fixes to buffer utilization + tracking; also fixes CPU regression in `file` and `kubernetes_logs` sources + introduced in 0.50.0.' + breaking_changes: + - Observability API has moved from GraphQL to gRPC; clients and tooling that + used `/graphql` or `/playground` (including `vector top`/`vector tap` integrations) + must be updated. `GET /health` is unchanged for Kubernetes probes. + - Top-level `headers` option on `http` and `opentelemetry` sinks has been removed; + configurations must be adjusted accordingly. + - '`azure_logs_ingestion` sink using Client Secret credentials now requires + explicitly setting `azure_credential_kind`.' chart_version: 0.52.0 - images: ['docker.io/timberio/vector:0.55.0-distroless-libc'] + images: + - docker.io/timberio/vector:0.55.0-distroless-libc - version: 0.54.0 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Enhanced `vector top` TUI with keybinds for scrolling, sorting, - and filtering (press `?` for help).', '`datadog_logs` sink now uses `zstd` - compression by default, improving network efficiency and throughput.', 'New - internal metrics: `component_latency_seconds` histogram and `component_latency_mean_seconds` - gauge to measure time events spend inside each component.', 'Syslog encoding - transform got RFC-compliance and safety improvements, including better handling - of structured data (scalars/nested objects/arrays) and UTF-8 safety.', New - `azure_logs_ingestion` sink for Azure Monitor Logs Ingestion API; legacy - `azure_monitor_logs` sink is deprecated ahead of the Data Collector API - retirement (currently Sept 2026).] - breaking_changes: ['`datadog_logs` sink default compression changed from none - to `zstd`; set `compression` explicitly if you need the previous behavior - (e.g., `none`).'] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Enhanced `vector top` TUI with keybinds for scrolling, sorting, and filtering + (press `?` for help). + - '`datadog_logs` sink now uses `zstd` compression by default, improving network + efficiency and throughput.' + - 'New internal metrics: `component_latency_seconds` histogram and `component_latency_mean_seconds` + gauge to measure time events spend inside each component.' + - Syslog encoding transform got RFC-compliance and safety improvements, including + better handling of structured data (scalars/nested objects/arrays) and UTF-8 + safety. + - New `azure_logs_ingestion` sink for Azure Monitor Logs Ingestion API; legacy + `azure_monitor_logs` sink is deprecated ahead of the Data Collector API retirement + (currently Sept 2026). + breaking_changes: + - '`datadog_logs` sink default compression changed from none to `zstd`; set + `compression` explicitly if you need the previous behavior (e.g., `none`).' chart_version: 0.51.0 - images: ['docker.io/timberio/vector:0.54.0-distroless-libc'] + images: + - docker.io/timberio/vector:0.54.0-distroless-libc - version: 0.53.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['VRL gained functions to read internal Vector metrics (`get_vector_metric`, - `find_vector_metrics`, `aggregate_vector_metrics`), backed by snapshots - refreshed every `metrics_storage_refresh_period`.', '`clickhouse` sink added - an `arrow_stream` format option using Apache Arrow IPC for higher throughput - and smaller payloads than JSON.', New `doris` sink added to ship log data - to Apache Doris via the Stream Load API., New `syslog` codec added for encoding - events as Syslog; supports RFC5424 and RFC3164., 'New moving-mean (EWMA) - gauges for buffer utilization added: `source_buffer_utilization_mean` and - `transform_buffer_utilization_mean`, complementing the existing instant - utilization metrics.'] + features: + - VRL gained functions to read internal Vector metrics (`get_vector_metric`, + `find_vector_metrics`, `aggregate_vector_metrics`), backed by snapshots refreshed + every `metrics_storage_refresh_period`. + - '`clickhouse` sink added an `arrow_stream` format option using Apache Arrow + IPC for higher throughput and smaller payloads than JSON.' + - New `doris` sink added to ship log data to Apache Doris via the Stream Load + API. + - New `syslog` codec added for encoding events as Syslog; supports RFC5424 and + RFC3164. + - 'New moving-mean (EWMA) gauges for buffer utilization added: `source_buffer_utilization_mean` + and `transform_buffer_utilization_mean`, complementing the existing instant + utilization metrics.' breaking_changes: [] chart_version: 0.50.0 - images: ['timberio/vector:0.53.0-distroless-libc'] + images: + - timberio/vector:0.53.0-distroless-libc - version: 0.52.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Added new internal metrics for source/transform buffer utilization - (capacity, usage, and historical levels) to improve observability during - backpressure/buffering scenarios.', Introduced a new `trace_to_log` transform - to convert traces into log events., 'Blackhole sink now supports end-to-end - acknowledgements, enabling ack-based delivery semantics even when discarding - output.', 'GELF decoder gained a `validation` mode (`strict` default, `relaxed` - to accept non-compliant GELF senders).', '`docker_logs` source now retries - Docker daemon communication failures using exponential backoff, improving - resilience.'] + features: + - Added new internal metrics for source/transform buffer utilization (capacity, + usage, and historical levels) to improve observability during backpressure/buffering + scenarios. + - Introduced a new `trace_to_log` transform to convert traces into log events. + - Blackhole sink now supports end-to-end acknowledgements, enabling ack-based + delivery semantics even when discarding output. + - GELF decoder gained a `validation` mode (`strict` default, `relaxed` to accept + non-compliant GELF senders). + - '`docker_logs` source now retries Docker daemon communication failures using + exponential backoff, improving resilience.' breaking_changes: [] chart_version: 0.49.0 - images: ['timberio/vector:0.52.0-distroless-libc'] + images: + - timberio/vector:0.52.0-distroless-libc - version: 0.51.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['New `otlp` codec for bidirectional conversion between Vector events - and OTLP, improving interoperability with OpenTelemetry collectors/instrumentation.', - 'Improved internal telemetry/metrics correctness: fixes negative utilization - metrics and buffer counter underflows.', Memory enrichment tables now support - an `expired` output to export expired cache items; enrichment table outputs - are also visible via `vector tap`., "(From 0.50.0 context) The `opentelemetry`\ - \ source can decode standard OTLP for logs/metrics/traces, simplifying OTEL\u2192\ - Vector\u2192OTEL pipelines."] - breaking_changes: ['Upstream release notes for 0.51.0 mention breaking changes - exist, but the provided excerpt does not list them; review the full changelog - before upgrading.', "Note from 0.50.0: `azure_blob` sink now requires `connection_string`\ - \ authentication (relevant if you\u2019re coming from <0.50.0).", 0.51.0 - was superseded and maintainers recommend upgrading to 0.51.1 instead of - 0.51.0.] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - New `otlp` codec for bidirectional conversion between Vector events and OTLP, + improving interoperability with OpenTelemetry collectors/instrumentation. + - 'Improved internal telemetry/metrics correctness: fixes negative utilization + metrics and buffer counter underflows.' + - Memory enrichment tables now support an `expired` output to export expired + cache items; enrichment table outputs are also visible via `vector tap`. + - "(From 0.50.0 context) The `opentelemetry` source can decode standard OTLP\ + \ for logs/metrics/traces, simplifying OTEL\u2192Vector\u2192OTEL pipelines." + breaking_changes: + - Upstream release notes for 0.51.0 mention breaking changes exist, but the + provided excerpt does not list them; review the full changelog before upgrading. + - "Note from 0.50.0: `azure_blob` sink now requires `connection_string` authentication\ + \ (relevant if you\u2019re coming from <0.50.0)." + - 0.51.0 was superseded and maintainers recommend upgrading to 0.51.1 instead + of 0.51.0. chart_version: 0.47.0 - images: ['timberio/vector:0.51.0-distroless-libc'] + images: + - timberio/vector:0.51.0-distroless-libc - version: 0.50.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ["OpenTelemetry source can now decode standard OTLP for logs, metrics,\ - \ and traces, reducing the need for remap transforms in OTEL\u2192Vector\u2192\ - OTEL or forwarding pipelines.", Added `varint_length_delimited` framing - for compatibility with protobuf streaming tools/implementations such as - ClickHouse., 'New `incremental_to_absolute` transform to convert incremental - metrics into absolute values, helpful when data loss is possible or for - historical recording.', New `okta` source to ingest Okta System Log events - via the Okta Management API., Exec secrets option now supports protocol - version v1.1 (compatible with Datadog Secret Backend).] - breaking_changes: ['`azure_blob` sink authentication changed: it now requires - `connection_string` and this is currently the only supported auth method; - existing configs using other auth options must be updated.'] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - "OpenTelemetry source can now decode standard OTLP for logs, metrics, and\ + \ traces, reducing the need for remap transforms in OTEL\u2192Vector\u2192\ + OTEL or forwarding pipelines." + - Added `varint_length_delimited` framing for compatibility with protobuf streaming + tools/implementations such as ClickHouse. + - New `incremental_to_absolute` transform to convert incremental metrics into + absolute values, helpful when data loss is possible or for historical recording. + - New `okta` source to ingest Okta System Log events via the Okta Management + API. + - Exec secrets option now supports protocol version v1.1 (compatible with Datadog + Secret Backend). + breaking_changes: + - '`azure_blob` sink authentication changed: it now requires `connection_string` + and this is currently the only supported auth method; existing configs using + other auth options must be updated.' chart_version: 0.46.0 - images: ['timberio/vector:0.50.0-distroless-libc'] + images: + - timberio/vector:0.50.0-distroless-libc - version: 0.49.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Introduced a new `websocket` source to ingest real-time data from - services exposing WebSocket APIs., 'HTTP sink now supports templating in - `uri` and `request.headers`, enabling dynamic request construction based - on event data.', '`--watch-config` now also watches enrichment table files - for changes and reload triggers.', '`prometheus_remote_write` sink adds - a TTL-based cache for metrics sets plus an `expire_metrics_secs` option - to prevent unbounded memory growth.', Fixed a race condition that could - cause negative values in `vector_buffer_byte_size` and `vector_buffer_events` - gauges.] - breaking_changes: [Some VRL functions have breaking changes in v0.49.0; review - and test VRL transforms/conditions against the 0.49.0 upgrade guide before - deploying.] + features: + - Introduced a new `websocket` source to ingest real-time data from services + exposing WebSocket APIs. + - HTTP sink now supports templating in `uri` and `request.headers`, enabling + dynamic request construction based on event data. + - '`--watch-config` now also watches enrichment table files for changes and + reload triggers.' + - '`prometheus_remote_write` sink adds a TTL-based cache for metrics sets plus + an `expire_metrics_secs` option to prevent unbounded memory growth.' + - Fixed a race condition that could cause negative values in `vector_buffer_byte_size` + and `vector_buffer_events` gauges. + breaking_changes: + - Some VRL functions have breaking changes in v0.49.0; review and test VRL transforms/conditions + against the 0.49.0 upgrade guide before deploying. chart_version: 0.45.0 - images: ['timberio/vector:0.49.0-distroless-libc'] + images: + - timberio/vector:0.49.0-distroless-libc - version: 0.48.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Release notes provided only include metadata and asset lists; no\ - \ feature list was included for v0.48.0 beyond what\u2019s on the linked\ - \ page.", 'Based on the provided text, there are no described new features - between v0.47.0 and v0.48.0 (features likely exist in the linked release - notes).'] - breaking_changes: [No breaking changes are mentioned in the provided release-note - excerpts; check the full v0.48.0 release notes link for any config/behavior - changes before upgrading.] + features: + - "Release notes provided only include metadata and asset lists; no feature\ + \ list was included for v0.48.0 beyond what\u2019s on the linked page." + - Based on the provided text, there are no described new features between v0.47.0 + and v0.48.0 (features likely exist in the linked release notes). + breaking_changes: + - No breaking changes are mentioned in the provided release-note excerpts; check + the full v0.48.0 release notes link for any config/behavior changes before + upgrading. chart_version: 0.44.0 - images: ['timberio/vector:0.48.0-distroless-libc'] + images: + - timberio/vector:0.48.0-distroless-libc - version: 0.47.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were included in the provided 0.47.0 notes beyond - the existence of new build artifacts., Release primarily indicates a version - bump from 0.46.0 to 0.47.0 with updated binaries/packages for multiple platforms.] - breaking_changes: [No breaking-change information was included in the provided - release notes excerpt (only metadata and asset lists).] + features: + - No feature details were included in the provided 0.47.0 notes beyond the existence + of new build artifacts. + - Release primarily indicates a version bump from 0.46.0 to 0.47.0 with updated + binaries/packages for multiple platforms. + breaking_changes: + - No breaking-change information was included in the provided release notes + excerpt (only metadata and asset lists). chart_version: 0.43.0 - images: ['timberio/vector:0.47.0-distroless-libc'] + images: + - timberio/vector:0.47.0-distroless-libc - version: 0.46.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were included in the provided release notes excerpt - beyond the fact this is v0.46.0 (the excerpt only lists assets/metadata).] - breaking_changes: [No breaking changes were listed in the provided release notes - excerpt; must review the actual v0.46.0 and v0.45.0 release pages/changelog - for breaking/config changes before upgrading.] + features: + - No feature details were included in the provided release notes excerpt beyond + the fact this is v0.46.0 (the excerpt only lists assets/metadata). + breaking_changes: + - No breaking changes were listed in the provided release notes excerpt; must + review the actual v0.46.0 and v0.45.0 release pages/changelog for breaking/config + changes before upgrading. chart_version: 0.42.0 - images: ['timberio/vector:0.46.0-distroless-libc'] + images: + - timberio/vector:0.46.0-distroless-libc - version: 0.45.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are metadata-only (assets list, dates, download - counts) for Vector 0.44.0 and 0.45.0; no functional changes, new features, - fixes, or config changes are included in the text you shared.'] - breaking_changes: ['Unknown from provided notes: the actual 0.45.0 release notes - content (features/fixes/breaking changes) is not included, so breaking changes - cannot be assessed.'] + features: + - Release notes provided are metadata-only (assets list, dates, download counts) + for Vector 0.44.0 and 0.45.0; no functional changes, new features, fixes, + or config changes are included in the text you shared. + breaking_changes: + - 'Unknown from provided notes: the actual 0.45.0 release notes content (features/fixes/breaking + changes) is not included, so breaking changes cannot be assessed.' chart_version: 0.41.0 - images: ['timberio/vector:0.45.0-distroless-libc'] + images: + - timberio/vector:0.45.0-distroless-libc - version: 0.44.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional changes were highlighted in the provided v0.44.0 notes - (the excerpt is essentially an assets list)., macOS x86_64 tarball is present - again in v0.44.0 assets; v0.43.0 explicitly removed that artifact.] - breaking_changes: ['If your upgrade process/download scripts relied on `vector-0.43.0-x86_64-apple-darwin.tar.gz`, - it did not exist in 0.43.0 (removed); verify artifact selection logic when - moving to 0.44.0 where it is available again.'] + features: + - No functional changes were highlighted in the provided v0.44.0 notes (the + excerpt is essentially an assets list). + - macOS x86_64 tarball is present again in v0.44.0 assets; v0.43.0 explicitly + removed that artifact. + breaking_changes: + - If your upgrade process/download scripts relied on `vector-0.43.0-x86_64-apple-darwin.tar.gz`, + it did not exist in 0.43.0 (removed); verify artifact selection logic when + moving to 0.44.0 where it is available again. chart_version: 0.40.0 - images: ['timberio/vector:0.44.0-distroless-libc'] + images: + - timberio/vector:0.44.0-distroless-libc - version: 0.43.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Vector v0.43.0 release notes not included in the provided text beyond - a packaging/asset change; no concrete new runtime features can be extracted - from what was pasted.] - breaking_changes: ['The `vector-0.43.0-x86_64-apple-darwin.tar.gz` release asset - was removed (per #22129). If you rely on that specific macOS Intel tarball - for installs or CI artifacts, you must switch to another supported artifact - (e.g., a different archive format/target, Homebrew, or container image).'] + features: + - Vector v0.43.0 release notes not included in the provided text beyond a packaging/asset + change; no concrete new runtime features can be extracted from what was pasted. + breaking_changes: + - 'The `vector-0.43.0-x86_64-apple-darwin.tar.gz` release asset was removed + (per #22129). If you rely on that specific macOS Intel tarball for installs + or CI artifacts, you must switch to another supported artifact (e.g., a different + archive format/target, Homebrew, or container image).' chart_version: 0.38.0 - images: ['timberio/vector:0.43.0-distroless-libc'] + images: + - timberio/vector:0.43.0-distroless-libc - version: 0.42.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided are limited to metadata and build artifacts; - no feature list was included, so no new features can be reliably summarized - from the supplied text.'] - breaking_changes: [No breaking changes were listed in the provided notes; cannot - confirm whether any exist without the full 0.42.0 release notes content - (changelog section).] + features: + - Release notes provided are limited to metadata and build artifacts; no feature + list was included, so no new features can be reliably summarized from the + supplied text. + breaking_changes: + - No breaking changes were listed in the provided notes; cannot confirm whether + any exist without the full 0.42.0 release notes content (changelog section). chart_version: 0.37.0 - images: ['timberio/vector:0.42.0-distroless-libc'] + images: + - timberio/vector:0.42.0-distroless-libc - version: 0.41.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional changes were included in the notes you provided; the - v0.41.0 entry only lists build artifacts/packaging outputs., The release - primarily appears to be a version bump from 0.40.1 to 0.41.0 with updated - binaries for multiple platforms.] - breaking_changes: [No breaking changes were documented in the notes you provided; - treat as 'unknown' until you review the full v0.41.0 changelog on vector.dev - (link included).] + features: + - No functional changes were included in the notes you provided; the v0.41.0 + entry only lists build artifacts/packaging outputs. + - The release primarily appears to be a version bump from 0.40.1 to 0.41.0 with + updated binaries for multiple platforms. + breaking_changes: + - No breaking changes were documented in the notes you provided; treat as 'unknown' + until you review the full v0.41.0 changelog on vector.dev (link included). chart_version: 0.36.0 - images: ['timberio/vector:0.41.0-distroless-libc'] + images: + - timberio/vector:0.41.0-distroless-libc - version: 0.40.1 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional features are described in the provided notes for v0.40.1; - the content shown is primarily release metadata and build artifacts.] - breaking_changes: [No breaking changes are mentioned in the provided notes for - v0.40.1 (or v0.40.0) within the text supplied.] + features: + - No functional features are described in the provided notes for v0.40.1; the + content shown is primarily release metadata and build artifacts. + breaking_changes: + - No breaking changes are mentioned in the provided notes for v0.40.1 (or v0.40.0) + within the text supplied. chart_version: 0.35.2 - images: ['timberio/vector:0.40.1-distroless-libc'] + images: + - timberio/vector:0.40.1-distroless-libc - version: 0.40.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Release notes provided contain only metadata and build artifacts - for v0.40.0 vs v0.39.0; no functional changes are listed, so features cannot - be derived from the pasted content.'] - breaking_changes: [No breaking changes are mentioned in the provided notes; - verify the full v0.40.0 release page/changelog for config schema or component - changes before upgrading.] + features: + - Release notes provided contain only metadata and build artifacts for v0.40.0 + vs v0.39.0; no functional changes are listed, so features cannot be derived + from the pasted content. + breaking_changes: + - No breaking changes are mentioned in the provided notes; verify the full v0.40.0 + release page/changelog for config schema or component changes before upgrading. chart_version: 0.35.0 - images: ['timberio/vector:0.40.0-distroless-libc'] + images: + - timberio/vector:0.40.0-distroless-libc - version: 0.39.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were provided in the pasted release notes beyond - the fact that v0.39.0 is a newer release with updated build artifacts.] - breaking_changes: [No breaking-change details were provided in the pasted release - notes; only asset lists and metadata were included.] + features: + - No feature details were provided in the pasted release notes beyond the fact + that v0.39.0 is a newer release with updated build artifacts. + breaking_changes: + - No breaking-change details were provided in the pasted release notes; only + asset lists and metadata were included. chart_version: 0.34.0 - images: ['timberio/vector:0.39.0-distroless-libc'] + images: + - timberio/vector:0.39.0-distroless-libc - version: 0.38.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['The provided notes are metadata and asset lists for v0.37.0 and - v0.38.0; they do not include the actual v0.38.0 change details, so no concrete - feature summary can be derived from this content alone.'] - breaking_changes: [No breaking changes are listed in the provided text; actual - breaking changes (if any) would be in the linked Vector 0.38.0 release notes - page.] + features: + - The provided notes are metadata and asset lists for v0.37.0 and v0.38.0; they + do not include the actual v0.38.0 change details, so no concrete feature summary + can be derived from this content alone. + breaking_changes: + - No breaking changes are listed in the provided text; actual breaking changes + (if any) would be in the linked Vector 0.38.0 release notes page. chart_version: 0.33.0 - images: ['timberio/vector:0.38.0-distroless-libc'] + images: + - timberio/vector:0.38.0-distroless-libc - version: 0.37.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Vector upgraded from v0.36.0 to v0.37.0 (new upstream release artifacts - published March 26, 2024).'] - breaking_changes: [No breaking changes were provided in the supplied release - notes; verify on the official v0.37.0 release page/changelog before upgrading.] + features: + - Vector upgraded from v0.36.0 to v0.37.0 (new upstream release artifacts published + March 26, 2024). + breaking_changes: + - No breaking changes were provided in the supplied release notes; verify on + the official v0.37.0 release page/changelog before upgrading. chart_version: 0.32.0 - images: ['timberio/vector:0.37.0-distroless-libc'] + images: + - timberio/vector:0.37.0-distroless-libc - version: 0.36.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were provided in the pasted notes; only metadata - and build artifacts for 0.35.0 and 0.36.0., The 0.36.0 release appears to - include updated binaries across platforms (rpm/deb/tar/msi) compared to - 0.35.0.] - breaking_changes: [No breaking-change information was included in the provided - release notes excerpt.] + features: + - No feature details were provided in the pasted notes; only metadata and build + artifacts for 0.35.0 and 0.36.0. + - The 0.36.0 release appears to include updated binaries across platforms (rpm/deb/tar/msi) + compared to 0.35.0. + breaking_changes: + - No breaking-change information was included in the provided release notes + excerpt. chart_version: 0.31.0 - images: ['timberio/vector:0.36.0-distroless-libc'] + images: + - timberio/vector:0.36.0-distroless-libc - version: 0.35.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details provided in the notes you shared; only release - metadata and downloadable artifacts are listed.] - breaking_changes: [No breaking-change details provided in the notes you shared; - only release metadata and downloadable artifacts are listed.] + features: + - No feature details provided in the notes you shared; only release metadata + and downloadable artifacts are listed. + breaking_changes: + - No breaking-change details provided in the notes you shared; only release + metadata and downloadable artifacts are listed. chart_version: 0.30.0 - images: ['timberio/vector:0.35.0-distroless-libc'] + images: + - timberio/vector:0.35.0-distroless-libc - version: 0.34.2 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were included in the provided notes; only release - metadata and build artifacts for 0.34.0 and 0.34.2 were shown.] - breaking_changes: [No breaking-change details were included in the provided - notes; only release metadata and build artifacts were shown.] + features: + - No feature details were included in the provided notes; only release metadata + and build artifacts for 0.34.0 and 0.34.2 were shown. + breaking_changes: + - No breaking-change details were included in the provided notes; only release + metadata and build artifacts were shown. chart_version: 0.29.1 - images: ['timberio/vector:0.34.2-distroless-libc'] + images: + - timberio/vector:0.34.2-distroless-libc - version: 0.34.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No specific features were included in the notes you provided (only - release metadata and asset lists). Please share the 0.34.0 release page - details (highlights/changes) to extract new features.] - breaking_changes: [No breaking changes were listed in the notes you provided. - Confirm by reviewing the 0.34.0 release notes 'Breaking changes' or 'Upgrade - notes' section on vector.dev.] + features: + - No specific features were included in the notes you provided (only release + metadata and asset lists). Please share the 0.34.0 release page details (highlights/changes) + to extract new features. + breaking_changes: + - No breaking changes were listed in the notes you provided. Confirm by reviewing + the 0.34.0 release notes 'Breaking changes' or 'Upgrade notes' section on + vector.dev. chart_version: 0.28.0 - images: ['timberio/vector:0.34.0-distroless-libc'] + images: + - timberio/vector:0.34.0-distroless-libc - version: 0.33.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['No feature details were included in the provided release notes text - beyond links to the full 0.32.0 and 0.33.0 release pages. Based on what - you pasted, the only observable change is the bump from Vector 0.32.0 to - 0.33.0 and updated build artifacts for multiple platforms.'] - breaking_changes: ["No breaking changes were listed in the provided text; you\u2019\ - ll need to review the full 0.33.0 release notes link for any config/component\ - \ deprecations or behavior changes before upgrading."] + features: + - No feature details were included in the provided release notes text beyond + links to the full 0.32.0 and 0.33.0 release pages. Based on what you pasted, + the only observable change is the bump from Vector 0.32.0 to 0.33.0 and updated + build artifacts for multiple platforms. + breaking_changes: + - "No breaking changes were listed in the provided text; you\u2019ll need to\ + \ review the full 0.33.0 release notes link for any config/component deprecations\ + \ or behavior changes before upgrading." chart_version: 0.26.0 - images: ['timberio/vector:0.33.0-distroless-libc'] + images: + - timberio/vector:0.33.0-distroless-libc - version: 0.32.2 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional changes were included in the provided notes beyond - the version bump to v0.32.2; only artifact listings are shown.] - breaking_changes: [No breaking changes are indicated in the provided notes; - the notes shown contain only release metadata and asset lists.] + features: + - No functional changes were included in the provided notes beyond the version + bump to v0.32.2; only artifact listings are shown. + breaking_changes: + - No breaking changes are indicated in the provided notes; the notes shown contain + only release metadata and asset lists. chart_version: 0.25.0 - images: ['timberio/vector:0.32.2-distroless-libc'] + images: + - timberio/vector:0.32.2-distroless-libc - version: 0.32.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Vector v0.32.0 release notes link provided, but no detailed changelog - items included in the text you pasted (only metadata and build assets).'] - breaking_changes: [No breaking changes can be identified from the pasted notes; - the actual 0.32.0 release notes content is referenced by link but not included - here.] + features: + - Vector v0.32.0 release notes link provided, but no detailed changelog items + included in the text you pasted (only metadata and build assets). + breaking_changes: + - No breaking changes can be identified from the pasted notes; the actual 0.32.0 + release notes content is referenced by link but not included here. chart_version: 0.24.0 - images: ['timberio/vector:0.32.0-distroless-libc'] + images: + - timberio/vector:0.32.0-distroless-libc - version: 0.31.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['No feature details were included in the provided v0.30.0/v0.31.0 - notes beyond links and build artifacts; review https://vector.dev/releases/0.31.0 - for the actual change list before upgrading.'] - breaking_changes: [No breaking-change information was included in the provided - notes; validate by reading the v0.31.0 release notes and checking deprecations/removals - that could affect your current sources/sinks/transforms.] + features: + - No feature details were included in the provided v0.30.0/v0.31.0 notes beyond + links and build artifacts; review https://vector.dev/releases/0.31.0 for the + actual change list before upgrading. + breaking_changes: + - No breaking-change information was included in the provided notes; validate + by reading the v0.31.0 release notes and checking deprecations/removals that + could affect your current sources/sinks/transforms. chart_version: 0.23.0 - images: ['timberio/vector:0.31.0-distroless-libc'] + images: + - timberio/vector:0.31.0-distroless-libc - version: 0.30.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['No functional changes were provided in the notes shared (only metadata - and asset lists). Please share the v0.30.0 release highlights/changes from - https://vector.dev/releases/0.30.0 (or paste the changelog sections) so - we can extract new features, fixes, and any deprecations/breaking changes.'] - breaking_changes: ['Unknown from the provided excerpt; the pasted content contains - only release metadata and build artifacts, not the change log details.'] + features: + - No functional changes were provided in the notes shared (only metadata and + asset lists). Please share the v0.30.0 release highlights/changes from https://vector.dev/releases/0.30.0 + (or paste the changelog sections) so we can extract new features, fixes, and + any deprecations/breaking changes. + breaking_changes: + - Unknown from the provided excerpt; the pasted content contains only release + metadata and build artifacts, not the change log details. chart_version: 0.22.1 - images: ['timberio/vector:0.30.0-distroless-libc'] + images: + - timberio/vector:0.30.0-distroless-libc - version: 0.29.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Application bumped from Vector 0.28.0 to 0.29.0 (per release headers).] + features: + - Application bumped from Vector 0.28.0 to 0.29.0 (per release headers). breaking_changes: [] chart_version: 0.21.0 - images: ['timberio/vector:0.29.0-distroless-libc'] + images: + - timberio/vector:0.29.0-distroless-libc - version: 0.28.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Vector updated from v0.27.0 to v0.28.0 (new release available with - updated build artifacts across Linux/macOS/Windows and package formats).] - breaking_changes: [No breaking changes were provided in the supplied release - notes excerpt; review the full v0.28.0 release notes link for any config/behavior - changes before upgrading.] + features: + - Vector updated from v0.27.0 to v0.28.0 (new release available with updated + build artifacts across Linux/macOS/Windows and package formats). + breaking_changes: + - No breaking changes were provided in the supplied release notes excerpt; review + the full v0.28.0 release notes link for any config/behavior changes before + upgrading. chart_version: 0.20.0 - images: ['timberio/vector:0.28.0-distroless-libc'] + images: + - timberio/vector:0.28.0-distroless-libc - version: 0.27.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Bumped Vector application version from v0.26.0 to v0.27.0.] - breaking_changes: ["Release note content for v0.27.0 (features/breaking changes)\ - \ was not included here\u2014only metadata and asset lists\u2014so potential\ - \ breaking changes need to be reviewed at https://vector.dev/releases/0.27.0/."] + features: + - Bumped Vector application version from v0.26.0 to v0.27.0. + breaking_changes: + - "Release note content for v0.27.0 (features/breaking changes) was not included\ + \ here\u2014only metadata and asset lists\u2014so potential breaking changes\ + \ need to be reviewed at https://vector.dev/releases/0.27.0/." chart_version: 0.19.0 - images: ['timberio/vector:0.27.0-distroless-libc'] + images: + - timberio/vector:0.27.0-distroless-libc - version: 0.26.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional changes identified from the provided notes; the pasted - release entries only list metadata and build artifacts for v0.25.1 and v0.26.0., - 'Expect general bug fixes/performance improvements may exist in the full 0.26.0 - release notes at vector.dev, but they are not included in the text provided.'] - breaking_changes: ['No breaking changes are shown in the provided content; verify - in the full v0.26.0 release notes before upgrading (config, transforms/sinks/sources, - deprecated options).'] + features: + - No functional changes identified from the provided notes; the pasted release + entries only list metadata and build artifacts for v0.25.1 and v0.26.0. + - Expect general bug fixes/performance improvements may exist in the full 0.26.0 + release notes at vector.dev, but they are not included in the text provided. + breaking_changes: + - No breaking changes are shown in the provided content; verify in the full + v0.26.0 release notes before upgrading (config, transforms/sinks/sources, + deprecated options). chart_version: 0.18.0 - images: ['timberio/vector:0.26.0-distroless-libc'] + images: + - timberio/vector:0.26.0-distroless-libc - version: 0.25.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included\ - \ beyond metadata/assets, so no feature-level deltas can be extracted from\ - \ what was provided."] - breaking_changes: ["Release notes content for v0.24.0 and v0.25.1 wasn\u2019\ - t included beyond metadata/assets, so no breaking changes can be identified\ - \ from what was provided."] + features: + - "Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included beyond\ + \ metadata/assets, so no feature-level deltas can be extracted from what was\ + \ provided." + breaking_changes: + - "Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included beyond\ + \ metadata/assets, so no breaking changes can be identified from what was\ + \ provided." chart_version: 0.17.0 - images: ['timberio/vector:0.25.1-distroless-libc'] + images: + - timberio/vector:0.25.1-distroless-libc - version: 0.24.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No application feature details were provided in the pasted notes - (only links to full release notes and build artifacts). Review the Vector - 0.24.0 release page for actual feature list before upgrading.] - breaking_changes: ['No breaking-change details were provided in the pasted notes. - Check the Vector 0.24.0 release page and any upgrade/breaking-changes section, - and scan for config/schema changes that could affect existing Vector configs.'] + features: + - No application feature details were provided in the pasted notes (only links + to full release notes and build artifacts). Review the Vector 0.24.0 release + page for actual feature list before upgrading. + breaking_changes: + - No breaking-change details were provided in the pasted notes. Check the Vector + 0.24.0 release page and any upgrade/breaking-changes section, and scan for + config/schema changes that could affect existing Vector configs. chart_version: 0.16.0 - images: ['timberio/vector:0.24.0-distroless-libc'] + images: + - timberio/vector:0.24.0-distroless-libc - version: 0.23.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ["The provided notes don\u2019t include the actual v0.23.0 changelog\ - \ items (features/fixes/breaking changes); only metadata and build artifacts\ - \ are shown. No feature changes can be extracted from the text you shared."] - breaking_changes: ["The provided notes don\u2019t list any breaking changes\ - \ between v0.22.0 and v0.23.0; none can be confirmed from the text shared.\ - \ Review the linked Vector 0.23.0 release page for any config schema changes,\ - \ component deprecations/removals, or default-behavior changes before upgrading."] + features: + - "The provided notes don\u2019t include the actual v0.23.0 changelog items\ + \ (features/fixes/breaking changes); only metadata and build artifacts are\ + \ shown. No feature changes can be extracted from the text you shared." + breaking_changes: + - "The provided notes don\u2019t list any breaking changes between v0.22.0 and\ + \ v0.23.0; none can be confirmed from the text shared. Review the linked Vector\ + \ 0.23.0 release page for any config schema changes, component deprecations/removals,\ + \ or default-behavior changes before upgrading." chart_version: 0.15.0 - images: ['timberio/vector:0.23.0-distroless-libc'] + images: + - timberio/vector:0.23.0-distroless-libc - version: 0.22.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Vector upgraded from v0.21.0 to v0.22.0 (new Vector binary/images - available for the same set of target platforms).] + features: + - Vector upgraded from v0.21.0 to v0.22.0 (new Vector binary/images available + for the same set of target platforms). breaking_changes: [] chart_version: 0.13.0 - images: ['timberio/vector:0.22.0-distroless-libc'] + images: + - timberio/vector:0.22.0-distroless-libc - version: 0.21.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['No feature details were included in the provided v0.20.0/v0.21.0 - notes beyond asset/package listings, so features for 0.21.0 vs 0.20.0 cannot - be summarized from this input.'] - breaking_changes: ['No breaking-change information was included in the provided - notes (only asset lists), so breaking changes between 0.20.0 and 0.21.0 - cannot be determined from this input.'] + features: + - No feature details were included in the provided v0.20.0/v0.21.0 notes beyond + asset/package listings, so features for 0.21.0 vs 0.20.0 cannot be summarized + from this input. + breaking_changes: + - No breaking-change information was included in the provided notes (only asset + lists), so breaking changes between 0.20.0 and 0.21.0 cannot be determined + from this input. chart_version: 0.10.0 - images: ['timberio/vector:0.21.0-distroless-libc'] + images: + - timberio/vector:0.21.0-distroless-libc - version: 0.20.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No functional feature details were provided in the supplied release - notes excerpt (only metadata and asset lists).] - breaking_changes: [No breaking-change information was provided in the supplied - release notes excerpt (only metadata and asset lists).] + features: + - No functional feature details were provided in the supplied release notes + excerpt (only metadata and asset lists). + breaking_changes: + - No breaking-change information was provided in the supplied release notes + excerpt (only metadata and asset lists). chart_version: 0.7.0 - images: ['timberio/vector:0.20.0-distroless-libc'] + images: + - timberio/vector:0.20.0-distroless-libc - version: 0.19.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release notes provided here only include asset lists; no feature - details were included in the pasted notes., 'Vector v0.19.0 is a minor-version - bump over v0.18.0; expect incremental improvements, but consult the full - v0.19.0 release notes link for specifics (new sources/sinks/transforms, - performance, and bug fixes).'] - breaking_changes: [No breaking changes were listed in the provided excerpt; - you must review the full v0.19.0 release notes for any config or behavior - changes that could affect pipelines.] + features: + - Release notes provided here only include asset lists; no feature details were + included in the pasted notes. + - Vector v0.19.0 is a minor-version bump over v0.18.0; expect incremental improvements, + but consult the full v0.19.0 release notes link for specifics (new sources/sinks/transforms, + performance, and bug fixes). + breaking_changes: + - No breaking changes were listed in the provided excerpt; you must review the + full v0.19.0 release notes for any config or behavior changes that could affect + pipelines. chart_version: 0.4.0 - images: ['timberio/vector:0.19.0-distroless-libc'] + images: + - timberio/vector:0.19.0-distroless-libc - version: 0.18.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Application updated from Vector v0.17.3 to v0.18.0 (new release published - 2021-11-18).] - breaking_changes: [No breaking changes were included in the provided release - notes excerpt (only assets/metadata). Review the full 0.18.0 release notes - page for config/component deprecations or behavioral changes before upgrading.] + features: + - Application updated from Vector v0.17.3 to v0.18.0 (new release published + 2021-11-18). + breaking_changes: + - No breaking changes were included in the provided release notes excerpt (only + assets/metadata). Review the full 0.18.0 release notes page for config/component + deprecations or behavioral changes before upgrading. chart_version: 0.2.1 - images: ['timberio/vector:0.18.0-distroless-libc'] + images: + - timberio/vector:0.18.0-distroless-libc - version: 0.17.3 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No feature details were provided in the supplied notes; only links - to the full release pages and build artifacts., "Upgrade spans multiple\ - \ Vector versions (0.16.1 \u2192 0.17.3); review intermediate release notes\ - \ on vector.dev for component-specific changes (sources, transforms, sinks)."] - breaking_changes: [No breaking-change information was included in the provided - notes; you must review the 0.17.x release notes (and any 0.17.0/0.17.1/0.17.2 - notes) for config/behavior changes before upgrading.] + features: + - No feature details were provided in the supplied notes; only links to the + full release pages and build artifacts. + - "Upgrade spans multiple Vector versions (0.16.1 \u2192 0.17.3); review intermediate\ + \ release notes on vector.dev for component-specific changes (sources, transforms,\ + \ sinks)." + breaking_changes: + - No breaking-change information was included in the provided notes; you must + review the 0.17.x release notes (and any 0.17.0/0.17.1/0.17.2 notes) for config/behavior + changes before upgrading. chart_version: 0.1.1 - images: ['timberio/vector:0.17.3-distroless-libc'] + images: + - timberio/vector:0.17.3-distroless-libc - version: 0.16.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.0-alpha.4 - images: ['timberio/vector:0.16.1-distroless-libc'] + images: + - timberio/vector:0.16.1-distroless-libc name: vector - git_url: https://github.com/VictoriaMetrics/operator release_url: https://github.com/VictoriaMetrics/operator/releases/tag/v{vsn} @@ -27028,68 +36575,97 @@ addons: icon: https://dashboard.snapcraft.io/site_media/appmedia/2020/11/output-onlinepngtools.png versions: - version: 0.66.1 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['v0.66.0 adds `spec.managedMetadata` support for VMUser (including - Secrets), an `incident.io` receiver in VMAlertmanagerConfig, HTTPRoute support - for VMAuthorization, an IPv6 mode toggle via `VM_ENABLETCP6`, and config-reloader - now defaults its image tag to the operator version.', v0.66.0 updates default - bundled VictoriaMetrics app versions to v1.131.0 and VictoriaTraces defaults - to v0.5.0., 'v0.66.1 is primarily a patch/security release: Go builder updated - to 1.25.5 plus bugfixes for RBAC cleanup and VMAnomaly config parsing/robustness.'] - breaking_changes: [v0.66.0 removes deprecated labels/annotations inheritance; - you must move required metadata to `spec.managedMetadata` fields., 'v0.66.0 - removes deprecated status fields: `VMCluster.status.clusterStatus` and `VMSingle.status.singleStatus` - (may break dashboards/scripts that read them).'] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - v0.66.0 adds `spec.managedMetadata` support for VMUser (including Secrets), + an `incident.io` receiver in VMAlertmanagerConfig, HTTPRoute support for VMAuthorization, + an IPv6 mode toggle via `VM_ENABLETCP6`, and config-reloader now defaults + its image tag to the operator version. + - v0.66.0 updates default bundled VictoriaMetrics app versions to v1.131.0 and + VictoriaTraces defaults to v0.5.0. + - 'v0.66.1 is primarily a patch/security release: Go builder updated to 1.25.5 + plus bugfixes for RBAC cleanup and VMAnomaly config parsing/robustness.' + breaking_changes: + - v0.66.0 removes deprecated labels/annotations inheritance; you must move required + metadata to `spec.managedMetadata` fields. + - 'v0.66.0 removes deprecated status fields: `VMCluster.status.clusterStatus` + and `VMSingle.status.singleStatus` (may break dashboards/scripts that read + them).' chart_version: 0.57.1 - images: ['victoriametrics/operator:config-reloader-v0.66.1', 'victoriametrics/operator:v0.66.1'] + images: + - victoriametrics/operator:config-reloader-v0.66.1 + - victoriametrics/operator:v0.66.1 - version: 0.66.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Config reloader now defaults its image tag to the operator version, - reducing drift between operator and reloader images.', VMAuth gains HTTPRoute - (Gateway API) support and can override the default path for its embedded - ingress., VMAlertmanagerConfig adds an incident.io receiver integration., - VMOperator can run all managed CR workloads in IPv6 mode via the VM_ENABLETCP6 - environment variable., VMUser introduces spec.managedMetadata for adding - labels/annotations to the generated Secret and adds query_args for appending - query parameters to backend URL generation., VMAgent in ingestOnly mode - no longer sets promscrape.cluster.membersCount and promscrape.cluster.memberNum - flags.] - breaking_changes: [Removed labels/annotations inheritance (deprecated since - v0.51.0). You must move any relied-upon labels/annotations into the spec.managedMetadata - fields on the relevant CRs., Removed VMCluster status.clusterStatus and - VMSingle status.singleStatus fields (deprecated since v0.51.0). Any tooling - that reads these status fields must be updated to use the current status - structure.] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Config reloader now defaults its image tag to the operator version, reducing + drift between operator and reloader images. + - VMAuth gains HTTPRoute (Gateway API) support and can override the default + path for its embedded ingress. + - VMAlertmanagerConfig adds an incident.io receiver integration. + - VMOperator can run all managed CR workloads in IPv6 mode via the VM_ENABLETCP6 + environment variable. + - VMUser introduces spec.managedMetadata for adding labels/annotations to the + generated Secret and adds query_args for appending query parameters to backend + URL generation. + - VMAgent in ingestOnly mode no longer sets promscrape.cluster.membersCount + and promscrape.cluster.memberNum flags. + breaking_changes: + - Removed labels/annotations inheritance (deprecated since v0.51.0). You must + move any relied-upon labels/annotations into the spec.managedMetadata fields + on the relevant CRs. + - Removed VMCluster status.clusterStatus and VMSingle status.singleStatus fields + (deprecated since v0.51.0). Any tooling that reads these status fields must + be updated to use the current status structure. chart_version: 0.57.0 - images: ['victoriametrics/operator:config-reloader-v0.66.0', 'victoriametrics/operator:v0.66.0'] + images: + - victoriametrics/operator:config-reloader-v0.66.0 + - victoriametrics/operator:v0.66.0 - version: 0.65.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['VMAuth: adds HorizontalPodAutoscaler support via new `spec.hpa` - field on the VMAuth CRD.', 'Converter: now supports Prometheus Operator - `ServiceMonitor.spec.role` / ServiceDiscoveryRole during object conversion.'] - breaking_changes: ['Scrape CRDs now use `int` (instead of `uint64`) for `seriesLimit` - and `sampleLimit` on VMPodScrape, VMNodeScrape, VMServiceScrape, VMScrapeConfig, - VMProbe (and related). This is a schema/type change that may require updating - manifests/clients or re-applying CRDs if validation fails.'] + features: + - 'VMAuth: adds HorizontalPodAutoscaler support via new `spec.hpa` field on + the VMAuth CRD.' + - 'Converter: now supports Prometheus Operator `ServiceMonitor.spec.role` / + ServiceDiscoveryRole during object conversion.' + breaking_changes: + - Scrape CRDs now use `int` (instead of `uint64`) for `seriesLimit` and `sampleLimit` + on VMPodScrape, VMNodeScrape, VMServiceScrape, VMScrapeConfig, VMProbe (and + related). This is a schema/type change that may require updating manifests/clients + or re-applying CRDs if validation fails. chart_version: 0.56.4 - images: ['victoriametrics/operator:config-reloader-v0.65.0', 'victoriametrics/operator:v0.65.0'] + images: + - victoriametrics/operator:config-reloader-v0.65.0 + - victoriametrics/operator:v0.65.0 - version: 0.64.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -27105,73 +36681,96 @@ addons: \ knobs**: new `rollingUpdate` / `updateStrategy` fields for `VMAuth.spec`\ \ and `*.spec.requestsLoadBalancer.spec` across VM/VL/VT clusters; again optional\ \ unless you want to tune rollouts.\n" - chart_updates: [Operator now prefers its bundled config-reloader implementation; - this can change the sidecar image and how reloads are performed across managed - resources., "Controller reconcile behavior changed to **preserve third\u2011\ - party labels** on objects (previously it tended to drop non-managed labels\ - \ unless in `managedMetadata.labels`).", Service reconciliation improvements - around `Service.spec.loadBalancerClass` tracking to prevent errors/loops.] - features: [Operator-bundled config reloader is now the default (can be disabled - via `VM_USECUSTOMCONFIGRELOADER=false`)., New `podDisruptionBudget.unhealthyPodEvictionPolicy` - support for finer control of eviction behavior., New rollout tuning fields - (`updateStrategy`/`rollingUpdate`) added to `VMAuth` and requests load balancer - specs for VM/VL/VT clusters., "Label preservation during reconcile: operator\ - \ keeps third\u2011party labels rather than pruning them to only managed\ - \ labels.", '`VLCluster.spec.vlselect.extraStorageNodes` and `VTCluster.spec.vtselect.extraStorageNodes` - allow select components to read from additional storage nodes.', vmagent - scraping can now use `scrapeClass` / `scrapeClassName` across multiple scrape - CRDs., vmanomaly adds UI preset mode and supports `vlogs` reader type.] - breaking_changes: ['**Default config reloader changed** from 3rd-party images - to `victoriametrics/operator:config-reloader`. If you relied on the old - reloader behavior/image (e.g., policies, allowlists, image pinning, compliance - scanning), you must either accept the new image or set `VM_USECUSTOMCONFIGRELOADER=false` - to keep prior behavior.'] + chart_updates: + - Operator now prefers its bundled config-reloader implementation; this can + change the sidecar image and how reloads are performed across managed resources. + - "Controller reconcile behavior changed to **preserve third\u2011party labels**\ + \ on objects (previously it tended to drop non-managed labels unless in `managedMetadata.labels`)." + - Service reconciliation improvements around `Service.spec.loadBalancerClass` + tracking to prevent errors/loops. + features: + - Operator-bundled config reloader is now the default (can be disabled via `VM_USECUSTOMCONFIGRELOADER=false`). + - New `podDisruptionBudget.unhealthyPodEvictionPolicy` support for finer control + of eviction behavior. + - New rollout tuning fields (`updateStrategy`/`rollingUpdate`) added to `VMAuth` + and requests load balancer specs for VM/VL/VT clusters. + - "Label preservation during reconcile: operator keeps third\u2011party labels\ + \ rather than pruning them to only managed labels." + - '`VLCluster.spec.vlselect.extraStorageNodes` and `VTCluster.spec.vtselect.extraStorageNodes` + allow select components to read from additional storage nodes.' + - vmagent scraping can now use `scrapeClass` / `scrapeClassName` across multiple + scrape CRDs. + - vmanomaly adds UI preset mode and supports `vlogs` reader type. + breaking_changes: + - '**Default config reloader changed** from 3rd-party images to `victoriametrics/operator:config-reloader`. + If you relied on the old reloader behavior/image (e.g., policies, allowlists, + image pinning, compliance scanning), you must either accept the new image + or set `VM_USECUSTOMCONFIGRELOADER=false` to keep prior behavior.' chart_version: 0.55.2 - images: ['victoriametrics/operator:v0.64.0'] + images: + - victoriametrics/operator:v0.64.0 - version: 0.63.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Bumped bundled default VictoriaMetrics app versions from **v1.123.0\ - \ \u2192 v1.125.0**.", "Bumped bundled default VictoriaLogs app versions\ - \ from **v1.28.0 \u2192 v1.33.0**.", 'Operator behavior fixes: VMAlert finalizer - is now reliably released on delete; Service reconciliation now handles `loadBalancerClass` - changes without hitting the immutable-field error.', VMUser routing logic - was simplified for `src_paths` when targeting `VMCluster/vminsert` or `VMCluster/vmselect`.] - features: ['VMUser `targetRef.crd.kind` now supports VictoriaLogs (VLSingle, - VLAgent, VLCluster components) and VictoriaTraces (VTSingle, VTCluster components) - resources, enabling VMUser to reference these CRDs directly.', 'New CRDs/resources - are introduced: `VLSingle` and `VTCluster` for managing VictoriaLogs single-node - and VictoriaTraces cluster deployments via the operator.', 'VMAgent stream - aggregation gains `ignore_first_sample_interval` support, improving aggregation - behavior right after restarts/rollouts.', 'VMAlert admission webhook adds - validation to ensure notifier configuration options are mutually exclusive, - catching misconfigurations earlier.', VMAlertmanager adds `enforcedNamespaceLabel` - to customize the label key used in the top-route namespace matcher for VMAlertmanagerConfig.] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Bumped bundled default VictoriaMetrics app versions from **v1.123.0 \u2192\ + \ v1.125.0**." + - "Bumped bundled default VictoriaLogs app versions from **v1.28.0 \u2192 v1.33.0**." + - 'Operator behavior fixes: VMAlert finalizer is now reliably released on delete; + Service reconciliation now handles `loadBalancerClass` changes without hitting + the immutable-field error.' + - VMUser routing logic was simplified for `src_paths` when targeting `VMCluster/vminsert` + or `VMCluster/vmselect`. + features: + - VMUser `targetRef.crd.kind` now supports VictoriaLogs (VLSingle, VLAgent, + VLCluster components) and VictoriaTraces (VTSingle, VTCluster components) + resources, enabling VMUser to reference these CRDs directly. + - 'New CRDs/resources are introduced: `VLSingle` and `VTCluster` for managing + VictoriaLogs single-node and VictoriaTraces cluster deployments via the operator.' + - VMAgent stream aggregation gains `ignore_first_sample_interval` support, improving + aggregation behavior right after restarts/rollouts. + - VMAlert admission webhook adds validation to ensure notifier configuration + options are mutually exclusive, catching misconfigurations earlier. + - VMAlertmanager adds `enforcedNamespaceLabel` to customize the label key used + in the top-route namespace matcher for VMAlertmanagerConfig. breaking_changes: [] chart_version: 0.54.1 - images: ['victoriametrics/operator:v0.63.0'] + images: + - victoriametrics/operator:v0.63.0 - version: 0.62.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Default component versions were bumped: VictoriaMetrics apps to - v1.123.0, VictoriaLogs apps to v1.28.0, and VMAnomaly to v1.25.2.', "PrometheusRule\u2192\ - VMRule converter now supports converting `spec.limit`, `spec.labels`, `spec.query_offset`,\ - \ and `spec.group[*].keep_firing_for`.", 'Operator reconcile latency was - reduced, improving responsiveness during sync/redeploy cycles.', 'Operator - now exposes its configuration as Prometheus metrics (`flag` and `config_parameter` - with `name`, `is_set`, `value` labels).'] + features: + - 'Default component versions were bumped: VictoriaMetrics apps to v1.123.0, + VictoriaLogs apps to v1.28.0, and VMAnomaly to v1.25.2.' + - "PrometheusRule\u2192VMRule converter now supports converting `spec.limit`,\ + \ `spec.labels`, `spec.query_offset`, and `spec.group[*].keep_firing_for`." + - Operator reconcile latency was reduced, improving responsiveness during sync/redeploy + cycles. + - Operator now exposes its configuration as Prometheus metrics (`flag` and `config_parameter` + with `name`, `is_set`, `value` labels). breaking_changes: [] chart_version: 0.52.1 - images: ['victoriametrics/operator:v0.62.0'] + images: + - victoriametrics/operator:v0.62.0 - version: 0.61.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -27188,812 +36787,1074 @@ addons: re explicitly pinning `spec.image.tag` where required.\n\n## Version bumps\ \ (defaults managed by operator)\n- Default VictoriaMetrics apps: **v1.120.0\ \ \u2192 v1.121.0**.\n- Default VictoriaLogs apps: **v1.24.0 \u2192 v1.25.1**." - chart_updates: [Introduces new CRD/resource **VLAgent** (apply new CRDs)., Transitions - **VLogs** CR to read-only; operator ignores create/update for it; migration - path is to **VLSingle**., Operator now requires **pods/eviction** RBAC to - respect PDB during StatefulSet updates., Fixes/changes rolling update behavior - controls by adding `maxUnavailable` fields for VMCluster/VLCluster storage/select - components., 'Adds `persistentVolumeClaimRetentionPolicy` support for StatefulSet-mode - CRs (VMAnomaly, VMCluster, VMAlertmanager, VMAgent).'] - features: [VLogs is now treated as read-only by the operator; migration support - guidance is provided to move to VLSingle., 'New CustomResource/CRD: VLAgent - for VictoriaLogs agent functionality.', VMCluster and VLCluster now support - `maxUnavailable` on key components to tune rolling update disruption., VLSingle - adds `spec.syslogSpec` to configure syslog ingestion., VMAgent adds a global - scrape config and an AWS section for remoteWrite; also adjusts default `remoteWrite.maxDiskUsagePerURL` - when using stateful storage., StatefulSet-mode CRs gain `persistentVolumeClaimRetentionPolicy` - for PVC retention behavior control., 'If a license is configured on a CR, - the operator can default image tags with an `-enterprise` suffix.'] - breaking_changes: ['**VLogs CR becomes read-only** in v0.61.0; create/update - requests are ignored, so existing GitOps flows managing VLogs will effectively - stop applying changes until migrated to VLSingle.', '**CRD update required** - due to new `VLAgent` resource; upgrading the operator without CRDs may break - reconciliation or fail validation.', '**Additional RBAC needed** (`pods/eviction`); - without it, operator actions involving evictions/PDB-respecting StatefulSet - updates may fail.'] + chart_updates: + - Introduces new CRD/resource **VLAgent** (apply new CRDs). + - Transitions **VLogs** CR to read-only; operator ignores create/update for + it; migration path is to **VLSingle**. + - Operator now requires **pods/eviction** RBAC to respect PDB during StatefulSet + updates. + - Fixes/changes rolling update behavior controls by adding `maxUnavailable` + fields for VMCluster/VLCluster storage/select components. + - Adds `persistentVolumeClaimRetentionPolicy` support for StatefulSet-mode CRs + (VMAnomaly, VMCluster, VMAlertmanager, VMAgent). + features: + - VLogs is now treated as read-only by the operator; migration support guidance + is provided to move to VLSingle. + - 'New CustomResource/CRD: VLAgent for VictoriaLogs agent functionality.' + - VMCluster and VLCluster now support `maxUnavailable` on key components to + tune rolling update disruption. + - VLSingle adds `spec.syslogSpec` to configure syslog ingestion. + - VMAgent adds a global scrape config and an AWS section for remoteWrite; also + adjusts default `remoteWrite.maxDiskUsagePerURL` when using stateful storage. + - StatefulSet-mode CRs gain `persistentVolumeClaimRetentionPolicy` for PVC retention + behavior control. + - If a license is configured on a CR, the operator can default image tags with + an `-enterprise` suffix. + breaking_changes: + - '**VLogs CR becomes read-only** in v0.61.0; create/update requests are ignored, + so existing GitOps flows managing VLogs will effectively stop applying changes + until migrated to VLSingle.' + - '**CRD update required** due to new `VLAgent` resource; upgrading the operator + without CRDs may break reconciliation or fail validation.' + - '**Additional RBAC needed** (`pods/eviction`); without it, operator actions + involving evictions/PDB-respecting StatefulSet updates may fail.' chart_version: 0.51.2 - images: ['victoriametrics/operator:v0.61.0'] + images: + - victoriametrics/operator:v0.61.0 - version: 0.60.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['(v0.59.0) New CRDs: `VLSingle` (replacement for deprecated `VLogs`) - and `VLCluster` for VictoriaLogs deployments.', (v0.59.0) `VMagent.remoteWriteSpec` - gains `proxyURL` support; leader-election config gains new flags for lease - duration and renew deadline., '(v0.59.0) GitHub release manifests add `app.kubernetes.io/instance: - default` and rename `app.kubernetes.io/name` to `victoria-metrics-operator`.', - '(v0.60.0) New CRD: `VMAnomaly` plus vmanomaly feature: online models now - support the `decay` field.', '(v0.60.0) Default bundled app versions bumped: - VM apps to v1.120.0; VictoriaLogs apps to v1.24.0 (victorialogs).'] - breaking_changes: ['`VLogs` is deprecated as of v0.59.0 and will become read-only - after v0.61.0; migrate to `VLSingle` before then.', 'Metric rename in v0.60.0: - `operator_vmagent_config_fetch_secret_errors_total` -> `operator_fetch_errors_total` - (and semantics broaden to all secret/configmap fetch failures), which can - break dashboards/alerts.'] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - '(v0.59.0) New CRDs: `VLSingle` (replacement for deprecated `VLogs`) and `VLCluster` + for VictoriaLogs deployments.' + - (v0.59.0) `VMagent.remoteWriteSpec` gains `proxyURL` support; leader-election + config gains new flags for lease duration and renew deadline. + - '(v0.59.0) GitHub release manifests add `app.kubernetes.io/instance: default` + and rename `app.kubernetes.io/name` to `victoria-metrics-operator`.' + - '(v0.60.0) New CRD: `VMAnomaly` plus vmanomaly feature: online models now + support the `decay` field.' + - '(v0.60.0) Default bundled app versions bumped: VM apps to v1.120.0; VictoriaLogs + apps to v1.24.0 (victorialogs).' + breaking_changes: + - '`VLogs` is deprecated as of v0.59.0 and will become read-only after v0.61.0; + migrate to `VLSingle` before then.' + - 'Metric rename in v0.60.0: `operator_vmagent_config_fetch_secret_errors_total` + -> `operator_fetch_errors_total` (and semantics broaden to all secret/configmap + fetch failures), which can break dashboards/alerts.' chart_version: 0.52.0 - images: ['victoriametrics/operator:v0.60.0'] + images: + - victoriametrics/operator:v0.60.0 - version: 0.59.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Default VM app versions bumped from v1.117.0 (operator v0.58.0) - to v1.118.0 (operator v0.59.0)., 'Manifests distributed via GitHub release - artifacts now include label `app.kubernetes.io/instance: default`, and `app.kubernetes.io/name` - value changed to `victoria-metrics-operator`.', Operator adds new leader - election flags `leader-elect-lease-duration` and `leader-elect-renew-deadline` - (in addition to the v0.58.0 flags `leader-elect-namespace` and `leader-elect-id`)., - Config-reloader now excludes hidden directories from watch to avoid errors - with hidden symlinks., '`spec.configMaps` are now mounted as `volumeMounts` - and watched by config-reloader for VMAgent and VMAlert.', 'New API fields/resources: - `proxyURL` for VMagent `remoteWriteSpec`; new CRDs/resources `VLSingle` - and `VLCluster`; `VLogs` deprecated with migration guidance to VLSingle.', - Removed alerting rule `BadObjects` because metric `operator_controller_bad_objects_count` - is no longer exposed., 'HPA validation fixed: `metrics` and `behaviour` - are optional fields.', "VMCluster defaulting typo fixed to avoid panic when\ - \ VMInsert isn\u2019t configured."] - features: ['New log storage CRDs: `VLSingle` (replacement for `VLogs`) and `VLCluster` - for clustered logs deployments.', VMagent `remoteWriteSpec` gains `proxyURL` - to route remote write traffic via an HTTP proxy., 'Additional leader election - tuning flags (`leader-elect-lease-duration`, `leader-elect-renew-deadline`) - for better HA behavior.', 'Config-reloader improvements: ignores hidden - directories and can watch ConfigMaps mounted via `spec.configMaps` for VMAgent/VMAlert.'] - breaking_changes: ['`VLogs` is deprecated in v0.59.0 and will become read-only - after v0.61.0; plan migration to `VLSingle` before that cutoff.', "If you\ - \ rely on the `BadObjects` alert or the `operator_controller_bad_objects_count`\ - \ metric, they\u2019re no longer available and any dashboards/alerts must\ - \ be updated.", 'GitHub release artifact manifests change standard labels - (`app.kubernetes.io/name` and add `app.kubernetes.io/instance`); if you - select resources by these labels in tooling/policies, update selectors accordingly.'] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Default VM app versions bumped from v1.117.0 (operator v0.58.0) to v1.118.0 + (operator v0.59.0). + - 'Manifests distributed via GitHub release artifacts now include label `app.kubernetes.io/instance: + default`, and `app.kubernetes.io/name` value changed to `victoria-metrics-operator`.' + - Operator adds new leader election flags `leader-elect-lease-duration` and + `leader-elect-renew-deadline` (in addition to the v0.58.0 flags `leader-elect-namespace` + and `leader-elect-id`). + - Config-reloader now excludes hidden directories from watch to avoid errors + with hidden symlinks. + - '`spec.configMaps` are now mounted as `volumeMounts` and watched by config-reloader + for VMAgent and VMAlert.' + - 'New API fields/resources: `proxyURL` for VMagent `remoteWriteSpec`; new CRDs/resources + `VLSingle` and `VLCluster`; `VLogs` deprecated with migration guidance to + VLSingle.' + - Removed alerting rule `BadObjects` because metric `operator_controller_bad_objects_count` + is no longer exposed. + - 'HPA validation fixed: `metrics` and `behaviour` are optional fields.' + - "VMCluster defaulting typo fixed to avoid panic when VMInsert isn\u2019t configured." + features: + - 'New log storage CRDs: `VLSingle` (replacement for `VLogs`) and `VLCluster` + for clustered logs deployments.' + - VMagent `remoteWriteSpec` gains `proxyURL` to route remote write traffic via + an HTTP proxy. + - Additional leader election tuning flags (`leader-elect-lease-duration`, `leader-elect-renew-deadline`) + for better HA behavior. + - 'Config-reloader improvements: ignores hidden directories and can watch ConfigMaps + mounted via `spec.configMaps` for VMAgent/VMAlert.' + breaking_changes: + - '`VLogs` is deprecated in v0.59.0 and will become read-only after v0.61.0; + plan migration to `VLSingle` before that cutoff.' + - "If you rely on the `BadObjects` alert or the `operator_controller_bad_objects_count`\ + \ metric, they\u2019re no longer available and any dashboards/alerts must\ + \ be updated." + - GitHub release artifact manifests change standard labels (`app.kubernetes.io/name` + and add `app.kubernetes.io/instance`); if you select resources by these labels + in tooling/policies, update selectors accordingly. chart_version: 0.49.0-rc1 - images: ['victoriametrics/operator:v0.59.0'] + images: + - victoriametrics/operator:v0.59.0 - version: 0.58.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Leader election configuration: new operator flags `leader-elect-namespace` - and `leader-elect-id` allow controlling where the leader election Lease - lives and how it is identified.', 'Prometheus config reloader image was - bumped from 0.68.0 to 0.82.1, which may change reloader behavior and should - be validated in your environment.'] - breaking_changes: ['Operational risk: v0.58.0 defaults to deploying a vmagent - version with a known bug (VictoriaMetrics#8941). Recommended to skip this - release; if you must upgrade, override vmagent to `v1.117.1` via `VM_VMAGENTDEFAULT_VERSION=v1.117.1`.'] + features: + - 'Leader election configuration: new operator flags `leader-elect-namespace` + and `leader-elect-id` allow controlling where the leader election Lease lives + and how it is identified.' + - Prometheus config reloader image was bumped from 0.68.0 to 0.82.1, which may + change reloader behavior and should be validated in your environment. + breaking_changes: + - 'Operational risk: v0.58.0 defaults to deploying a vmagent version with a + known bug (VictoriaMetrics#8941). Recommended to skip this release; if you + must upgrade, override vmagent to `v1.117.1` via `VM_VMAGENTDEFAULT_VERSION=v1.117.1`.' chart_version: 0.47.0 - images: ['victoriametrics/operator:v0.58.0'] + images: + - victoriametrics/operator:v0.58.0 - version: 0.57.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Introduced FIPS-compliant builds for the operator and config-reloader - images (use images tagged with the -fips prefix when required)., Added spec.configReloadAuthKeySecret - to VMAgent/VMAlert/VMAuth to supply a secret value used as the -configReload - auth key., Converter now supports msteamsv2_configs conversion from Prometheus - AlertmanagerConfig., VMAlertmanagerConfig webhook_configs gained a timeout - field (requires Alertmanager v0.28.0+)., VMSingle Service now exposes an - additional named port/alias for 8428., 'VMSingle and VMCluster retentionPeriod - is now optional and defaults to 1 month; retentionPeriod is validated against - ^[0-9]+(h|d|y)?$.', 'Operator default component versions updated: VictoriaMetrics - apps to v1.116.0, VictoriaLogs to v1.21.0, Alertmanager to v0.28.1.', 'Build - tooling updated: Go builder upgraded from Go 1.24.0 to Go 1.24.4.'] - breaking_changes: [retentionPeriod in VMSingle/VMCluster now has strict validation - and defaults to 1 month when omitted; previously accepted values may now - be rejected by the webhook/CRD validation.] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Introduced FIPS-compliant builds for the operator and config-reloader images + (use images tagged with the -fips prefix when required). + - Added spec.configReloadAuthKeySecret to VMAgent/VMAlert/VMAuth to supply a + secret value used as the -configReload auth key. + - Converter now supports msteamsv2_configs conversion from Prometheus AlertmanagerConfig. + - VMAlertmanagerConfig webhook_configs gained a timeout field (requires Alertmanager + v0.28.0+). + - VMSingle Service now exposes an additional named port/alias for 8428. + - VMSingle and VMCluster retentionPeriod is now optional and defaults to 1 month; + retentionPeriod is validated against ^[0-9]+(h|d|y)?$. + - 'Operator default component versions updated: VictoriaMetrics apps to v1.116.0, + VictoriaLogs to v1.21.0, Alertmanager to v0.28.1.' + - 'Build tooling updated: Go builder upgraded from Go 1.24.0 to Go 1.24.4.' + breaking_changes: + - retentionPeriod in VMSingle/VMCluster now has strict validation and defaults + to 1 month when omitted; previously accepted values may now be rejected by + the webhook/CRD validation. chart_version: 0.46.0 - images: ['victoriametrics/operator:v0.57.0'] + images: + - victoriametrics/operator:v0.57.0 - version: 0.56.0 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Default VM component images bumped: VictoriaMetrics -> v1.115.0; - VLogs -> v1.18.0 (from prior v1.114.0/v1.17.0).', New support for env vars - `VM_METRICS_VERSION` and `VM_LOGS_VERSION` to control images for all VM/VL-related - CRs., 'Config-reloader behavior change: it no longer uses proxy-protocol - for its internal web-server even when `reload-use-proxy-protocol` is set - (plus a bugfix around that flag).', 'Added additional validations: vmalertmanager - runtime config validation; StatefulSet volumeMount name validation; stricter - vmalertmanagerconfig validation for unknown fields; shard count bounds fix.'] - features: ['Can set all VM and VLogs image versions via `VM_METRICS_VERSION` - and `VM_LOGS_VERSION` environment variables, reducing per-CR version pinning.', - vmauth can now serve internal routes on a separate port (`internalListenPort`) - for improved security/isolation., vmauth can optionally enable HAProxy PROXY - protocol support via `useProxyProtocol`., 'vmalertmanager now validates - runtime configuration, catching invalid configs earlier.'] - breaking_changes: ['Config-reloader no longer uses proxy-protocol for its internal - web server even if `reload-use-proxy-protocol` is enabled; if you relied - on proxy-protocol on that internal endpoint, adjust your setup or remove - the expectation.'] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Default VM component images bumped: VictoriaMetrics -> v1.115.0; VLogs -> + v1.18.0 (from prior v1.114.0/v1.17.0).' + - New support for env vars `VM_METRICS_VERSION` and `VM_LOGS_VERSION` to control + images for all VM/VL-related CRs. + - 'Config-reloader behavior change: it no longer uses proxy-protocol for its + internal web-server even when `reload-use-proxy-protocol` is set (plus a bugfix + around that flag).' + - 'Added additional validations: vmalertmanager runtime config validation; StatefulSet + volumeMount name validation; stricter vmalertmanagerconfig validation for + unknown fields; shard count bounds fix.' + features: + - Can set all VM and VLogs image versions via `VM_METRICS_VERSION` and `VM_LOGS_VERSION` + environment variables, reducing per-CR version pinning. + - vmauth can now serve internal routes on a separate port (`internalListenPort`) + for improved security/isolation. + - vmauth can optionally enable HAProxy PROXY protocol support via `useProxyProtocol`. + - vmalertmanager now validates runtime configuration, catching invalid configs + earlier. + breaking_changes: + - Config-reloader no longer uses proxy-protocol for its internal web server + even if `reload-use-proxy-protocol` is enabled; if you relied on proxy-protocol + on that internal endpoint, adjust your setup or remove the expectation. chart_version: 0.45.0 - images: ['victoriametrics/operator:v0.56.0'] + images: + - victoriametrics/operator:v0.56.0 - version: 0.55.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Default VictoriaMetrics app versions updated to VM v1.114.0 (from - v1.113.0) and VictoriaLogs (VLogs) to v1.17.0 (from v1.15.0)., Scrape target - OAuth2 configs now support `tls_config` and `proxy_url` fields., All VM - apps now support `extraEnvsFrom` to source env vars from a Secret or ConfigMap., - 'Services for vmstorage/vmselect/vmalertmanager now set `publishNotReadyAddresses: - true` to improve discovery/cluster formation during rollouts.', Operator - now logs a diff of field changes for key objects (Deployment/StatefulSet/Service/PDB/HPA/VMServiceScrape) - during reconcile for easier debugging., 'New global env vars control config-reloader - resources: `VM_CONFIG_RELOADER_LIMIT_CPU/MEMORY` (default `unlimited`) and - `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` (default empty); per-resource request - env vars are deprecated.', VMAgent adds beta `daemonSetMode` for running - as a DaemonSet., VMAgent reduces Kubernetes API load by removing selectors - from VMPodScrape kubernetes_sd_configs; original behavior can be restored - with `VMAgent.spec.enableKubernetesAPISelectors`., 'VMAgent remote write - disk usage fields improved: `remoteWrite.MaxDiskUsage` can be integer with - validation; `remoteWriteSettings.maxDiskUsagePerURL` supports byte-suffix - strings with validation.', 'Alertmanager config CRD gains new/updated receivers: - Discord adds `content`, `username`, `avatar_url`; new `jira_configs`, `rocketchat_configs`, - `msteamsv2_configs` (Alertmanager v0.28.0+).'] - breaking_changes: ['VMPodScrape-generated kubernetes_sd_configs no longer include - `selectors` by default, which can change scrape target selection; set `VMAgent.spec.enableKubernetesAPISelectors=true` - to restore the prior behavior.', 'Per-resource config-reloader request env - vars are now deprecated in favor of the new global `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` - controls (not an immediate break, but update values/automation accordingly).'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Default VictoriaMetrics app versions updated to VM v1.114.0 (from v1.113.0) + and VictoriaLogs (VLogs) to v1.17.0 (from v1.15.0). + - Scrape target OAuth2 configs now support `tls_config` and `proxy_url` fields. + - All VM apps now support `extraEnvsFrom` to source env vars from a Secret or + ConfigMap. + - 'Services for vmstorage/vmselect/vmalertmanager now set `publishNotReadyAddresses: + true` to improve discovery/cluster formation during rollouts.' + - Operator now logs a diff of field changes for key objects (Deployment/StatefulSet/Service/PDB/HPA/VMServiceScrape) + during reconcile for easier debugging. + - 'New global env vars control config-reloader resources: `VM_CONFIG_RELOADER_LIMIT_CPU/MEMORY` + (default `unlimited`) and `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` (default + empty); per-resource request env vars are deprecated.' + - VMAgent adds beta `daemonSetMode` for running as a DaemonSet. + - VMAgent reduces Kubernetes API load by removing selectors from VMPodScrape + kubernetes_sd_configs; original behavior can be restored with `VMAgent.spec.enableKubernetesAPISelectors`. + - 'VMAgent remote write disk usage fields improved: `remoteWrite.MaxDiskUsage` + can be integer with validation; `remoteWriteSettings.maxDiskUsagePerURL` supports + byte-suffix strings with validation.' + - 'Alertmanager config CRD gains new/updated receivers: Discord adds `content`, + `username`, `avatar_url`; new `jira_configs`, `rocketchat_configs`, `msteamsv2_configs` + (Alertmanager v0.28.0+).' + breaking_changes: + - VMPodScrape-generated kubernetes_sd_configs no longer include `selectors` + by default, which can change scrape target selection; set `VMAgent.spec.enableKubernetesAPISelectors=true` + to restore the prior behavior. + - Per-resource config-reloader request env vars are now deprecated in favor + of the new global `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` controls (not an + immediate break, but update values/automation accordingly). chart_version: 0.44.0 - images: ['victoriametrics/operator:v0.55.0'] + images: + - victoriametrics/operator:v0.55.0 - version: 0.54.1 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['vmalertmanagerconfig: added `thread_message_id` to `telegram_configs` - (requires Alertmanager v0.28.0+).', VMUser `targetRefs` can now reference - VLogs resources (VLogs support in VMUser).] + features: + - 'vmalertmanagerconfig: added `thread_message_id` to `telegram_configs` (requires + Alertmanager v0.28.0+).' + - VMUser `targetRefs` can now reference VLogs resources (VLogs support in VMUser). breaking_changes: [] chart_version: 0.43.1 - images: ['victoriametrics/operator:v0.54.1'] + images: + - victoriametrics/operator:v0.54.1 - version: 0.53.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Adds `thread_message_id` to `telegram_configs` in `VMAlertmanagerConfig` - (requires Alertmanager v0.28.0+)., Adds support for VLogs as a targetRef - in `VMUser` (VLogs can now be referenced in VMUser targetRefs)., "Updates\ - \ the operator\u2019s default VictoriaMetrics application versions to v1.110.0\ - \ (from v1.109.1).", Rebuilds operator with Go 1.23.5 (security patch upgrade).] + features: + - Adds `thread_message_id` to `telegram_configs` in `VMAlertmanagerConfig` (requires + Alertmanager v0.28.0+). + - Adds support for VLogs as a targetRef in `VMUser` (VLogs can now be referenced + in VMUser targetRefs). + - "Updates the operator\u2019s default VictoriaMetrics application versions\ + \ to v1.110.0 (from v1.109.1)." + - Rebuilds operator with Go 1.23.5 (security patch upgrade). breaking_changes: [] chart_version: 0.42.5 - images: ['victoriametrics/operator:v0.53.0'] + images: + - victoriametrics/operator:v0.53.0 - version: 0.52.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Default component versions bumped: VictoriaMetrics apps to v1.109.1 - and VictoriaLogs to v1.6.1 (if you rely on chart/operator defaults, workloads - may roll to these images).', 'VMScrapeConfig: GCE SD `zone` now supports - multiple values (may broaden discovery if you previously had to workaround).', - 'Operator performance/scale improvements: faster config regeneration (decoupled - from child status updates), reduced prometheus-converter API load, and higher - default Kubernetes client limits (`client.qps=50`, `client.burst=100`).', - New operator flag `controller.statusLastUpdateTimeTTL` (default 1h) to control - staleness detection for `status.conditions`; increase for very large fleets - (>>5k objects)., 'Richer failure diagnostics: `failed` status now includes - reason and crashed container logs.', 'VMServiceScrape generation: now exposes - only the well-known `http` port; job name for vmbackupmanager gets `-vmbackupmanager` - suffix.'] - breaking_changes: ['Metadata inheritance removal: `labels`/`annotations` inheritance - from CRD metadata is removed in v0.52.0. Move required labels/annotations - to `spec.managedMetadata`; after upgrade, inherited labels will be dropped - and annotation changes may be ignored (except preserved).', 'Potential scrape/job - changes: VMServiceScrape port exposure and job naming changes may affect - dashboards/alerts that match on port names or job names (especially vmbackupmanager).', - 'Behavioral change for large installs: new staleness detection may mark conditions - stale if `controller.statusLastUpdateTimeTTL` too low for your object count; - tune accordingly.'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Default component versions bumped: VictoriaMetrics apps to v1.109.1 and VictoriaLogs + to v1.6.1 (if you rely on chart/operator defaults, workloads may roll to these + images).' + - 'VMScrapeConfig: GCE SD `zone` now supports multiple values (may broaden discovery + if you previously had to workaround).' + - 'Operator performance/scale improvements: faster config regeneration (decoupled + from child status updates), reduced prometheus-converter API load, and higher + default Kubernetes client limits (`client.qps=50`, `client.burst=100`).' + - New operator flag `controller.statusLastUpdateTimeTTL` (default 1h) to control + staleness detection for `status.conditions`; increase for very large fleets + (>>5k objects). + - 'Richer failure diagnostics: `failed` status now includes reason and crashed + container logs.' + - 'VMServiceScrape generation: now exposes only the well-known `http` port; + job name for vmbackupmanager gets `-vmbackupmanager` suffix.' + breaking_changes: + - 'Metadata inheritance removal: `labels`/`annotations` inheritance from CRD + metadata is removed in v0.52.0. Move required labels/annotations to `spec.managedMetadata`; + after upgrade, inherited labels will be dropped and annotation changes may + be ignored (except preserved).' + - 'Potential scrape/job changes: VMServiceScrape port exposure and job naming + changes may affect dashboards/alerts that match on port names or job names + (especially vmbackupmanager).' + - 'Behavioral change for large installs: new staleness detection may mark conditions + stale if `controller.statusLastUpdateTimeTTL` too low for your object count; + tune accordingly.' chart_version: 0.41.2 - images: ['victoriametrics/operator:v0.52.0'] + images: + - victoriametrics/operator:v0.52.0 - version: 0.51.1 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Default VictoriaMetrics component versions bumped (v0.50.0 - -> VM 1.106.1; v0.51.1 -> VM apps 1.108.1, and VL default 1.3.2 as shown - in release notes).', Operator now supports generating manifests without - the admission webhook (useful for restricted clusters / simpler installs)., - 'Operator logging changed: structured logging fields moved into msg; logger - field adjusted to show controller.CRD name; new loggerJSONFields option - (introduced in v0.50.0) lets you customize JSON encoder field names.', 'Security - context handling adjusted: when useStrictSecurity=false, securityContext - is now properly applied; when useStrictSecurity=true, default privileged:false - is set for containers.', 'Generated object metadata improvements: VMCluster-generated - objects get label app.kubernetes.io/part-of=vmcluster; PodDisruptionBudget - and HorizontalPodAutoscaler generated by operator now include annotations.', - 'Scrape config generation/selection bugfixes for VMAgent selectors and namespaceSelectors, - especially around selectAllByDefault true/false and VMScrapeConfig inclusion - rules.', 'License options support added: license.forceOffile and license.reloadInterval.', - 'VMServiceScrape endpointSlice discovery enhancements: missing container labels - added to discovered metrics; new env var VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES - to default to endpointslices discovery role instead of endpoints.', 'API/CRDs - updated: new managedMetadata field added to several specs to control labels/annotations - on generated objects; status subresource reworked for multiple CRDs adding - conditions; new observedGeneration status field; updateStatus field unified - for some CRDs (replacing status/clusterStatus/singleStatus in VLogs/VMCluster/VMSingle).', - VMAuth/VMUser config generation improvements and new fields (unauthorizedUserAccessSpec; - dump_request_on_errors; fixed missing src_headers/src_query_args/discover_backend_ips - when using targetRefs).] - features: ['Option to enforce EndpointSlice-based discovery for VMServiceScrape - via VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES, plus added container - labels in discovered metrics.', New operator logger configuration flag loggerJSONFields - and updated structured logging output., managedMetadata field in multiple - CRDs to explicitly manage labels/annotations applied to operator-generated - resources., VMAuth gains unauthorizedUserAccessSpec (new structured way - to define unauthorized access behavior) and VMUser adds dump_request_on_errors; - VMUser targetRefs config generation fixes., Support for enterprise license - options license.forceOffile and license.reloadInterval., Ability to deploy - operator manifests without webhook., 'Security hardening defaults: privileged:false - when useStrictSecurity=true, plus corrected securityContext application - when not strict.'] - breaking_changes: ['CRD/API surface changes: new status/conditions/observedGeneration - and updateStatus unification may require updating any automation that reads/writes - status fields or relies on old status field names.', 'Deprecations introduced - (not removed yet): labels/annotations inheritance from CRD metadata is deprecated - in favor of spec.managedMetadata and will be removed in v0.52.0; VMAuth.spec.unauthorizedAccessConfig - and several inlined VMAuth.spec fields are deprecated in favor of unauthorizedUserAccessSpec - (supported until v1.0).'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Default VictoriaMetrics component versions bumped (v0.50.0 -> VM 1.106.1; + v0.51.1 -> VM apps 1.108.1, and VL default 1.3.2 as shown in release notes). + - Operator now supports generating manifests without the admission webhook (useful + for restricted clusters / simpler installs). + - 'Operator logging changed: structured logging fields moved into msg; logger + field adjusted to show controller.CRD name; new loggerJSONFields option (introduced + in v0.50.0) lets you customize JSON encoder field names.' + - 'Security context handling adjusted: when useStrictSecurity=false, securityContext + is now properly applied; when useStrictSecurity=true, default privileged:false + is set for containers.' + - 'Generated object metadata improvements: VMCluster-generated objects get label + app.kubernetes.io/part-of=vmcluster; PodDisruptionBudget and HorizontalPodAutoscaler + generated by operator now include annotations.' + - Scrape config generation/selection bugfixes for VMAgent selectors and namespaceSelectors, + especially around selectAllByDefault true/false and VMScrapeConfig inclusion + rules. + - 'License options support added: license.forceOffile and license.reloadInterval.' + - 'VMServiceScrape endpointSlice discovery enhancements: missing container labels + added to discovered metrics; new env var VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES + to default to endpointslices discovery role instead of endpoints.' + - 'API/CRDs updated: new managedMetadata field added to several specs to control + labels/annotations on generated objects; status subresource reworked for multiple + CRDs adding conditions; new observedGeneration status field; updateStatus + field unified for some CRDs (replacing status/clusterStatus/singleStatus in + VLogs/VMCluster/VMSingle).' + - VMAuth/VMUser config generation improvements and new fields (unauthorizedUserAccessSpec; + dump_request_on_errors; fixed missing src_headers/src_query_args/discover_backend_ips + when using targetRefs). + features: + - Option to enforce EndpointSlice-based discovery for VMServiceScrape via VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES, + plus added container labels in discovered metrics. + - New operator logger configuration flag loggerJSONFields and updated structured + logging output. + - managedMetadata field in multiple CRDs to explicitly manage labels/annotations + applied to operator-generated resources. + - VMAuth gains unauthorizedUserAccessSpec (new structured way to define unauthorized + access behavior) and VMUser adds dump_request_on_errors; VMUser targetRefs + config generation fixes. + - Support for enterprise license options license.forceOffile and license.reloadInterval. + - Ability to deploy operator manifests without webhook. + - 'Security hardening defaults: privileged:false when useStrictSecurity=true, + plus corrected securityContext application when not strict.' + breaking_changes: + - 'CRD/API surface changes: new status/conditions/observedGeneration and updateStatus + unification may require updating any automation that reads/writes status fields + or relies on old status field names.' + - 'Deprecations introduced (not removed yet): labels/annotations inheritance + from CRD metadata is deprecated in favor of spec.managedMetadata and will + be removed in v0.52.0; VMAuth.spec.unauthorizedAccessConfig and several inlined + VMAuth.spec fields are deprecated in favor of unauthorizedUserAccessSpec (supported + until v1.0).' chart_version: 0.40.1 - images: ['victoriametrics/operator:v0.51.1'] + images: + - victoriametrics/operator:v0.51.1 - version: 0.50.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Added missing `container` labels for metrics discovered via `VMServiceScrape` - when using `endpointslices` discovery, improving metric labeling consistency.', - Operator now defaults VictoriaMetrics component images/versions to v1.106.1 - (from v1.106.0)., New env var `VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES` - to force `endpointslices` (instead of `endpoints`) as the discovery role - for `VMServiceScrape` when generating VMAgent scrape config., New operator - logger option/flag `loggerJSONFields` to customize JSON encoder field names - in logs., CRDs now expose `status.observedGeneration` to help clients understand - whether status reflects the latest spec generation., 'CRD status fields - were unified: `status` / `clusterStatus` / `singleStatus` for `VLogs`, `VMCluster`, - `VMSingle` replaced by a generic `updateStatus` field.'] - breaking_changes: ['CRD status schema change: `VLogs`, `VMCluster`, and `VMSingle` - status fields (`status`, `clusterStatus`, `singleStatus`) are replaced by - `updateStatus`. Anything reading these old fields (dashboards, scripts, - controllers) must be updated accordingly.', "`VMAuth` spec change (already\ - \ in v0.49.0 but relevant if you\u2019re upgrading across it): `spec.configSecret`\ - \ moved to `spec.externalConfig.secretRef.name`, and `spec.externalConfig.localPath`\ - \ was added. Existing manifests must be updated or they will fail validation/behavior\ - \ will change."] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Added missing `container` labels for metrics discovered via `VMServiceScrape` + when using `endpointslices` discovery, improving metric labeling consistency. + - Operator now defaults VictoriaMetrics component images/versions to v1.106.1 + (from v1.106.0). + - New env var `VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES` to force `endpointslices` + (instead of `endpoints`) as the discovery role for `VMServiceScrape` when + generating VMAgent scrape config. + - New operator logger option/flag `loggerJSONFields` to customize JSON encoder + field names in logs. + - CRDs now expose `status.observedGeneration` to help clients understand whether + status reflects the latest spec generation. + - 'CRD status fields were unified: `status` / `clusterStatus` / `singleStatus` + for `VLogs`, `VMCluster`, `VMSingle` replaced by a generic `updateStatus` + field.' + breaking_changes: + - 'CRD status schema change: `VLogs`, `VMCluster`, and `VMSingle` status fields + (`status`, `clusterStatus`, `singleStatus`) are replaced by `updateStatus`. + Anything reading these old fields (dashboards, scripts, controllers) must + be updated accordingly.' + - "`VMAuth` spec change (already in v0.49.0 but relevant if you\u2019re upgrading\ + \ across it): `spec.configSecret` moved to `spec.externalConfig.secretRef.name`,\ + \ and `spec.externalConfig.localPath` was added. Existing manifests must be\ + \ updated or they will fail validation/behavior will change." chart_version: 0.39.1 - images: ['victoriametrics/operator:v0.50.0'] + images: + - victoriametrics/operator:v0.50.0 - version: 0.49.0 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator behavior/security fix: `useStrictSecurity: true` is - now properly applied to initContainers for VMAuth, VMAgent, and VMAlertmanager - (may cause previously-working permissive initContainers to become restricted).', - 'VMAuth CRD schema change: `spec.configSecret` moved to `spec.externalConfig.secretRef.name`; - new `spec.externalConfig.localPath` added for providing custom configs via - sidecar.', 'VMCluster CRD enhancement: add `spec.requestsLoadBalancer` configuration.', - 'VMCluster monitoring: fixes/adjustments when `backup` is enabled so monitoring - is configured correctly.', 'VMAlertmanager: config reload now triggers when - a ConfigMap referenced via `.spec.configMap` changes.', 'Operator reconciliation - fixes: handles storage size changes correctly; fixes conversion from AlertmanagerConfig - to VMAlertmanagerConfig.', Default VictoriaMetrics component versions bumped - to 1.106.0 (release tag referenced 1.106.6).] - features: ['InitContainers now honor strict security settings (`useStrictSecurity`) - for VMAuth/VMAgent/VMAlertmanager, improving hardening consistency.', VMAuth - can consume external config via `externalConfig` (secretRef + optional localPath) - enabling sidecar-driven config delivery., VMCluster can be configured with - `requestsLoadBalancer` to influence service/load balancer request behavior., - Improved monitoring wiring for VMCluster deployments that enable backups., - 'VMAlertmanager now reloads when the referenced ConfigMap changes, reducing - need for manual restarts.'] - breaking_changes: ["VMAuth spec change: `spec.configSecret` is replaced by `spec.externalConfig.secretRef.name`\ - \ (you must migrate manifests/Helm values or VMAuth config won\u2019t be\ - \ found).", 'Security behavior change: enabling `useStrictSecurity: true` - now affects initContainers too; clusters relying on more permissive initContainer - security settings may see pods fail to start until securityContext/permissions - are adjusted.'] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Operator behavior/security fix: `useStrictSecurity: true` is now properly + applied to initContainers for VMAuth, VMAgent, and VMAlertmanager (may cause + previously-working permissive initContainers to become restricted).' + - 'VMAuth CRD schema change: `spec.configSecret` moved to `spec.externalConfig.secretRef.name`; + new `spec.externalConfig.localPath` added for providing custom configs via + sidecar.' + - 'VMCluster CRD enhancement: add `spec.requestsLoadBalancer` configuration.' + - 'VMCluster monitoring: fixes/adjustments when `backup` is enabled so monitoring + is configured correctly.' + - 'VMAlertmanager: config reload now triggers when a ConfigMap referenced via + `.spec.configMap` changes.' + - 'Operator reconciliation fixes: handles storage size changes correctly; fixes + conversion from AlertmanagerConfig to VMAlertmanagerConfig.' + - Default VictoriaMetrics component versions bumped to 1.106.0 (release tag + referenced 1.106.6). + features: + - InitContainers now honor strict security settings (`useStrictSecurity`) for + VMAuth/VMAgent/VMAlertmanager, improving hardening consistency. + - VMAuth can consume external config via `externalConfig` (secretRef + optional + localPath) enabling sidecar-driven config delivery. + - VMCluster can be configured with `requestsLoadBalancer` to influence service/load + balancer request behavior. + - Improved monitoring wiring for VMCluster deployments that enable backups. + - VMAlertmanager now reloads when the referenced ConfigMap changes, reducing + need for manual restarts. + breaking_changes: + - "VMAuth spec change: `spec.configSecret` is replaced by `spec.externalConfig.secretRef.name`\ + \ (you must migrate manifests/Helm values or VMAuth config won\u2019t be found)." + - 'Security behavior change: enabling `useStrictSecurity: true` now affects + initContainers too; clusters relying on more permissive initContainer security + settings may see pods fail to start until securityContext/permissions are + adjusted.' chart_version: 0.37.0 - images: ['victoriametrics/operator:v0.49.0'] + images: + - victoriametrics/operator:v0.49.0 - version: 0.48.0 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator now supports enabling/disabling use of VM config-reloader - per resource (VMAgent/VMAlert/VMAuth/VMAlertmanager) and configuring reloader - image tag/resources via CRD fields (`useVMConfigReloader`, `configReloaderImageTag`, - `configReloaderResources`).', Webhook port is now configurable (ensure your - Helm values/Service/NetworkPolicy match if you override defaults)., 'Operator - enables controller-runtime cache for Secrets/ConfigMaps again; can be disabled - via flag `-controller.disableCacheFor=seccret,configmap` (spelling per release - note).', Operator now trims spaces from Secret/ConfigMap values by default; - can be disabled via flag `disableSecretKeySpaceTrim`., Default VictoriaMetrics - app versions bumped to v1.103.0 (expect downstream image tag changes if - you rely on chart defaults)., PVCs for VMSingle/VLogs gain ownerReferences - to improve Argo CD compatibility (may affect GitOps drift/garbage-collection - behavior)., PDB enabled status is now respected (behavior change if you - previously relied on operator creating PDBs even when disabled).] - features: ['Per-resource control over using VM config-reloader and its image/resources - for VMAgent, VMAlert, VMAuth, and VMAlertmanager.', VMAlertmanager can enforce - top-level route matchers via `enforcedTopRouteMatchers` applied to all VMAlertmanagerConfig - objects., 'New/extended API knobs: `host_aliases` (underscore form prioritized), - per-app `useDefaultResources` and `disableSelfServiceScrape`, `clusterDomainName` - for VMCluster/VMAlertmanager, and expanded securityContext propagation to - containers.', 'Operational improvements: reduced reconcile latency and lower - kube-apiserver load; re-enabled caching for Secrets/ConfigMaps to improve - performance.'] - breaking_changes: [Default behavior now trims whitespace in Secret/ConfigMap - values used for generated configs; this can change credentials/URLs if they - relied on trailing/leading spaces., 'If you deploy behind strict NetworkPolicies/firewalls, - the webhook port being configurable may require you to adjust any policies/services - if you change it from the default.', 'PVC ownerReferences added for VMSingle/VLogs - can change deletion/GC semantics in GitOps setups (e.g., Argo CD pruning) - if you previously managed PVCs separately.'] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator now supports enabling/disabling use of VM config-reloader per resource + (VMAgent/VMAlert/VMAuth/VMAlertmanager) and configuring reloader image tag/resources + via CRD fields (`useVMConfigReloader`, `configReloaderImageTag`, `configReloaderResources`). + - Webhook port is now configurable (ensure your Helm values/Service/NetworkPolicy + match if you override defaults). + - Operator enables controller-runtime cache for Secrets/ConfigMaps again; can + be disabled via flag `-controller.disableCacheFor=seccret,configmap` (spelling + per release note). + - Operator now trims spaces from Secret/ConfigMap values by default; can be + disabled via flag `disableSecretKeySpaceTrim`. + - Default VictoriaMetrics app versions bumped to v1.103.0 (expect downstream + image tag changes if you rely on chart defaults). + - PVCs for VMSingle/VLogs gain ownerReferences to improve Argo CD compatibility + (may affect GitOps drift/garbage-collection behavior). + - PDB enabled status is now respected (behavior change if you previously relied + on operator creating PDBs even when disabled). + features: + - Per-resource control over using VM config-reloader and its image/resources + for VMAgent, VMAlert, VMAuth, and VMAlertmanager. + - VMAlertmanager can enforce top-level route matchers via `enforcedTopRouteMatchers` + applied to all VMAlertmanagerConfig objects. + - 'New/extended API knobs: `host_aliases` (underscore form prioritized), per-app + `useDefaultResources` and `disableSelfServiceScrape`, `clusterDomainName` + for VMCluster/VMAlertmanager, and expanded securityContext propagation to + containers.' + - 'Operational improvements: reduced reconcile latency and lower kube-apiserver + load; re-enabled caching for Secrets/ConfigMaps to improve performance.' + breaking_changes: + - Default behavior now trims whitespace in Secret/ConfigMap values used for + generated configs; this can change credentials/URLs if they relied on trailing/leading + spaces. + - If you deploy behind strict NetworkPolicies/firewalls, the webhook port being + configurable may require you to adjust any policies/services if you change + it from the default. + - PVC ownerReferences added for VMSingle/VLogs can change deletion/GC semantics + in GitOps setups (e.g., Argo CD pruning) if you previously managed PVCs separately. chart_version: 0.35.0 - images: ['victoriametrics/operator:v0.48.0'] + images: + - victoriametrics/operator:v0.48.0 - version: 0.47.0 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator behavior changes for VMAlertmanagerConfig: forbids - cross-resource or global receiver references; config must only reference - local receivers.', 'VMAlertmanagerConfig API change: removed deprecated - `spec.mute_time_intervals`; use `spec.time_intervals` instead.', 'VMAlertmanager - default routing change: if root route receiver is empty, operator now sets - `blackhole` receiver instead of choosing the first VMAlertmanagerConfig - receiver.', 'New CRD/resource support: adds `VLogs` for managing VictoriaLogs - via the operator.', 'Config reloader: new TLS flags for securing the reload - endpoint (`tlsCaFile`, `tlsCertFile`, `tlsKeyFile`, `tlsServerName`, `tlsInsecureSkipVerify`).', - 'VMUser: adds `status.lastSyncError`; adds validation for `spec.targetRefs.crd.kind`; - can skip generating VMAuth config for invalid VMUser refs (recommended to - enable validation webhook).', 'Scrape objects: adds `status` and `lastSyncError` - to `VMServiceScrape`, `VMPodScrape`, `VMNodeScrape`, `VMStaticScrape`, and - `VMScrapeConfig` to track vmagent config generation.', VMAgent config builder - refactor; fixes incorrect skipping logic for scrape objects with bad Secret/ConfigMap - refs., 'Operator metrics endpoint: can secure `metrics-bind-address` with - TLS/mTLS via flags (`tls.*`, `mtls.*`).', 'TLS asset naming fix: adds `configmap` - prefix to ConfigMap-referenced TLS assets to avoid Secret/ConfigMap name - clashes.', 'PodDisruptionBudget finalizer fix: properly releases PDB finalizer - (previously could stick due to typo); plus general finalizer refactor.', - 'Auto-created VMServiceScrape for CRD objects from `extraArgs`: adds `tls_config` - and `authKey` settings.', 'VMAlertmanagerConfig: improved validation and - adds `status`/`lastSyncError` fields.', 'VMAlertmanager: adds `webConfig` - for easier TLS configuration and correct probe/URL generation; adds `gossipConfig` - for client/server TLS on gossip.', 'VMAgent/VMSingle: stream aggregation - options synced with upstream (`dropInputLabels`, `ignoreFirstIntervals`, - `ignoreOldSamples`) and supports configMap as aggregation rules source.', - 'Operator: adds `-client.qps` and `-client.burst` flags to tune Kubernetes - API client behavior.'] - features: [Adds a new `VLogs` custom resource to manage VictoriaLogs through - the operator., Adds TLS configuration options to the config-reloader so - reload endpoints can be secured., Adds status and lastSyncError fields across - scrape-related resources to help troubleshoot vmagent config generation., - Adds operator TLS/mTLS support for the metrics endpoint and improves TLS asset - handling to avoid naming clashes., Enhances VMAlertmanager with webConfig - and gossipConfig for simpler TLS and secure gossip communication., Adds - additional stream aggregation options and supports configMap-based aggregation - rules for vmagent/vmsingle., 'Adds Kubernetes client tuning flags (`client.qps`, - `client.burst`) for large clusters or API rate limiting scenarios.'] - breaking_changes: [VMAlertmanagerConfig can no longer reference receivers across - other VMAlertmanagerConfig objects or use global receiver references; receivers - must be local to the object., '`VMAlertmanagerConfig.spec.mute_time_intervals` - has been removed; migrate to `VMAlertmanagerConfig.spec.time_intervals`.', - 'If a VMAlertmanager root route has an empty receiver, the operator now sets - it to `blackhole` (previously it picked the first VMAlertmanagerConfig receiver), - which can change alert delivery until you set an explicit receiver.'] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Operator behavior changes for VMAlertmanagerConfig: forbids cross-resource + or global receiver references; config must only reference local receivers.' + - 'VMAlertmanagerConfig API change: removed deprecated `spec.mute_time_intervals`; + use `spec.time_intervals` instead.' + - 'VMAlertmanager default routing change: if root route receiver is empty, operator + now sets `blackhole` receiver instead of choosing the first VMAlertmanagerConfig + receiver.' + - 'New CRD/resource support: adds `VLogs` for managing VictoriaLogs via the + operator.' + - 'Config reloader: new TLS flags for securing the reload endpoint (`tlsCaFile`, + `tlsCertFile`, `tlsKeyFile`, `tlsServerName`, `tlsInsecureSkipVerify`).' + - 'VMUser: adds `status.lastSyncError`; adds validation for `spec.targetRefs.crd.kind`; + can skip generating VMAuth config for invalid VMUser refs (recommended to + enable validation webhook).' + - 'Scrape objects: adds `status` and `lastSyncError` to `VMServiceScrape`, `VMPodScrape`, + `VMNodeScrape`, `VMStaticScrape`, and `VMScrapeConfig` to track vmagent config + generation.' + - VMAgent config builder refactor; fixes incorrect skipping logic for scrape + objects with bad Secret/ConfigMap refs. + - 'Operator metrics endpoint: can secure `metrics-bind-address` with TLS/mTLS + via flags (`tls.*`, `mtls.*`).' + - 'TLS asset naming fix: adds `configmap` prefix to ConfigMap-referenced TLS + assets to avoid Secret/ConfigMap name clashes.' + - 'PodDisruptionBudget finalizer fix: properly releases PDB finalizer (previously + could stick due to typo); plus general finalizer refactor.' + - 'Auto-created VMServiceScrape for CRD objects from `extraArgs`: adds `tls_config` + and `authKey` settings.' + - 'VMAlertmanagerConfig: improved validation and adds `status`/`lastSyncError` + fields.' + - 'VMAlertmanager: adds `webConfig` for easier TLS configuration and correct + probe/URL generation; adds `gossipConfig` for client/server TLS on gossip.' + - 'VMAgent/VMSingle: stream aggregation options synced with upstream (`dropInputLabels`, + `ignoreFirstIntervals`, `ignoreOldSamples`) and supports configMap as aggregation + rules source.' + - 'Operator: adds `-client.qps` and `-client.burst` flags to tune Kubernetes + API client behavior.' + features: + - Adds a new `VLogs` custom resource to manage VictoriaLogs through the operator. + - Adds TLS configuration options to the config-reloader so reload endpoints + can be secured. + - Adds status and lastSyncError fields across scrape-related resources to help + troubleshoot vmagent config generation. + - Adds operator TLS/mTLS support for the metrics endpoint and improves TLS asset + handling to avoid naming clashes. + - Enhances VMAlertmanager with webConfig and gossipConfig for simpler TLS and + secure gossip communication. + - Adds additional stream aggregation options and supports configMap-based aggregation + rules for vmagent/vmsingle. + - Adds Kubernetes client tuning flags (`client.qps`, `client.burst`) for large + clusters or API rate limiting scenarios. + breaking_changes: + - VMAlertmanagerConfig can no longer reference receivers across other VMAlertmanagerConfig + objects or use global receiver references; receivers must be local to the + object. + - '`VMAlertmanagerConfig.spec.mute_time_intervals` has been removed; migrate + to `VMAlertmanagerConfig.spec.time_intervals`.' + - If a VMAlertmanager root route has an empty receiver, the operator now sets + it to `blackhole` (previously it picked the first VMAlertmanagerConfig receiver), + which can change alert delivery until you set an explicit receiver. chart_version: 0.34.0 - images: ['victoriametrics/operator:v0.47.0'] + images: + - victoriametrics/operator:v0.47.0 - version: 0.46.4 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator base image switched from distroless to scratch (v0.46.4); - this can affect debugging/exec tooling and image scanning expectations., - Operator manifests no longer set an explicit `runAsUser`; it must be defined - via image defaults or pod security context/profile (v0.46.4)., Config-reloader - container no longer specifies `command`; it is defined in the image now - (v0.46.4)., 'OperatorHub bundle change: `VMAgent` deployment `ServiceAccount - vmagent` is no longer shipped; operator will recreate a new SA with required - permissions after removal (v0.46.4).', 'OperatorHub manifests: `webhook.enable` - is properly wired for OperatorHub deployments (v0.46.4).', "kubebuilder\ - \ upgrade v2 \u2192 v4 (v0.46.0) and Kubernetes code-generator upgrade v0.27.11\ - \ \u2192 v0.30.0 (v0.46.0) \u2014 implies regenerated CRDs/webhooks and\ - \ potential RBAC/manager flag changes.", "cert-manager API upgrade `certificates.cert-manager.io/v1alpha2`\ - \ \u2192 `certificates.cert-manager.io/v1` (v0.46.0).", 'Selector behavior - fix: `xxNamespaceSelector` and `xxSelector` were previously inverted and - are corrected (v0.46.0).', 'VMNodeScrape scrape_config generation fix: de-dup - `series_limit` / `sample_limit` fields (v0.46.0).'] - features: [VMUser service discovery can now be configured to use HTTPS via a - TLS flag check in `AsURL` (v0.46.0)., 'VMRule supports syncing group attributes - `eval_offset`, `eval_delay`, and `eval_alignment` from upstream vmalert - group settings (v0.46.0).', VMAlertmanagerConfig reconcile loop now includes - a `handleReconcileErr` callback to better handle errors and deregister objects - (v0.46.0).] - breaking_changes: ["Operator flag deprecations: `--metrics-addr` \u2192 `--metrics-bind-address`,\ - \ `--enable-leader-election` \u2192 `--leader-elect`, `--http.readyListenAddr`\ - \ \u2192 `--health-probe-bind-address` (v0.46.0).", 'Remote write multitenancy - change: when using `remoteWriteSettings.useMultiTenantMode`, `remoteWrite.url` - must include `/insert/multitenant/` because upstream vmagent deprecated - `-remoteWrite.multitenantURL` (v0.46.0).', "OperatorHub VMAgent deployment\ - \ change: remove the `vmagent` ServiceAccount since it\u2019s no longer\ - \ shipped; operator will create a new SA with needed permissions (v0.46.4).", - Manifests no longer pin `runAsUser`; you must set user at image or security - context/profile level if required by your policies (v0.46.4)., 'Container - entrypoints changed: operator base image is now `scratch` and config-reloader - no longer sets `command` explicitly; any assumptions about shell/tools/command - overrides may break (v0.46.4).'] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator base image switched from distroless to scratch (v0.46.4); this can + affect debugging/exec tooling and image scanning expectations. + - Operator manifests no longer set an explicit `runAsUser`; it must be defined + via image defaults or pod security context/profile (v0.46.4). + - Config-reloader container no longer specifies `command`; it is defined in + the image now (v0.46.4). + - 'OperatorHub bundle change: `VMAgent` deployment `ServiceAccount vmagent` + is no longer shipped; operator will recreate a new SA with required permissions + after removal (v0.46.4).' + - 'OperatorHub manifests: `webhook.enable` is properly wired for OperatorHub + deployments (v0.46.4).' + - "kubebuilder upgrade v2 \u2192 v4 (v0.46.0) and Kubernetes code-generator\ + \ upgrade v0.27.11 \u2192 v0.30.0 (v0.46.0) \u2014 implies regenerated CRDs/webhooks\ + \ and potential RBAC/manager flag changes." + - "cert-manager API upgrade `certificates.cert-manager.io/v1alpha2` \u2192 `certificates.cert-manager.io/v1`\ + \ (v0.46.0)." + - 'Selector behavior fix: `xxNamespaceSelector` and `xxSelector` were previously + inverted and are corrected (v0.46.0).' + - 'VMNodeScrape scrape_config generation fix: de-dup `series_limit` / `sample_limit` + fields (v0.46.0).' + features: + - VMUser service discovery can now be configured to use HTTPS via a TLS flag + check in `AsURL` (v0.46.0). + - VMRule supports syncing group attributes `eval_offset`, `eval_delay`, and + `eval_alignment` from upstream vmalert group settings (v0.46.0). + - VMAlertmanagerConfig reconcile loop now includes a `handleReconcileErr` callback + to better handle errors and deregister objects (v0.46.0). + breaking_changes: + - "Operator flag deprecations: `--metrics-addr` \u2192 `--metrics-bind-address`,\ + \ `--enable-leader-election` \u2192 `--leader-elect`, `--http.readyListenAddr`\ + \ \u2192 `--health-probe-bind-address` (v0.46.0)." + - 'Remote write multitenancy change: when using `remoteWriteSettings.useMultiTenantMode`, + `remoteWrite.url` must include `/insert/multitenant/` because upstream + vmagent deprecated `-remoteWrite.multitenantURL` (v0.46.0).' + - "OperatorHub VMAgent deployment change: remove the `vmagent` ServiceAccount\ + \ since it\u2019s no longer shipped; operator will create a new SA with needed\ + \ permissions (v0.46.4)." + - Manifests no longer pin `runAsUser`; you must set user at image or security + context/profile level if required by your policies (v0.46.4). + - 'Container entrypoints changed: operator base image is now `scratch` and config-reloader + no longer sets `command` explicitly; any assumptions about shell/tools/command + overrides may break (v0.46.4).' chart_version: 0.33.6 - images: ['victoriametrics/operator:v0.46.4'] + images: + - victoriametrics/operator:v0.46.4 - version: 0.46.0 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["Operator CLI flags deprecated/renamed: `--metrics-addr`\u2192\ - `--metrics-bind-address`, `--enable-leader-election`\u2192`--leader-elect`,\ - \ `--http.readyListenAddr`\u2192`--health-probe-bind-address` (update your\ - \ deployment/Helm chart args if you set these).", 'vmagent multitenancy: - when `remoteWriteSettings.useMultiTenantMode` is enabled, `remoteWrite.url` - must include the `/insert/multitenant/` path (upstream vmagent deprecated - `-remoteWrite.multitenantURL` since v1.102.0).', 'VMUser service discovery: - operator now checks `tls` flag in `AsURL`, enabling `https` config for VMUser - SD.', "Kubebuilder upgraded v2\u2192v4 (operator scaffolding/tooling change;\ - \ may affect CRDs generation/behavior).", Operator images switched to distroless - base (may impact debugging/exec into container; ensure tooling expectations)., - "cert-manager API upgraded `certificates.cert-manager.io/v1alpha2`\u2192`certificates.cert-manager.io/v1`\ - \ (update CRDs/manifests if you use cert-manager resources).", "code-generator\ - \ upgraded v0.27.11\u2192v0.30.0.", "Fix selector logic: VM CRs\u2019 `xxNamespaceSelector`\ - \ and `xxSelector` were inverted previously; behavior changes after upgrade\ - \ (may alter which targets/rules are selected).", 'VMAlertmanagerConfig - reconcile loop: adds missing `handleReconcileErr` to properly handle errors/deregister - objects.', 'VMRule: group attributes `eval_offset`, `eval_delay`, `eval_alignment` - synced with upstream vmalert.', 'VMNodeScrape: remove duplicated `series_limit` - and `sample_limit` fields in generated `scrape_config`.'] - features: [VMUser service discovery can now be configured for HTTPS via `tls` - handling in URL generation., 'VMRule supports additional group scheduling - attributes (`eval_offset`, `eval_delay`, `eval_alignment`) aligned with - upstream vmalert.', Improved reconciliation robustness for VMAlertmanagerConfig - via proper error handling and object deregistration.] - breaking_changes: ['Operator flag names have changed (old flags are deprecated); - Helm values/args must be updated if you set metrics address, leader election, - or readiness/health probe listen address flags.', 'vmagent multitenancy - configuration changes: multitenant write URLs must include `/insert/multitenant/` - when `useMultiTenantMode` is enabled, otherwise remote write may fail or - write to wrong endpoint.', 'Selector inversion fix changes behavior: resources - selected by `xxSelector`/`xxNamespaceSelector` may differ after upgrade, - potentially adding/removing scrape targets or rules.'] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "Operator CLI flags deprecated/renamed: `--metrics-addr`\u2192`--metrics-bind-address`,\ + \ `--enable-leader-election`\u2192`--leader-elect`, `--http.readyListenAddr`\u2192\ + `--health-probe-bind-address` (update your deployment/Helm chart args if you\ + \ set these)." + - 'vmagent multitenancy: when `remoteWriteSettings.useMultiTenantMode` is enabled, + `remoteWrite.url` must include the `/insert/multitenant/` path (upstream + vmagent deprecated `-remoteWrite.multitenantURL` since v1.102.0).' + - 'VMUser service discovery: operator now checks `tls` flag in `AsURL`, enabling + `https` config for VMUser SD.' + - "Kubebuilder upgraded v2\u2192v4 (operator scaffolding/tooling change; may\ + \ affect CRDs generation/behavior)." + - Operator images switched to distroless base (may impact debugging/exec into + container; ensure tooling expectations). + - "cert-manager API upgraded `certificates.cert-manager.io/v1alpha2`\u2192`certificates.cert-manager.io/v1`\ + \ (update CRDs/manifests if you use cert-manager resources)." + - "code-generator upgraded v0.27.11\u2192v0.30.0." + - "Fix selector logic: VM CRs\u2019 `xxNamespaceSelector` and `xxSelector` were\ + \ inverted previously; behavior changes after upgrade (may alter which targets/rules\ + \ are selected)." + - 'VMAlertmanagerConfig reconcile loop: adds missing `handleReconcileErr` to + properly handle errors/deregister objects.' + - 'VMRule: group attributes `eval_offset`, `eval_delay`, `eval_alignment` synced + with upstream vmalert.' + - 'VMNodeScrape: remove duplicated `series_limit` and `sample_limit` fields + in generated `scrape_config`.' + features: + - VMUser service discovery can now be configured for HTTPS via `tls` handling + in URL generation. + - VMRule supports additional group scheduling attributes (`eval_offset`, `eval_delay`, + `eval_alignment`) aligned with upstream vmalert. + - Improved reconciliation robustness for VMAlertmanagerConfig via proper error + handling and object deregistration. + breaking_changes: + - Operator flag names have changed (old flags are deprecated); Helm values/args + must be updated if you set metrics address, leader election, or readiness/health + probe listen address flags. + - 'vmagent multitenancy configuration changes: multitenant write URLs must include + `/insert/multitenant/` when `useMultiTenantMode` is enabled, otherwise + remote write may fail or write to wrong endpoint.' + - 'Selector inversion fix changes behavior: resources selected by `xxSelector`/`xxNamespaceSelector` + may differ after upgrade, potentially adding/removing scrape targets or rules.' chart_version: 0.33.1 - images: ['victoriametrics/operator:v0.46.0'] + images: + - victoriametrics/operator:v0.46.0 - version: 0.45.0 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator CLI surface changed: only operator-related flags are - exposed; transitive dependency flags removed (may affect Helm chart values - that pass extra args).', 'Finalizer handling adjusted: uses Patch for finalizer - set/unset (0.44.0) and removes finalizers for child objects with non-empty - DeletionTimestamp (0.45.0) to avoid stuck deletions.', "PVC/storageClass\ - \ reconciliation logic changed: storageClass checks are skipped when PVC\ - \ size doesn\u2019t change (0.45.0).", 'VMAgent status enhancements: status.selector - is set to better support VPA; new streamAggrConfig fields added (requires - vmagent v1.100+ to use).', 'Pause support added: spec.pause field added - across multiple CRDs to suspend reconciliation.', "VMAlertmanager secret-name\ - \ collision behavior changed: if cr.spec.configSecret name clashes with\ - \ operator-managed secret, the CR\u2019s secret content is ignored to prevent\ - \ overwriting.", 'VMAuth fixes: targetRef URL building when default http - port changes; deployment fix when using custom reloader.', 'Converters improved: - ScrapeConfig converter copies only spec and fixes ownerRef type; AlertmanagerConfig - converter fix for opsgenie_configs; reduced API discovery scope to monitoring.coreos.com/* - only.', 'VMScrapeConfig: authorization.type defaulting to Bearer works with - empty type.'] - features: [New `spec.pause` field on multiple VictoriaMetrics CRDs to suspend - operator reconciliation when needed., 'Additional `vmagent.streamAggrConfig` - tuning fields (dedup interval, ignore old samples, keep metric names, no-align - flush) available when running vmagent v1.100+.', '`vmagent` now populates - `status.selector`, improving compatibility with Vertical Pod Autoscaler - (VPA).', Improved and safer conversion tooling for Prometheus Operator resources - and AlertmanagerConfig (including opsgenie receiver configs)., Reduced cluster - API discovery footprint for prometheus-converter by querying only required - API groups.] - breaking_changes: ['Operator command-line flags exposed by the container changed: - transitive dependency flags were removed. Helm charts that set extraArgs/flags - may fail to start if they pass now-unknown flags.', 'VMAlertmanager behavior - change on configSecret name collision: if you previously relied on using - the same secret name as the operator-managed secret, your provided config - may now be ignored.'] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Operator CLI surface changed: only operator-related flags are exposed; transitive + dependency flags removed (may affect Helm chart values that pass extra args).' + - 'Finalizer handling adjusted: uses Patch for finalizer set/unset (0.44.0) + and removes finalizers for child objects with non-empty DeletionTimestamp + (0.45.0) to avoid stuck deletions.' + - "PVC/storageClass reconciliation logic changed: storageClass checks are skipped\ + \ when PVC size doesn\u2019t change (0.45.0)." + - 'VMAgent status enhancements: status.selector is set to better support VPA; + new streamAggrConfig fields added (requires vmagent v1.100+ to use).' + - 'Pause support added: spec.pause field added across multiple CRDs to suspend + reconciliation.' + - "VMAlertmanager secret-name collision behavior changed: if cr.spec.configSecret\ + \ name clashes with operator-managed secret, the CR\u2019s secret content\ + \ is ignored to prevent overwriting." + - 'VMAuth fixes: targetRef URL building when default http port changes; deployment + fix when using custom reloader.' + - 'Converters improved: ScrapeConfig converter copies only spec and fixes ownerRef + type; AlertmanagerConfig converter fix for opsgenie_configs; reduced API discovery + scope to monitoring.coreos.com/* only.' + - 'VMScrapeConfig: authorization.type defaulting to Bearer works with empty + type.' + features: + - New `spec.pause` field on multiple VictoriaMetrics CRDs to suspend operator + reconciliation when needed. + - Additional `vmagent.streamAggrConfig` tuning fields (dedup interval, ignore + old samples, keep metric names, no-align flush) available when running vmagent + v1.100+. + - '`vmagent` now populates `status.selector`, improving compatibility with Vertical + Pod Autoscaler (VPA).' + - Improved and safer conversion tooling for Prometheus Operator resources and + AlertmanagerConfig (including opsgenie receiver configs). + - Reduced cluster API discovery footprint for prometheus-converter by querying + only required API groups. + breaking_changes: + - 'Operator command-line flags exposed by the container changed: transitive + dependency flags were removed. Helm charts that set extraArgs/flags may fail + to start if they pass now-unknown flags.' + - 'VMAlertmanager behavior change on configSecret name collision: if you previously + relied on using the same secret name as the operator-managed secret, your + provided config may now be ignored.' chart_version: 0.32.3 - images: ['victoriametrics/operator:v0.45.0'] + images: + - victoriametrics/operator:v0.45.0 - version: 0.44.0 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Adds `spec.pause` to multiple CRDs (VMAgent, VMAlert, VMAuth, VMCluster, - VMAlertmanager, VMSingle) to suspend reconciliation.', 'Extends `VMAgent.spec.streamAggrConfig` - with new options (`dedup_interval`, `ignore_old_samples`, `keep_metric_names`, - `no_align_flush_to_interval`); requires vmagent v1.100+.', Sets `VMAgent.status.selector` - to support correct integration with Vertical Pod Autoscaler (VPA)., 'Syncs - VMAuth/VMUser config fields with upstream vmauth (e.g., `src_query_args`, - `discover_backend_ips`).', Fixes prometheus-operator ScrapeConfig converter - behavior and corrects VMScrapeConfig owner reference handling., Improves - VMScrapeConfig SD `authorization` handling when `type` is empty (defaults - to Bearer).] - breaking_changes: [New `streamAggrConfig` fields are only usable with vmagent - v1.100+; using older vmagent versions will prevent using these options (upgrade - vmagent first or avoid setting them)., 'If you relied on older operator - behavior around finalizer updates, behavior changes to Patch-based operations - may affect custom automation that assumes full-object updates (generally - a fix, but verify).'] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Adds `spec.pause` to multiple CRDs (VMAgent, VMAlert, VMAuth, VMCluster, VMAlertmanager, + VMSingle) to suspend reconciliation. + - Extends `VMAgent.spec.streamAggrConfig` with new options (`dedup_interval`, + `ignore_old_samples`, `keep_metric_names`, `no_align_flush_to_interval`); + requires vmagent v1.100+. + - Sets `VMAgent.status.selector` to support correct integration with Vertical + Pod Autoscaler (VPA). + - Syncs VMAuth/VMUser config fields with upstream vmauth (e.g., `src_query_args`, + `discover_backend_ips`). + - Fixes prometheus-operator ScrapeConfig converter behavior and corrects VMScrapeConfig + owner reference handling. + - Improves VMScrapeConfig SD `authorization` handling when `type` is empty (defaults + to Bearer). + breaking_changes: + - New `streamAggrConfig` fields are only usable with vmagent v1.100+; using + older vmagent versions will prevent using these options (upgrade vmagent first + or avoid setting them). + - If you relied on older operator behavior around finalizer updates, behavior + changes to Patch-based operations may affect custom automation that assumes + full-object updates (generally a fix, but verify). chart_version: 0.31.2 - images: ['victoriametrics/operator:v0.44.0'] + images: + - victoriametrics/operator:v0.44.0 - version: 0.43.0 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Removes deprecated `VMClusterSpec.VMInsert.Name`, `VMClusterSpec.VMStorage.Name`, - and `VMClusterSpec.VMSelect.Name` fields (deprecated since v0.21.0).', PodSecurityPolicy - (PSP) support removed; operator no longer creates PSP objects., PodDisruptionBudget - API switched from `policy/v1beta1` to stable `policy/v1`., Alertmanager - versions < v0.22.0 are no longer supported; default bumped to v0.27.0., - 'ServiceAccount reconcile behavior changed: operator only creates/updates - ServiceAccounts when SA field is omitted in CRD; avoids ownership race conditions.', - 'Operator watches fewer owned resources (no longer watches Service/Secret/ConfigMap - changes), reducing log/CPU/memory usage.', 'Config-reloader: exposes HTTP - port 8435; new `configReloaderExtraArgs` field for several CRDs; adds new - config-reloader container for VMAlertmanagerConfig and adds metrics.', 'Reconcile - behavior improved: Kubernetes Events emitted on reconcile errors; retries - on conflict errors.', '`serviceSpec.useAsDefault=true` allows adjusting - operator-generated Services.', 'VMAgent statefulMode service behavior changed: - now headless; `serviceName` customizable for custom Service.', 'Scrape CRDs - updated: add `attach_metadata`; add `series_limit`; fix `disable_keep_alive` - field name; deprecate `relabel_debug` and `metric_relabel_debug`.', Adds - new CRD `VMScrapeConfig` for arbitrary SD-based scrape configs., 'Other - CRD additions: VMUser `targetRefBasicAuth`, VMProbe `proxy_url`, VMAgent - multiline regex relabeling; Sigv4Config tag fix.', Base images/dependencies - updated for CVE fixes; VictoriaMetrics images bumped to v1.100.1.] - features: [New `VMScrapeConfig` CRD enables defining scrape configs with any - SD mechanism supported by VictoriaMetrics., Scrape CRDs gained `attach_metadata` - (Prometheus-like) and `series_limit` to control label metadata attachment - and cap per-target series., 'Config reloader improvements: dedicated reloader - for VMAlertmanagerConfig, new error/health metrics, exposed HTTP port 8435, - and per-CRD extra args via `configReloaderExtraArgs`.', VMUser can now configure - basic auth for `target_url` via `targetRefBasicAuth`; VMProbe supports `proxy_url`., - VMAgent relabeling supports multi-line regex; stateful mode service can be - customized.] - breaking_changes: [Removed deprecated `Name` fields from VMCluster component - specs; manifests using them must be updated/removed., PodSecurityPolicy - objects are no longer managed/created by the operator; clusters relying - on PSP must migrate to Pod Security Admission/other policy controls., PodDisruptionBudget - `policy/v1beta1` is no longer supported; ensure your cluster and any custom - manifests use `policy/v1`., Alertmanager versions below v0.22.0 are unsupported; - upgrade Alertmanager (or use operator defaults) before/with this operator - upgrade., VMAgent statefulMode Service changed to headless; any consumers - assuming a ClusterIP Service may need updates (DNS/discovery/load-balancing - behavior changes).] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Removes deprecated `VMClusterSpec.VMInsert.Name`, `VMClusterSpec.VMStorage.Name`, + and `VMClusterSpec.VMSelect.Name` fields (deprecated since v0.21.0). + - PodSecurityPolicy (PSP) support removed; operator no longer creates PSP objects. + - PodDisruptionBudget API switched from `policy/v1beta1` to stable `policy/v1`. + - Alertmanager versions < v0.22.0 are no longer supported; default bumped to + v0.27.0. + - 'ServiceAccount reconcile behavior changed: operator only creates/updates + ServiceAccounts when SA field is omitted in CRD; avoids ownership race conditions.' + - Operator watches fewer owned resources (no longer watches Service/Secret/ConfigMap + changes), reducing log/CPU/memory usage. + - 'Config-reloader: exposes HTTP port 8435; new `configReloaderExtraArgs` field + for several CRDs; adds new config-reloader container for VMAlertmanagerConfig + and adds metrics.' + - 'Reconcile behavior improved: Kubernetes Events emitted on reconcile errors; + retries on conflict errors.' + - '`serviceSpec.useAsDefault=true` allows adjusting operator-generated Services.' + - 'VMAgent statefulMode service behavior changed: now headless; `serviceName` + customizable for custom Service.' + - 'Scrape CRDs updated: add `attach_metadata`; add `series_limit`; fix `disable_keep_alive` + field name; deprecate `relabel_debug` and `metric_relabel_debug`.' + - Adds new CRD `VMScrapeConfig` for arbitrary SD-based scrape configs. + - 'Other CRD additions: VMUser `targetRefBasicAuth`, VMProbe `proxy_url`, VMAgent + multiline regex relabeling; Sigv4Config tag fix.' + - Base images/dependencies updated for CVE fixes; VictoriaMetrics images bumped + to v1.100.1. + features: + - New `VMScrapeConfig` CRD enables defining scrape configs with any SD mechanism + supported by VictoriaMetrics. + - Scrape CRDs gained `attach_metadata` (Prometheus-like) and `series_limit` + to control label metadata attachment and cap per-target series. + - 'Config reloader improvements: dedicated reloader for VMAlertmanagerConfig, + new error/health metrics, exposed HTTP port 8435, and per-CRD extra args via + `configReloaderExtraArgs`.' + - VMUser can now configure basic auth for `target_url` via `targetRefBasicAuth`; + VMProbe supports `proxy_url`. + - VMAgent relabeling supports multi-line regex; stateful mode service can be + customized. + breaking_changes: + - Removed deprecated `Name` fields from VMCluster component specs; manifests + using them must be updated/removed. + - PodSecurityPolicy objects are no longer managed/created by the operator; clusters + relying on PSP must migrate to Pod Security Admission/other policy controls. + - PodDisruptionBudget `policy/v1beta1` is no longer supported; ensure your cluster + and any custom manifests use `policy/v1`. + - Alertmanager versions below v0.22.0 are unsupported; upgrade Alertmanager + (or use operator defaults) before/with this operator upgrade. + - VMAgent statefulMode Service changed to headless; any consumers assuming a + ClusterIP Service may need updates (DNS/discovery/load-balancing behavior + changes). chart_version: 0.30.0 - images: ['victoriametrics/operator:v0.43.0'] + images: + - victoriametrics/operator:v0.43.0 - version: 0.42.4 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: null chart_version: 0.29.6 - images: ['victoriametrics/operator:v0.42.4'] + images: + - victoriametrics/operator:v0.42.4 - version: 0.42.0 - kube: ['1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator now supports watching multiple namespaces via comma-separated - `WATCH_NAMESPACE` (enables multi-namespace mode without cluster-wide permissions); - requires appropriate namespace-scoped RBAC (see `config/examples/operator_rbac_for_single_namespace.yaml`)., - 'Logging: operator adds more context to log messages to improve debugging - and log quality.', 'Runtime dependencies updated (controller-runtime, controller-gen); - may affect build/runtime behavior if you vendor/pin these elsewhere.', All - pod-producing CRs now expose a `status.updateStatus` field to better track - rollouts., All pod-producing CRs now get annotation `operator.victoriametrics/last-applied-spec` - to track applied spec and enable proper resource cleanup later., VictoriaMetrics - component image tags updated to v1.99.0 (from v1.97.1 in 0.41.1)., 'vmalertmanager: - default router changes to `blackhole` when no config is provided (previously - dummy webhook).', 'vmalertmanager: template path assignment fixed when templates - are set both in config file and via `spec.templates`.', 'vmauth: new `spec.configSecret` - to load external config from a Secret key `config.yaml`; changes can be - watched with `extraArgs.configCheckInterval` or a config-reloader sidecar.', - 'vmagent: `streamAggrConfig.flush_on_shutdown` added.', 'vmagent: experimental - `spec.ingestOnlyMode` added (runs without scrape config/config reloaders; - currently also disables TLS and auth for remoteWrites).', "vmcluster/vmstorage:\ - \ PVC resize disabling annotation `operator.victoriametrics.com/pvc-allow-volume-expansion`\ - \ behavior changed\u2014now evaluated at StatefulSet storage spec level\ - \ (not per-PVC); enables adding a PVC autoscaler.", 'APIs: missing static - config relabeling added with tests.'] - features: [Multi-namespace watch support via comma-separated `WATCH_NAMESPACE` - without needing cluster-wide permissions (with namespace RBAC)., Improved - rollout observability via `status.updateStatus` on all resources that create - pods., Spec change tracking via `operator.victoriametrics/last-applied-spec` - annotation on pod-producing resources., 'New vmagent options: `flush_on_shutdown` - for stream aggregation, and experimental `ingestOnlyMode` to run without - scrapes/config reloaders.', New vmauth `spec.configSecret` to source config - from a Secret and optionally reload/check periodically., vmstorage/vmcluster - gains better control of PVC expansion policy at storage spec level and supports - PVC autoscaler workflows.] - breaking_changes: ["vmalertmanager default routing behavior changes: if no configuration\ - \ is provided, it now uses `blackhole` instead of a dummy webhook\u2014\ - could change how unconfigured alerts are handled (dropped vs previously\ - \ sent somewhere).", PVC expansion disabling check moved from per-PVC to - StatefulSet storage spec level; clusters relying on the old per-PVC annotation - behavior may see different resize outcomes after upgrade., "`vmagent.spec.ingestOnlyMode`\ - \ is experimental and currently disables TLS/auth for remoteWrite endpoints\ - \ when enabled\u2014treat as a behavioral change if you plan to use it."] + kube: + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator now supports watching multiple namespaces via comma-separated `WATCH_NAMESPACE` + (enables multi-namespace mode without cluster-wide permissions); requires + appropriate namespace-scoped RBAC (see `config/examples/operator_rbac_for_single_namespace.yaml`). + - 'Logging: operator adds more context to log messages to improve debugging + and log quality.' + - Runtime dependencies updated (controller-runtime, controller-gen); may affect + build/runtime behavior if you vendor/pin these elsewhere. + - All pod-producing CRs now expose a `status.updateStatus` field to better track + rollouts. + - All pod-producing CRs now get annotation `operator.victoriametrics/last-applied-spec` + to track applied spec and enable proper resource cleanup later. + - VictoriaMetrics component image tags updated to v1.99.0 (from v1.97.1 in 0.41.1). + - 'vmalertmanager: default router changes to `blackhole` when no config is provided + (previously dummy webhook).' + - 'vmalertmanager: template path assignment fixed when templates are set both + in config file and via `spec.templates`.' + - 'vmauth: new `spec.configSecret` to load external config from a Secret key + `config.yaml`; changes can be watched with `extraArgs.configCheckInterval` + or a config-reloader sidecar.' + - 'vmagent: `streamAggrConfig.flush_on_shutdown` added.' + - 'vmagent: experimental `spec.ingestOnlyMode` added (runs without scrape config/config + reloaders; currently also disables TLS and auth for remoteWrites).' + - "vmcluster/vmstorage: PVC resize disabling annotation `operator.victoriametrics.com/pvc-allow-volume-expansion`\ + \ behavior changed\u2014now evaluated at StatefulSet storage spec level (not\ + \ per-PVC); enables adding a PVC autoscaler." + - 'APIs: missing static config relabeling added with tests.' + features: + - Multi-namespace watch support via comma-separated `WATCH_NAMESPACE` without + needing cluster-wide permissions (with namespace RBAC). + - Improved rollout observability via `status.updateStatus` on all resources + that create pods. + - Spec change tracking via `operator.victoriametrics/last-applied-spec` annotation + on pod-producing resources. + - 'New vmagent options: `flush_on_shutdown` for stream aggregation, and experimental + `ingestOnlyMode` to run without scrapes/config reloaders.' + - New vmauth `spec.configSecret` to source config from a Secret and optionally + reload/check periodically. + - vmstorage/vmcluster gains better control of PVC expansion policy at storage + spec level and supports PVC autoscaler workflows. + breaking_changes: + - "vmalertmanager default routing behavior changes: if no configuration is provided,\ + \ it now uses `blackhole` instead of a dummy webhook\u2014could change how\ + \ unconfigured alerts are handled (dropped vs previously sent somewhere)." + - PVC expansion disabling check moved from per-PVC to StatefulSet storage spec + level; clusters relying on the old per-PVC annotation behavior may see different + resize outcomes after upgrade. + - "`vmagent.spec.ingestOnlyMode` is experimental and currently disables TLS/auth\ + \ for remoteWrite endpoints when enabled\u2014treat as a behavioral change\ + \ if you plan to use it." chart_version: 0.29.0 - images: ['victoriametrics/operator:v0.42.0'] + images: + - victoriametrics/operator:v0.42.0 - version: 0.41.1 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Operator-managed VictoriaMetrics component image tags are updated - to VictoriaMetrics v1.97.1 (via operator v0.41.1), which may pull in changes - from the VictoriaMetrics application release.', '(From the starting version - v0.40.0) VMUser gained new fields: drop_src_path_prefix_parts, tls_insecure_skip_verify, - metric_labels, and load_balancing_policy (note: metric_labels requires VMAuth - >= v1.97.0).', (From the starting version v0.40.0) Added revisionHistoryLimitCount - and MinReadySeconds parameters for VictoriaMetrics workload CRDs., '(From - the starting version v0.40.0) VMAlertmanagerConfig gained additional receiver - type support: discord_configs, msteams_configs, sns_configs, webex_configs.', - (From the starting version v0.40.0) Added alerting rules for the operator - itself.] + features: + - Operator-managed VictoriaMetrics component image tags are updated to VictoriaMetrics + v1.97.1 (via operator v0.41.1), which may pull in changes from the VictoriaMetrics + application release. + - '(From the starting version v0.40.0) VMUser gained new fields: drop_src_path_prefix_parts, + tls_insecure_skip_verify, metric_labels, and load_balancing_policy (note: + metric_labels requires VMAuth >= v1.97.0).' + - (From the starting version v0.40.0) Added revisionHistoryLimitCount and MinReadySeconds + parameters for VictoriaMetrics workload CRDs. + - '(From the starting version v0.40.0) VMAlertmanagerConfig gained additional + receiver type support: discord_configs, msteams_configs, sns_configs, webex_configs.' + - (From the starting version v0.40.0) Added alerting rules for the operator + itself. breaking_changes: [] chart_version: 0.28.0 - images: ['victoriametrics/operator:v0.41.1'] + images: + - victoriametrics/operator:v0.41.1 - version: 0.40.0 - kube: ['1.29', '1.28', '1.27'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Fix VMAlertmanagerConfig discovery to match documented behavior., - Add optional built-in alerting rules for vmoperator itself (operator self-monitoring)., - 'Add new CRD fields for workloads: `revisionHistoryLimitCount` and `minReadySeconds` - across Victoriametrics workload CRDs.', 'Extend VMAlertmanagerConfig CRD - to support additional receiver types: `discord_configs`, `msteams_configs`, - `sns_configs`, `webex_configs`.', 'Extend VMUser CRD with new fields: `drop_src_path_prefix_parts`, - `tls_insecure_skip_verify`, `metric_labels`, `load_balancing_policy`.'] - features: ['Operator can now ship alerting rules for itself, improving observability - of operator health and reconciliation issues.', 'VMUser adds new auth/routing - knobs (drop path prefix parts, TLS skip verify, metric label injection, - load balancing policy); note `metric_labels` requires VMAuth >= v1.97.0.', - 'VMAlertmanagerConfig supports more receiver integrations (Discord, MS Teams, - AWS SNS, Webex) and has corrected discovery behavior.', Workload CRDs gain - `minReadySeconds` and `revisionHistoryLimitCount` to control rollout readiness - and ReplicaSet history retention.] - breaking_changes: ['`VMAlertmanagerConfig` discovery behavior is fixed to match - docs; if you relied on the previous (incorrect) discovery semantics, existing - AlertmanagerConfig objects selected/discovered by vmalertmanager may change - and should be revalidated after upgrade.'] + kube: + - '1.29' + - '1.28' + - '1.27' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Fix VMAlertmanagerConfig discovery to match documented behavior. + - Add optional built-in alerting rules for vmoperator itself (operator self-monitoring). + - 'Add new CRD fields for workloads: `revisionHistoryLimitCount` and `minReadySeconds` + across Victoriametrics workload CRDs.' + - 'Extend VMAlertmanagerConfig CRD to support additional receiver types: `discord_configs`, + `msteams_configs`, `sns_configs`, `webex_configs`.' + - 'Extend VMUser CRD with new fields: `drop_src_path_prefix_parts`, `tls_insecure_skip_verify`, + `metric_labels`, `load_balancing_policy`.' + features: + - Operator can now ship alerting rules for itself, improving observability of + operator health and reconciliation issues. + - VMUser adds new auth/routing knobs (drop path prefix parts, TLS skip verify, + metric label injection, load balancing policy); note `metric_labels` requires + VMAuth >= v1.97.0. + - VMAlertmanagerConfig supports more receiver integrations (Discord, MS Teams, + AWS SNS, Webex) and has corrected discovery behavior. + - Workload CRDs gain `minReadySeconds` and `revisionHistoryLimitCount` to control + rollout readiness and ReplicaSet history retention. + breaking_changes: + - '`VMAlertmanagerConfig` discovery behavior is fixed to match docs; if you + relied on the previous (incorrect) discovery semantics, existing AlertmanagerConfig + objects selected/discovered by vmalertmanager may change and should be revalidated + after upgrade.' chart_version: 0.27.10 - images: ['victoriametrics/operator:v0.40.0'] + images: + - victoriametrics/operator:v0.40.0 - version: 0.39.4 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: null chart_version: 0.27.9 - images: ['victoriametrics/operator:v0.39.3'] + images: + - victoriametrics/operator:v0.39.3 - version: 0.39.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [vmagent/vmauth default config-reloader image was upgraded (impacts - the sidecar/init behavior and image pull)., 'VMUser gained new vmauth options: - `retry_status_codes`, `max_concurrent_requests`, and `response_headers` - (requires vmauth >= v1.94.0).', New per-component `useStrictSecurity` flag - allows gradual migration from insecure to strict security without breaking - all components at once., Operator can now accept/provide an enterprise license - key for VictoriaMetrics enterprise components.] + features: + - vmagent/vmauth default config-reloader image was upgraded (impacts the sidecar/init + behavior and image pull). + - 'VMUser gained new vmauth options: `retry_status_codes`, `max_concurrent_requests`, + and `response_headers` (requires vmauth >= v1.94.0).' + - New per-component `useStrictSecurity` flag allows gradual migration from insecure + to strict security without breaking all components at once. + - Operator can now accept/provide an enterprise license key for VictoriaMetrics + enterprise components. breaking_changes: [] chart_version: 0.27.3 - images: ['victoriametrics/operator:v0.39.0'] + images: + - victoriametrics/operator:v0.39.0 - version: 0.38.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Adds the ability for vmoperator to print the default values for all - operator environment variables (useful for debugging/config discovery).] + features: + - Adds the ability for vmoperator to print the default values for all operator + environment variables (useful for debugging/config discovery). breaking_changes: [] chart_version: 0.27.1 - images: ['victoriametrics/operator:v0.38.0'] + images: + - victoriametrics/operator:v0.38.0 - version: 0.37.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['VMAlert/VMRule/VMagent/VMSingle: streaming aggregation enhancements - introduced in v0.36.0 (dropInput, list support for match, staleness_interval).', - 'VMRule: new rule fields update_entries_limit and keep_firing_for supported - (v0.36.0).', 'Operator: new VM_ENABLESTRICTSECURITY env var; strict security - context enabled by default (v0.36.0).', 'VMagent: multiple `if` conditions - for relabeling supported (v0.37.0).'] - breaking_changes: ['VMAlert CRD: field `OAuth2` renamed to `oauth2` in several - VMAlert spec sections; manifests must be updated and reapplied after upgrade - (v0.36.0).', 'VMAlert CRD: field `bearerTokenFilePath` renamed to `bearerTokenFile` - in several VMAlert spec sections; manifests must be updated and reapplied - after upgrade (v0.36.0).'] + features: + - 'VMAlert/VMRule/VMagent/VMSingle: streaming aggregation enhancements introduced + in v0.36.0 (dropInput, list support for match, staleness_interval).' + - 'VMRule: new rule fields update_entries_limit and keep_firing_for supported + (v0.36.0).' + - 'Operator: new VM_ENABLESTRICTSECURITY env var; strict security context enabled + by default (v0.36.0).' + - 'VMagent: multiple `if` conditions for relabeling supported (v0.37.0).' + breaking_changes: + - 'VMAlert CRD: field `OAuth2` renamed to `oauth2` in several VMAlert spec sections; + manifests must be updated and reapplied after upgrade (v0.36.0).' + - 'VMAlert CRD: field `bearerTokenFilePath` renamed to `bearerTokenFile` in + several VMAlert spec sections; manifests must be updated and reapplied after + upgrade (v0.36.0).' chart_version: 0.26.0 - images: ['victoriametrics/operator:v0.37.0'] + images: + - victoriametrics/operator:v0.37.0 - version: 0.36.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -28005,549 +37866,751 @@ addons: \ by default**.\n - `VM_PSPAUTOCREATEENABLED`: default changed from `true`\ \ -> `false` (PSP is deprecated since k8s v1.25).\n" chart_updates: [] - features: ['Streaming aggregation support updates for vmagent/vmsingle: `streamAggr.dropInput`, - list support for `match`, and `staleness_interval`.', VMRule supports `update_entries_limit` - and `keep_firing_for` fields (vmalert rule features)., 'New example manifests: - vmagent stateful mode with sharding; vmcluster with additional/custom storage - claims.', Operator can run with strict security context by default via new - `VM_ENABLESTRICTSECURITY` parameter.] - breaking_changes: ['VMAlert CRD field rename: `OAuth2` -> `oauth2` across datasource/notifier/notifiers/remoteRead/remoteWrite; - any existing configs must be reapplied with the new field name after upgrade.', - 'VMAlert CRD field rename: `bearerTokenFilePath` -> `bearerTokenFile` across - datasource/notifier/notifiers/remoteRead/remoteWrite; any existing configs - must be reapplied with the new field name after upgrade.'] + features: + - 'Streaming aggregation support updates for vmagent/vmsingle: `streamAggr.dropInput`, + list support for `match`, and `staleness_interval`.' + - VMRule supports `update_entries_limit` and `keep_firing_for` fields (vmalert + rule features). + - 'New example manifests: vmagent stateful mode with sharding; vmcluster with + additional/custom storage claims.' + - Operator can run with strict security context by default via new `VM_ENABLESTRICTSECURITY` + parameter. + breaking_changes: + - 'VMAlert CRD field rename: `OAuth2` -> `oauth2` across datasource/notifier/notifiers/remoteRead/remoteWrite; + any existing configs must be reapplied with the new field name after upgrade.' + - 'VMAlert CRD field rename: `bearerTokenFilePath` -> `bearerTokenFile` across + datasource/notifier/notifiers/remoteRead/remoteWrite; any existing configs + must be reapplied with the new field name after upgrade.' chart_version: 0.25.0 - images: ['victoriametrics/operator:v0.36.0'] + images: + - victoriametrics/operator:v0.36.0 - version: 0.35.0 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['vmagent: adds validation when generating static scrape config (may - reject previously accepted invalid configs).', 'vmalertmanagerconfig: adds - validation for Slack receiver URL.', 'vmauth/vmagent: implement config initiation - flow for a custom config reloader (changes how custom reloader is bootstrapped).', - Adds more generators (additional supported config/resource generation options)., - 'vmsingle: adds a status field to the CR status (more observable state).'] + features: + - 'vmagent: adds validation when generating static scrape config (may reject + previously accepted invalid configs).' + - 'vmalertmanagerconfig: adds validation for Slack receiver URL.' + - 'vmauth/vmagent: implement config initiation flow for a custom config reloader + (changes how custom reloader is bootstrapped).' + - Adds more generators (additional supported config/resource generation options). + - 'vmsingle: adds a status field to the CR status (more observable state).' breaking_changes: [] chart_version: 0.24.0 - images: ['victoriametrics/operator:v0.35.0'] + images: + - victoriametrics/operator:v0.35.0 - version: 0.34.0 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [VMAlertmanager now defaults/bundles Alertmanager v0.25.0., VMCluster - adds `clusterNativePort` on VMSelect/VMInsert to support multi-level cluster - topologies., VMRule gains `notifierHeader` to attach custom headers for - notifications., VMPodScrape adds `FilterRunning` option (similar to Prometheus) - to scrape only running pods., VMAuth incorporates latest upstream VMAuth - feature set (behavior depends on VMAuth version used).] - breaking_changes: ['If you run the operator in single-namespace mode via `WATCH_NAMESPACE`, - behavior changes: it will no longer access cluster-wide resources and will - only create single-namespace config for VMAgent. This may require revisiting - RBAC/ClusterRole assumptions and any setups relying on cluster-wide discovery.'] + features: + - VMAlertmanager now defaults/bundles Alertmanager v0.25.0. + - VMCluster adds `clusterNativePort` on VMSelect/VMInsert to support multi-level + cluster topologies. + - VMRule gains `notifierHeader` to attach custom headers for notifications. + - VMPodScrape adds `FilterRunning` option (similar to Prometheus) to scrape + only running pods. + - VMAuth incorporates latest upstream VMAuth feature set (behavior depends on + VMAuth version used). + breaking_changes: + - 'If you run the operator in single-namespace mode via `WATCH_NAMESPACE`, behavior + changes: it will no longer access cluster-wide resources and will only create + single-namespace config for VMAgent. This may require revisiting RBAC/ClusterRole + assumptions and any setups relying on cluster-wide discovery.' chart_version: 0.23.0 - images: ['victoriametrics/operator:v0.34.0'] + images: + - victoriametrics/operator:v0.34.0 - version: 0.33.0 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['VMAlertmanager: new option to disable route `continue` enforcement - (lets you keep Alertmanager-style routing semantics if you rely on `continue: - true`).', 'VMAlertmanagerConfig: can now set `require_tls: false` for email - receivers and adds sanity checks to validate configs earlier.', 'VMAlertmanagerConfig: - adds `sound` field support for Pushover notifications.', 'VMAgent/VMAuth: - can download initial config via an initContainer, improving first-start - reliability when config is generated/served externally.', 'Build: Alpine - base image bumped to v3.17.3 (security/patch updates).'] + features: + - 'VMAlertmanager: new option to disable route `continue` enforcement (lets + you keep Alertmanager-style routing semantics if you rely on `continue: true`).' + - 'VMAlertmanagerConfig: can now set `require_tls: false` for email receivers + and adds sanity checks to validate configs earlier.' + - 'VMAlertmanagerConfig: adds `sound` field support for Pushover notifications.' + - 'VMAgent/VMAuth: can download initial config via an initContainer, improving + first-start reliability when config is generated/served externally.' + - 'Build: Alpine base image bumped to v3.17.3 (security/patch updates).' breaking_changes: [] chart_version: 0.21.0 - images: ['victoriametrics/operator:v0.33.0'] + images: + - victoriametrics/operator:v0.33.0 - version: 0.32.1 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [No new features in v0.32.1; it is a patch release focused on fixes., - "v0.32.1 makes vmsingle\u2019s stream aggregation config conditional, preventing\ - \ it from being injected when not configured/needed."] + features: + - No new features in v0.32.1; it is a patch release focused on fixes. + - "v0.32.1 makes vmsingle\u2019s stream aggregation config conditional, preventing\ + \ it from being injected when not configured/needed." breaking_changes: [] chart_version: 0.20.1 - images: ['victoriametrics/operator:v0.32.1'] + images: + - victoriametrics/operator:v0.32.1 - version: 0.32.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['**vmauth**: `config-reloader` is now auto-configured with `proxy-protocol` - client support and `reloadAuthKey` handling, reducing manual config for - auth reload behavior.', '**vmagent**: new global `scrapeTimeout` setting - can be set via the VMAgent CR to control scrape timeouts consistently.', - '**vmagent remoteWrite**: adds support for streaming aggregation configuration - for remoteWrite targets (see VictoriaMetrics stream aggregation docs).', - '**vmsingle**: adds global streaming aggregation configuration for the database, - enabling server-side aggregation pipelines.'] + features: + - '**vmauth**: `config-reloader` is now auto-configured with `proxy-protocol` + client support and `reloadAuthKey` handling, reducing manual config for auth + reload behavior.' + - '**vmagent**: new global `scrapeTimeout` setting can be set via the VMAgent + CR to control scrape timeouts consistently.' + - '**vmagent remoteWrite**: adds support for streaming aggregation configuration + for remoteWrite targets (see VictoriaMetrics stream aggregation docs).' + - '**vmsingle**: adds global streaming aggregation configuration for the database, + enabling server-side aggregation pipelines.' breaking_changes: [] chart_version: 0.20.0 - images: ['victoriametrics/operator:v0.32.0'] + images: + - victoriametrics/operator:v0.32.0 - version: 0.31.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['vmalertmanager: adds support for `vmalertmanager.spec.templates`, - including auto-reload directories for templates and configmaps.', 'vmagent: - adds support for the `%SHARD_NUM%` placeholder when generating/templating - vmagent StatefulSet/Deployment (useful for sharded setups).'] - breaking_changes: ['HPA API handling changed to avoid deprecated autoscaling - v2beta on Kubernetes 1.26+; if you have custom manifests/overrides expecting - v2beta, they may need adjustment.'] + features: + - 'vmalertmanager: adds support for `vmalertmanager.spec.templates`, including + auto-reload directories for templates and configmaps.' + - 'vmagent: adds support for the `%SHARD_NUM%` placeholder when generating/templating + vmagent StatefulSet/Deployment (useful for sharded setups).' + breaking_changes: + - HPA API handling changed to avoid deprecated autoscaling v2beta on Kubernetes + 1.26+; if you have custom manifests/overrides expecting v2beta, they may need + adjustment. chart_version: 0.19.0 - images: ['victoriametrics/operator:v0.31.0'] + images: + - victoriametrics/operator:v0.31.0 - version: 0.30.3 - kube: ['1.26', '1.25', '1.24'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['v0.30.0 added the Scaling subresource for `VMAgent`, enabling use - of the Kubernetes scale API (e.g., `kubectl scale`) against the CRD.', 'v0.30.0 - introduced optional namespace label matching for inhibit rules, improving - alert inhibition scoping.', 'v0.30.0 started publishing CRDs YAML as a release - asset, making CRD management outside Helm easier.', v0.30.0 added child - labels filtering to control which labels propagate to generated child resources., - v0.30.0 added OAuth2 and bearer auth support for vmalert remote DB connections.] - breaking_changes: ['Kubernetes 1.26+ deprecates `autoscaling/v2beta2`; v0.30.3 - adds an API-availability check, which may change HPA behavior if your cluster - only supports certain autoscaling API versions.', 'PVC resize logic in v0.30.3 - now uses corrected selector labels; if you relied on the previous (incorrect) - labels for automation/monitoring, behavior/metrics selection may differ.'] + kube: + - '1.26' + - '1.25' + - '1.24' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - v0.30.0 added the Scaling subresource for `VMAgent`, enabling use of the Kubernetes + scale API (e.g., `kubectl scale`) against the CRD. + - v0.30.0 introduced optional namespace label matching for inhibit rules, improving + alert inhibition scoping. + - v0.30.0 started publishing CRDs YAML as a release asset, making CRD management + outside Helm easier. + - v0.30.0 added child labels filtering to control which labels propagate to + generated child resources. + - v0.30.0 added OAuth2 and bearer auth support for vmalert remote DB connections. + breaking_changes: + - Kubernetes 1.26+ deprecates `autoscaling/v2beta2`; v0.30.3 adds an API-availability + check, which may change HPA behavior if your cluster only supports certain + autoscaling API versions. + - PVC resize logic in v0.30.3 now uses corrected selector labels; if you relied + on the previous (incorrect) labels for automation/monitoring, behavior/metrics + selection may differ. chart_version: 0.17.2 - images: ['victoriametrics/operator:v0.30.3'] + images: + - victoriametrics/operator:v0.30.3 - version: 0.30.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Adds a Scaling subresource for `VMAgent`, enabling kubectl/HPA-style - scaling interactions without editing the full spec.', 'Adds an optional - namespace label matcher to inhibit rules (Alertmanager config), giving finer - control over inhibition behavior across namespaces.', 'Publishes CRDs YAML - as a release asset, simplifying CRD installation/updates outside of Helm - or Git checkout.', Introduces child labels filtering to better control which - labels propagate from parent/owner resources to generated objects., '`vmalert` - controller adds OAuth2 and bearer-token auth support for remote read/query - databases, improving secured integrations.'] + features: + - Adds a Scaling subresource for `VMAgent`, enabling kubectl/HPA-style scaling + interactions without editing the full spec. + - Adds an optional namespace label matcher to inhibit rules (Alertmanager config), + giving finer control over inhibition behavior across namespaces. + - Publishes CRDs YAML as a release asset, simplifying CRD installation/updates + outside of Helm or Git checkout. + - Introduces child labels filtering to better control which labels propagate + from parent/owner resources to generated objects. + - '`vmalert` controller adds OAuth2 and bearer-token auth support for remote + read/query databases, improving secured integrations.' breaking_changes: [] chart_version: 0.17.0 - images: ['victoriametrics/operator:v0.30.0'] + images: + - victoriametrics/operator:v0.30.0 - version: 0.29.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator fix: VMCluster now reconciles VMStorage even when - the PodDisruptionBudget object is missing.', Fix for Kubernetes 1.25 crash., - 'vmagent/vmalert: reduce/handle throttling issues more safely.', 'vmalertmanagerconfig: - fixes for parsing nested routes plus correct OwnerReference handling.', - 'vmagent: allow maxDiskUsage values > 1GB.', 'vmagent: correctly merge ports - when using an additional Service.', 'vmprobe: correctly set labels for ingress - targets.', 'PodDisruptionBudget: add configurable selectors (new capability - in how PDBs are generated/selected).'] - features: ['PodDisruptionBudget support gains configurable selectors, allowing - more control over which pods a PDB targets.'] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Operator fix: VMCluster now reconciles VMStorage even when the PodDisruptionBudget + object is missing.' + - Fix for Kubernetes 1.25 crash. + - 'vmagent/vmalert: reduce/handle throttling issues more safely.' + - 'vmalertmanagerconfig: fixes for parsing nested routes plus correct OwnerReference + handling.' + - 'vmagent: allow maxDiskUsage values > 1GB.' + - 'vmagent: correctly merge ports when using an additional Service.' + - 'vmprobe: correctly set labels for ingress targets.' + - 'PodDisruptionBudget: add configurable selectors (new capability in how PDBs + are generated/selected).' + features: + - PodDisruptionBudget support gains configurable selectors, allowing more control + over which pods a PDB targets. breaking_changes: [] chart_version: 0.15.0 - images: ['victoriametrics/operator:v0.29.0'] + images: + - victoriametrics/operator:v0.29.0 - version: 0.28.3 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [TLS endpoint support for the vmauth config reloader (improves secure - reload hookups)., 'New/expanded CRD capabilities: `claimTemplates` supported - for `VMCluster`, `VMAlertmanager`, and `VMAgent`; `readinessGates` supported - on CRD objects; health checks now respect TLS settings on CRDs.', Option - to add ArgoCD ignore annotations when converting Prometheus CRDs via `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` - to reduce drift/noise in ArgoCD-managed clusters.] + features: + - TLS endpoint support for the vmauth config reloader (improves secure reload + hookups). + - 'New/expanded CRD capabilities: `claimTemplates` supported for `VMCluster`, + `VMAlertmanager`, and `VMAgent`; `readinessGates` supported on CRD objects; + health checks now respect TLS settings on CRDs.' + - Option to add ArgoCD ignore annotations when converting Prometheus CRDs via + `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to reduce drift/noise + in ArgoCD-managed clusters. breaking_changes: [] chart_version: 0.14.0 - images: ['victoriametrics/operator:v0.28.3'] + images: + - victoriametrics/operator:v0.28.3 - version: 0.27.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Adds support for `claimTemplates` on `VMCluster`, `VMAlertmanager`, - and `VMAgent` to simplify PVC templating for stateful workloads.', 'Adds - `readinessGates` support across CRD objects, enabling integration with custom - readiness conditions.', 'HealthChecks now respect TLS settings defined on - CRD objects, improving correctness for secured endpoints.', Adds an env - var `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to ignore Argo - CD objects converted from Prometheus CRDs., Adds TLS endpoint support for - the `vmauth` config reloader for secured reload operations.] + features: + - Adds support for `claimTemplates` on `VMCluster`, `VMAlertmanager`, and `VMAgent` + to simplify PVC templating for stateful workloads. + - Adds `readinessGates` support across CRD objects, enabling integration with + custom readiness conditions. + - HealthChecks now respect TLS settings defined on CRD objects, improving correctness + for secured endpoints. + - Adds an env var `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to + ignore Argo CD objects converted from Prometheus CRDs. + - Adds TLS endpoint support for the `vmauth` config reloader for secured reload + operations. breaking_changes: [] chart_version: 0.12.0 - images: ['victoriametrics/operator:v0.27.0'] + images: + - victoriametrics/operator:v0.27.0 - version: 0.26.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['VMUser: adds `name` field (v0.25.0) and `tokenRef` (v0.26.0) for - improved user identification and secret-based token management.', 'VMAgent: - adds `StatefulMode` to run as a StatefulSet, plus new per-remote-storage - `headers` configuration and multitenant mode support.', 'VMRule: adds a - validation webhook to catch rule errors at admission time.', 'Scrape/target - config: adds `authorization` support and `headers` fields for passing custom - headers to targets.', 'vmauth/ingress: adds `host` parameter for ingress - configuration.', 'VMCluster: reworks/expands cluster volume expansion behavior - and improves expansion handling overall.', 'Operator/ops: adds new operator - metrics (log messages, controller object counts, throttling, app version/uptime/start - timestamp) and introduces/adjusts reconciliation rate limiting.', 'Global: - adds a setting to override the container registry globally for images.'] - breaking_changes: ["VMRule API change (v0.25.0): `expr` must be a string; integer\ - \ expressions are no longer supported\u2014existing rules with numeric `expr`\ - \ will fail validation/apply.", v0.26.0 is flagged by upstream as containing - breaking changes that were fixed in v0.26.2; upgrading directly to 0.26.0 - is not recommended (use 0.26.2+ instead).] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'VMUser: adds `name` field (v0.25.0) and `tokenRef` (v0.26.0) for improved + user identification and secret-based token management.' + - 'VMAgent: adds `StatefulMode` to run as a StatefulSet, plus new per-remote-storage + `headers` configuration and multitenant mode support.' + - 'VMRule: adds a validation webhook to catch rule errors at admission time.' + - 'Scrape/target config: adds `authorization` support and `headers` fields for + passing custom headers to targets.' + - 'vmauth/ingress: adds `host` parameter for ingress configuration.' + - 'VMCluster: reworks/expands cluster volume expansion behavior and improves + expansion handling overall.' + - 'Operator/ops: adds new operator metrics (log messages, controller object + counts, throttling, app version/uptime/start timestamp) and introduces/adjusts + reconciliation rate limiting.' + - 'Global: adds a setting to override the container registry globally for images.' + breaking_changes: + - "VMRule API change (v0.25.0): `expr` must be a string; integer expressions\ + \ are no longer supported\u2014existing rules with numeric `expr` will fail\ + \ validation/apply." + - v0.26.0 is flagged by upstream as containing breaking changes that were fixed + in v0.26.2; upgrading directly to 0.26.0 is not recommended (use 0.26.2+ instead). chart_version: 0.11.1 - images: ['victoriametrics/operator:v0.26.0'] + images: + - victoriametrics/operator:v0.26.0 - version: 0.25.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['VMUser CRD: added a `name` field (useful for explicitly naming VMUser - objects).', 'VMAgent CRD: added `statefulMode` to run VMAgent as a StatefulSet - instead of a Deployment.', 'VMRule: added a validation webhook to catch - rule errors at admission time (fails fast on invalid rules).', 'Operator - metrics: added additional metrics such as `operator_log_messages_total`, - `operator_controller_objects_count`, `operator_reconcile_throttled_events_total`, - and app info metrics (`vm_app_version`, `vm_app_uptime_seconds`, `vm_app_start_timestamp`).', - 'Reconciliation: added rate limiting for VMAgent and VMAlert reconciliations - to reduce churn under frequent updates.'] - breaking_changes: ['VMRule API change: `expr` must be a string; integer values - are no longer accepted. Audit and update any VMRule manifests or generated - rules that used numeric expressions.'] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'VMUser CRD: added a `name` field (useful for explicitly naming VMUser objects).' + - 'VMAgent CRD: added `statefulMode` to run VMAgent as a StatefulSet instead + of a Deployment.' + - 'VMRule: added a validation webhook to catch rule errors at admission time + (fails fast on invalid rules).' + - 'Operator metrics: added additional metrics such as `operator_log_messages_total`, + `operator_controller_objects_count`, `operator_reconcile_throttled_events_total`, + and app info metrics (`vm_app_version`, `vm_app_uptime_seconds`, `vm_app_start_timestamp`).' + - 'Reconciliation: added rate limiting for VMAgent and VMAlert reconciliations + to reduce churn under frequent updates.' + breaking_changes: + - 'VMRule API change: `expr` must be a string; integer values are no longer + accepted. Audit and update any VMRule manifests or generated rules that used + numeric expressions.' chart_version: 0.10.0 - images: ['victoriametrics/operator:v0.25.0'] + images: + - victoriametrics/operator:v0.25.0 - version: 0.24.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Operator can filter converted Prometheus CRD objects, helping control - which migrated resources are reconciled.', 'Default CLI args/params can - be overridden via configuration, enabling per-install tuning without patching - manifests.', "Operator-generated VMServiceScrape objects can now be customized\ - \ for the operator\u2019s managed resources.", CRD-managed workloads can - set `terminationGracePeriodSeconds` and `dnsConfig` for finer pod-level - behavior control., VMAlertmanagerConfig adds support for `telegram_configs` - notification receiver blocks., Retention period can be set to less than - one month (previously constrained).] - breaking_changes: ['From v0.23.0, the `job` name label for scrape/probe resources - changed to include a CRD-type prefix (probe, podScrape, serviceScrape, nodeScrape, - staticScrape). This can affect alerting/recording rules and dashboards that - match on the old job label value.'] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Operator can filter converted Prometheus CRD objects, helping control which + migrated resources are reconciled. + - Default CLI args/params can be overridden via configuration, enabling per-install + tuning without patching manifests. + - "Operator-generated VMServiceScrape objects can now be customized for the\ + \ operator\u2019s managed resources." + - CRD-managed workloads can set `terminationGracePeriodSeconds` and `dnsConfig` + for finer pod-level behavior control. + - VMAlertmanagerConfig adds support for `telegram_configs` notification receiver + blocks. + - Retention period can be set to less than one month (previously constrained). + breaking_changes: + - From v0.23.0, the `job` name label for scrape/probe resources changed to include + a CRD-type prefix (probe, podScrape, serviceScrape, nodeScrape, staticScrape). + This can affect alerting/recording rules and dashboards that match on the + old job label value. chart_version: 0.9.0 - images: ['victoriametrics/operator:v0.24.0'] + images: + - victoriametrics/operator:v0.24.0 - version: 0.23.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Operator now checks the Kubernetes API server version and automatically - uses the appropriate API versions for deprecated objects (notably PodSecurityPolicy - and PodDisruptionBudget)., Fixes include correcting bearerToken handling - for VMAgent remoteWriteSpec and adjusting job name labeling to avoid collisions.] - breaking_changes: ['Job name label format changed: a CRD-type prefix is added - (probe, podScrape, serviceScrape, nodeScrape, staticScrape), which can affect - dashboards/alerts/relabeling that depend on the old job label values.'] + features: + - Operator now checks the Kubernetes API server version and automatically uses + the appropriate API versions for deprecated objects (notably PodSecurityPolicy + and PodDisruptionBudget). + - Fixes include correcting bearerToken handling for VMAgent remoteWriteSpec + and adjusting job name labeling to avoid collisions. + breaking_changes: + - 'Job name label format changed: a CRD-type prefix is added (probe, podScrape, + serviceScrape, nodeScrape, staticScrape), which can affect dashboards/alerts/relabeling + that depend on the old job label values.' chart_version: 0.7.1 - images: ['victoriametrics/operator:v0.23.0'] + images: + - victoriametrics/operator:v0.23.0 - version: 0.22.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Operator API objects were moved into a separate Go package, allowing - consumers to use the API without importing the whole operator codebase.', - "Support was added to configure `rollingUpdateStrategy` for StatefulSets;\ - \ when set to `rollingUpdate`, Kubernetes\u2019 native controller-manager\ - \ handles rolling updates, enabling `kubectl rollout restart` for both Deployments\ - \ and StatefulSets.", VMAlertmanager gained a global option `disableNamespaceMatcher` - to disable the namespace label matcher behavior.] + features: + - Operator API objects were moved into a separate Go package, allowing consumers + to use the API without importing the whole operator codebase. + - "Support was added to configure `rollingUpdateStrategy` for StatefulSets;\ + \ when set to `rollingUpdate`, Kubernetes\u2019 native controller-manager\ + \ handles rolling updates, enabling `kubectl rollout restart` for both Deployments\ + \ and StatefulSets." + - VMAlertmanager gained a global option `disableNamespaceMatcher` to disable + the namespace label matcher behavior. breaking_changes: [] chart_version: 0.6.0 - images: ['victoriametrics/operator:v0.22.0'] + images: + - victoriametrics/operator:v0.22.0 - version: 0.21.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Alertmanager ServiceScrape auto-generation was added, reducing manual - scrape configuration when alertmanager is managed by the operator.', 'VMUser - now automatically adds routing for VMCluster components (vminsert and vmselect), - simplifying multi-tenant access setup.', 'VMAgent can now have its default - disk space usage adjusted, making it easier to tune persistent storage behavior.', - 'VMUser target references can now include custom HTTP headers, enabling additional - auth/metadata to be passed to upstreams.'] - breaking_changes: ["Selector default behavior changed again: v0.21.0 rolls back\ - \ the v0.20.x \u201Cselect all when selector is nil\u201D behavior unless\ - \ you explicitly set `spec.selectAllByDefault: true`. This can silently\ - \ reduce what gets scraped/selected after upgrade if you relied on nil selectors\ - \ selecting everything.", 'VMAuth Ingress API moved to `networking.k8s.io/v1`, - which effectively raises the minimum Kubernetes version for VMAuth Ingress - usage to 1.19. Clusters older than 1.19 (or manifests still using v1beta1) - will fail to apply.'] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Alertmanager ServiceScrape auto-generation was added, reducing manual scrape + configuration when alertmanager is managed by the operator. + - VMUser now automatically adds routing for VMCluster components (vminsert and + vmselect), simplifying multi-tenant access setup. + - VMAgent can now have its default disk space usage adjusted, making it easier + to tune persistent storage behavior. + - VMUser target references can now include custom HTTP headers, enabling additional + auth/metadata to be passed to upstreams. + breaking_changes: + - "Selector default behavior changed again: v0.21.0 rolls back the v0.20.x \u201C\ + select all when selector is nil\u201D behavior unless you explicitly set `spec.selectAllByDefault:\ + \ true`. This can silently reduce what gets scraped/selected after upgrade\ + \ if you relied on nil selectors selecting everything." + - VMAuth Ingress API moved to `networking.k8s.io/v1`, which effectively raises + the minimum Kubernetes version for VMAuth Ingress usage to 1.19. Clusters + older than 1.19 (or manifests still using v1beta1) will fail to apply. chart_version: 0.5.1 - images: ['victoriametrics/operator:v0.21.0'] + images: + - victoriametrics/operator:v0.21.0 - version: 0.20.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Custom headers can be set on the VMUser targetRef (useful when integrating - with auth/proxies that require extra headers).] - breaking_changes: ["CR selector defaults changed (e.g., vmagent.spec.serviceScrapeSelector\ - \ and similar): if a selector field is omitted, it now selects *all* matching\ - \ objects rather than selecting none. This can drastically increase scrape\ - \ targets if you relied on the old implicit \u2018select nothing\u2019 behavior.", - Operator no longer appends the cluster domain name for in-cluster communication; - the cluster domain value is now empty by default. This fixes clusters with - non-standard DNS domains but may break setups that depended on the previous - explicit domain concatenation.] + features: + - Custom headers can be set on the VMUser targetRef (useful when integrating + with auth/proxies that require extra headers). + breaking_changes: + - "CR selector defaults changed (e.g., vmagent.spec.serviceScrapeSelector and\ + \ similar): if a selector field is omitted, it now selects *all* matching\ + \ objects rather than selecting none. This can drastically increase scrape\ + \ targets if you relied on the old implicit \u2018select nothing\u2019 behavior." + - Operator no longer appends the cluster domain name for in-cluster communication; + the cluster domain value is now empty by default. This fixes clusters with + non-standard DNS domains but may break setups that depended on the previous + explicit domain concatenation. chart_version: 0.4.0 - images: ['victoriametrics/operator:v0.20.0'] + images: + - victoriametrics/operator:v0.20.0 - version: 0.19.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Single-namespace mode for the operator, allowing it to watch and - reconcile resources only in a specified namespace instead of cluster-wide.', - 'VMAlert Notifier service discovery support, enabling discovery of notifier - endpoints for vmalert integrations.', VMRule updates to support vmalert-specific - features (expanded rule capabilities when managed by vmalert)., 'Reduced - operator memory usage by disabling client-side caching for Pods, Deployments, - and StatefulSets.', 'Improved end-to-end tests (internal quality improvement, - no expected user-facing config change).'] + features: + - Single-namespace mode for the operator, allowing it to watch and reconcile + resources only in a specified namespace instead of cluster-wide. + - VMAlert Notifier service discovery support, enabling discovery of notifier + endpoints for vmalert integrations. + - VMRule updates to support vmalert-specific features (expanded rule capabilities + when managed by vmalert). + - Reduced operator memory usage by disabling client-side caching for Pods, Deployments, + and StatefulSets. + - Improved end-to-end tests (internal quality improvement, no expected user-facing + config change). breaking_changes: [] chart_version: 0.3.0 - images: ['victoriametrics/operator:v0.19.0'] + images: + - victoriametrics/operator:v0.19.0 - version: 0.18.0 - kube: ['1.25', '1.24', '1.23'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [CRDs are now generated for `apiextensions.k8s.io/v1`; `apiextensions.k8s.io/v1beta1` - is deprecated/legacy. Ensure your cluster is on a Kubernetes version that - supports v1 CRDs and that your Helm upgrade applies the updated CRDs (often - via `crds/` or a separate `kubectl apply -f` step)., 'Major API updates - to CRDs: `VMServiceScrape`, `VMPodScrape`, `VMProbe`, `VMStaticScrape`, - `VMNodeScrape` gained additional fields (e.g., `sampleLimit` and other missing - scrape config params) and new `vm_scrape_params` options; manifests may - need to be adjusted to use the new schema/fields.', '`spec.selector` is - now optional for `VMPodScrape` and `VMServiceScrape`; review existing resources - if you were relying on selector-required validation or admission behavior.', - "New CRD `VMAlertmanagerConfig` introduced; it only supports Alertmanager\ - \ v0.22+\u2014plan component version alignment if you intend to use it."] - features: [OAuth2 configuration added for `VMagent` remoteWrite and scrape endpoints; - you can now authenticate outbound remote writes and protected scrape targets - via OAuth2., '`TLSConfig` support added for `VMProbe`, enabling TLS settings - for blackbox-style probing targets.', 'New `vm_scrape_params` options and - expanded scrape config surface (e.g., `sampleLimit`, proxy authentication) - across multiple scrape-related CRDs, bringing them closer to vmagent configuration - capabilities.', New `VMAlertmanagerConfig` CRD for managing Alertmanager - config via Kubernetes resources (requires Alertmanager >= v0.22).] - breaking_changes: ["CRD API versioning shifts to `apiextensions.k8s.io/v1` as\ - \ the primary format; clusters relying on `v1beta1` CRDs must treat them\ - \ as legacy and may fail upgrades on newer Kubernetes if CRDs aren\u2019\ - t migrated/applied correctly.", "The \u201Cmajor API update\u201D to several\ - \ CRDs can break upgrades if existing custom resources no longer validate\ - \ against the updated OpenAPI schema; validate your existing `VMServiceScrape`/`VMPodScrape`/`VMProbe`/`VMStaticScrape`/`VMNodeScrape`\ - \ manifests against the new CRDs before upgrading."] + kube: + - '1.25' + - '1.24' + - '1.23' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - CRDs are now generated for `apiextensions.k8s.io/v1`; `apiextensions.k8s.io/v1beta1` + is deprecated/legacy. Ensure your cluster is on a Kubernetes version that + supports v1 CRDs and that your Helm upgrade applies the updated CRDs (often + via `crds/` or a separate `kubectl apply -f` step). + - 'Major API updates to CRDs: `VMServiceScrape`, `VMPodScrape`, `VMProbe`, `VMStaticScrape`, + `VMNodeScrape` gained additional fields (e.g., `sampleLimit` and other missing + scrape config params) and new `vm_scrape_params` options; manifests may need + to be adjusted to use the new schema/fields.' + - '`spec.selector` is now optional for `VMPodScrape` and `VMServiceScrape`; + review existing resources if you were relying on selector-required validation + or admission behavior.' + - "New CRD `VMAlertmanagerConfig` introduced; it only supports Alertmanager\ + \ v0.22+\u2014plan component version alignment if you intend to use it." + features: + - OAuth2 configuration added for `VMagent` remoteWrite and scrape endpoints; + you can now authenticate outbound remote writes and protected scrape targets + via OAuth2. + - '`TLSConfig` support added for `VMProbe`, enabling TLS settings for blackbox-style + probing targets.' + - New `vm_scrape_params` options and expanded scrape config surface (e.g., `sampleLimit`, + proxy authentication) across multiple scrape-related CRDs, bringing them closer + to vmagent configuration capabilities. + - New `VMAlertmanagerConfig` CRD for managing Alertmanager config via Kubernetes + resources (requires Alertmanager >= v0.22). + breaking_changes: + - "CRD API versioning shifts to `apiextensions.k8s.io/v1` as the primary format;\ + \ clusters relying on `v1beta1` CRDs must treat them as legacy and may fail\ + \ upgrades on newer Kubernetes if CRDs aren\u2019t migrated/applied correctly." + - "The \u201Cmajor API update\u201D to several CRDs can break upgrades if existing\ + \ custom resources no longer validate against the updated OpenAPI schema;\ + \ validate your existing `VMServiceScrape`/`VMPodScrape`/`VMProbe`/`VMStaticScrape`/`VMNodeScrape`\ + \ manifests against the new CRDs before upgrading." chart_version: 0.2.0 - images: ['victoriametrics/operator:v0.18.0'] + images: + - victoriametrics/operator:v0.18.0 - version: 0.17.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Adds an experimental custom config reloader to mitigate long configuration - sync; enable it via env var `VM_USECUSTOMCONFIGRELOADER=true`., Reduces - Kubernetes API server load when handling `VMPodScrape` resources., 'Exposes - a `/debug/pprof` endpoint on `0.0.0.0:8435` for profiling/troubleshooting.', - Updates default versions for VictoriaMetrics apps to v1.63.0., Documentation - updates.] - breaking_changes: ['`VMAgent` `RemoteWriteSpec` was changed: some options were - moved into `RemoteWriteSettings`, so existing CRs may need field/path updates - before/after upgrade.'] + features: + - Adds an experimental custom config reloader to mitigate long configuration + sync; enable it via env var `VM_USECUSTOMCONFIGRELOADER=true`. + - Reduces Kubernetes API server load when handling `VMPodScrape` resources. + - Exposes a `/debug/pprof` endpoint on `0.0.0.0:8435` for profiling/troubleshooting. + - Updates default versions for VictoriaMetrics apps to v1.63.0. + - Documentation updates. + breaking_changes: + - '`VMAgent` `RemoteWriteSpec` was changed: some options were moved into `RemoteWriteSettings`, + so existing CRs may need field/path updates before/after upgrade.' chart_version: 0.1.18 - images: ['victoriametrics/operator:v0.17.1'] + images: + - victoriametrics/operator:v0.17.1 - version: 0.16.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Experimental custom config-reloader to mitigate long config sync; - enable with env var `VM_USECUSTOMCONFIGRELOADER=true`., Reduced Kubernetes - API server load when handling `VMPodScrape` resources., 'Added `/debug/pprof` - handler served on `0.0.0.0:8435` for profiling/debugging.'] - breaking_changes: ['`VMAgent` `RemoteWriteSpec` changed: some options moved - into `RemoteWriteSettings`; existing manifests may need updates to match - the new schema.'] + features: + - Experimental custom config-reloader to mitigate long config sync; enable with + env var `VM_USECUSTOMCONFIGRELOADER=true`. + - Reduced Kubernetes API server load when handling `VMPodScrape` resources. + - Added `/debug/pprof` handler served on `0.0.0.0:8435` for profiling/debugging. + breaking_changes: + - '`VMAgent` `RemoteWriteSpec` changed: some options moved into `RemoteWriteSettings`; + existing manifests may need updates to match the new schema.' chart_version: 0.1.17 - images: ['victoriametrics/operator:v0.16.0'] + images: + - victoriametrics/operator:v0.16.0 - version: 0.15.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['All CRD-backed resources now support `nodeSelector`, allowing you - to pin operator-managed workloads to specific nodes.', '`vminsert` and `vmselect` - can now be autoscaled via HorizontalPodAutoscaler (HPA).', 'Two new CRDs - were added: `VMAuth` and `VMUser`, enabling operator-managed auth/user resources.', - 'HostPath volumes are now supported, and you can override the `storageDataPath` - setting when using them.'] + features: + - All CRD-backed resources now support `nodeSelector`, allowing you to pin operator-managed + workloads to specific nodes. + - '`vminsert` and `vmselect` can now be autoscaled via HorizontalPodAutoscaler + (HPA).' + - 'Two new CRDs were added: `VMAuth` and `VMUser`, enabling operator-managed + auth/user resources.' + - HostPath volumes are now supported, and you can override the `storageDataPath` + setting when using them. breaking_changes: [] chart_version: 0.1.14 - images: ['victoriametrics/operator:v0.15.0'] + images: + - victoriametrics/operator:v0.15.0 - version: 0.14.2 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.13 - images: ['victoriametrics/operator:v0.14.2'] + images: + - victoriametrics/operator:v0.14.2 - version: 0.13.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Adds probe customization via CRD, allowing you to tune readiness/liveness/startup - probes for managed components without patching generated manifests.'] + features: + - Adds probe customization via CRD, allowing you to tune readiness/liveness/startup + probes for managed components without patching generated manifests. breaking_changes: [] chart_version: 0.1.12 - images: ['victoriametrics/operator:v0.13.0'] + images: + - victoriametrics/operator:v0.13.0 - version: 0.12.2 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.10 - images: ['victoriametrics/operator:v0.12.2'] + images: + - victoriametrics/operator:v0.12.2 - version: 0.11.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.9 - images: ['victoriametrics/operator:v0.11.0'] + images: + - victoriametrics/operator:v0.11.0 - version: 0.9.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['VMPodScrape: basic auth, bearer token, and TLS connection support - were added, enabling secure scraping configurations.', 'VMSingle/VMCluster: - new `insertPorts` option allows configuring ingestion ports for OpenTSDB, - Graphite, and Influx protocols.', 'vmalert: support for `externalLabels` - was added to attach extra labels to generated alerts/metrics.'] - breaking_changes: ['RBAC changes: role/namespace handling was adjusted; verify - the operator has the expected permissions in the target namespace(s) after - upgrade.'] + features: + - 'VMPodScrape: basic auth, bearer token, and TLS connection support were added, + enabling secure scraping configurations.' + - 'VMSingle/VMCluster: new `insertPorts` option allows configuring ingestion + ports for OpenTSDB, Graphite, and Influx protocols.' + - 'vmalert: support for `externalLabels` was added to attach extra labels to + generated alerts/metrics.' + breaking_changes: + - 'RBAC changes: role/namespace handling was adjusted; verify the operator has + the expected permissions in the target namespace(s) after upgrade.' chart_version: 0.1.8 - images: ['victoriametrics/operator:v0.9.1'] + images: + - victoriametrics/operator:v0.9.1 - version: 0.8.0 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Operator v0.8.0 includes additional VMPodScrape connection/auth - options (basic auth, bearer token, TLS) and new ingestion port configuration - via `insertPorts` for VMSingle and VMCluster.', Includes minor documentation - fixes (operator-hub broken links) and stability fixes (panic fixes around - VMCluster).] - features: ['VMPodScrape now supports basic auth, bearer token authentication, - and TLS configuration for scraping endpoints.', 'VMSingle and VMCluster - add `insertPorts` to configure ingestion ports for OpenTSDB, Graphite, and - Influx protocols.'] + chart_updates: + - Operator v0.8.0 includes additional VMPodScrape connection/auth options (basic + auth, bearer token, TLS) and new ingestion port configuration via `insertPorts` + for VMSingle and VMCluster. + - Includes minor documentation fixes (operator-hub broken links) and stability + fixes (panic fixes around VMCluster). + features: + - VMPodScrape now supports basic auth, bearer token authentication, and TLS + configuration for scraping endpoints. + - VMSingle and VMCluster add `insertPorts` to configure ingestion ports for + OpenTSDB, Graphite, and Influx protocols. breaking_changes: [] chart_version: 0.1.7 - images: ['victoriametrics/operator:v0.8.0'] + images: + - victoriametrics/operator:v0.8.0 - version: 0.7.3 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.5 - images: ['victoriametrics/operator:v0.7.3'] + images: + - victoriametrics/operator:v0.7.3 - version: 0.6.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.4 - images: ['victoriametrics/operator:v0.6.1'] + images: + - victoriametrics/operator:v0.6.1 - version: 0.2.1 - kube: ['1.25', '1.24', '1.23'] + kube: + - '1.25' + - '1.24' + - '1.23' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: ['victoriametrics/operator:v0.2.1'] + images: + - victoriametrics/operator:v0.2.1 name: victoria-metrics-operator - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/nvidia-operator/plural/icons/nvidia.png?raw=true git_url: https://github.com/NVIDIA/gpu-operator @@ -28557,298 +38620,543 @@ addons: readme_url: https://github.com/NVIDIA/gpu-operator/blob/main/README.md versions: - version: 26.7.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] chart_version: 26.7.0 - images: ['nvcr.io/nvidia/gpu-operator:v26.7.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.19.0'] + images: + - nvcr.io/nvidia/gpu-operator:v26.7.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.19.0 incompatibilities: [] - version: 26.3.3 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] chart_version: 26.3.3 - images: ['nvcr.io/nvidia/gpu-operator:v26.3.3', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] + images: + - nvcr.io/nvidia/gpu-operator:v26.3.3 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 incompatibilities: [] - version: 26.3.2 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] chart_version: 26.3.2 - images: ['nvcr.io/nvidia/gpu-operator:v26.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] + images: + - nvcr.io/nvidia/gpu-operator:v26.3.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 incompatibilities: [] - version: 26.3.1 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] chart_version: 26.3.1 - images: ['nvcr.io/nvidia/gpu-operator:v26.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] + images: + - nvcr.io/nvidia/gpu-operator:v26.3.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 incompatibilities: [] - version: 26.3.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] chart_version: 26.3.0 - images: ['nvcr.io/nvidia/gpu-operator:v26.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] + images: + - nvcr.io/nvidia/gpu-operator:v26.3.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 incompatibilities: [] - version: 25.10.1 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] chart_version: 25.10.1 - images: ['nvcr.io/nvidia/gpu-operator:v25.10.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.2'] + images: + - nvcr.io/nvidia/gpu-operator:v25.10.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.2 incompatibilities: [] - version: 25.10.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] chart_version: 25.10.0 - images: ['nvcr.io/nvidia/gpu-operator:v25.10.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.2'] + images: + - nvcr.io/nvidia/gpu-operator:v25.10.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.18.2 incompatibilities: [] - version: 25.3.4 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] chart_version: 25.3.4 - images: ['nvcr.io/nvidia/gpu-operator:v25.3.4', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] + images: + - nvcr.io/nvidia/gpu-operator:v25.3.4 + - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 incompatibilities: [] - version: 25.3.3 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] chart_version: 25.3.3 - images: ['nvcr.io/nvidia/gpu-operator:v25.3.3', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] + images: + - nvcr.io/nvidia/gpu-operator:v25.3.3 + - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 incompatibilities: [] - version: 25.3.2 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] chart_version: 25.3.2 - images: ['nvcr.io/nvidia/gpu-operator:v25.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] + images: + - nvcr.io/nvidia/gpu-operator:v25.3.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 incompatibilities: [] - version: 25.3.1 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] chart_version: 25.3.1 - images: ['nvcr.io/nvidia/gpu-operator:v25.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] + images: + - nvcr.io/nvidia/gpu-operator:v25.3.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 incompatibilities: [] - version: 25.3.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] chart_version: 25.3.0 - images: ['nvcr.io/nvidia/gpu-operator:v25.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.2'] + images: + - nvcr.io/nvidia/gpu-operator:v25.3.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.17.2 incompatibilities: [] - version: 24.9.2 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] chart_version: 24.9.2 - images: ['nvcr.io/nvidia/gpu-operator:v24.9.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] + images: + - nvcr.io/nvidia/gpu-operator:v24.9.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 incompatibilities: [] - version: 24.9.1 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] chart_version: 24.9.1 - images: ['nvcr.io/nvidia/gpu-operator:v24.9.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] + images: + - nvcr.io/nvidia/gpu-operator:v24.9.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 incompatibilities: [] - version: 24.9.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] chart_version: 24.9.0 - images: ['nvcr.io/nvidia/gpu-operator:v24.9.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] + images: + - nvcr.io/nvidia/gpu-operator:v24.9.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 incompatibilities: [] - version: 24.6.2 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] chart_version: 24.6.2 - images: ['nvcr.io/nvidia/gpu-operator:v24.6.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] + images: + - nvcr.io/nvidia/gpu-operator:v24.6.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 incompatibilities: [] - version: 24.6.1 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] chart_version: 24.6.1 - images: ['nvcr.io/nvidia/gpu-operator:v24.6.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] + images: + - nvcr.io/nvidia/gpu-operator:v24.6.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 incompatibilities: [] - version: 24.6.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] chart_version: 24.6.0 - images: ['nvcr.io/nvidia/gpu-operator:v24.6.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] + images: + - nvcr.io/nvidia/gpu-operator:v24.6.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 incompatibilities: [] - version: 24.3.0 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] chart_version: 24.3.0 - images: ['nvcr.io/nvidia/gpu-operator:v24.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.15.4'] + images: + - nvcr.io/nvidia/gpu-operator:v24.3.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.15.4 incompatibilities: [] - version: 23.9.2 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] chart_version: 23.9.2 - images: ['nvcr.io/nvidia/gpu-operator:v23.9.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] + images: + - nvcr.io/nvidia/gpu-operator:v23.9.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 incompatibilities: [] - version: 23.9.1 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] chart_version: 23.9.1 - images: ['nvcr.io/nvidia/gpu-operator:v23.9.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] + images: + - nvcr.io/nvidia/gpu-operator:v23.9.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 incompatibilities: [] - version: 23.9.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] chart_version: 23.9.0 - images: ['nvcr.io/nvidia/gpu-operator:v23.9.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] + images: + - nvcr.io/nvidia/gpu-operator:v23.9.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 incompatibilities: [] - version: 23.6.2 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] chart_version: 23.6.2 - images: ['nvcr.io/nvidia/gpu-operator:v23.6.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.6.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 incompatibilities: [] - version: 23.6.1 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] chart_version: 23.6.1 - images: ['nvcr.io/nvidia/gpu-operator:v23.6.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.6.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 incompatibilities: [] - version: 23.6.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] chart_version: 23.6.0 - images: ['nvcr.io/nvidia/gpu-operator:v23.6.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.6.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 incompatibilities: [] - version: 23.3.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 23.3.2 - images: ['nvcr.io/nvidia/gpu-operator:v23.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.3.2 + - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 incompatibilities: [] - version: 23.3.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 23.3.1 - images: ['nvcr.io/nvidia/gpu-operator:v23.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.3.1 + - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 incompatibilities: [] - version: 23.3.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 23.3.0 - images: ['nvcr.io/nvidia/gpu-operator:v23.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] + images: + - nvcr.io/nvidia/gpu-operator:v23.3.0 + - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 incompatibilities: [] - version: 22.9.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 22.9.2 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.2'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v22.9.2 incompatibilities: [] - version: 22.9.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 22.9.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v22.9.1 incompatibilities: [] - version: 22.9.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 22.9.0 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.0'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v22.9.0 incompatibilities: [] - version: 1.11.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.11.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.11.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v1.11.1 incompatibilities: [] - version: 1.11.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.11.0 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.11.0'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v1.11.0 incompatibilities: [] - version: 1.10.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.10.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.10.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v1.10.1 incompatibilities: [] - version: 1.10.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.10.0 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.10.0'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 + - nvcr.io/nvidia/gpu-operator:v1.10.0 incompatibilities: [] - version: 1.9.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.9.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.9.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.9.1 incompatibilities: [] - version: 1.9.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.9.0 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.9.0'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.9.0 incompatibilities: [] - version: 1.8.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.8.2 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.2'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.8.2 incompatibilities: [] - version: 1.8.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.8.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.8.1 incompatibilities: [] - version: 1.8.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.8.0 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.0'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.8.0 incompatibilities: [] - version: 1.7.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.7.1 - images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.7.1'] + images: + - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 + - nvcr.io/nvidia/gpu-operator:v1.7.1 incompatibilities: [] - version: 1.7.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.7.0 - images: ['nvcr.io/nvidia/gpu-operator:v1.7.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:v1.7.0 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.6.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.6.2 - images: ['nvcr.io/nvidia/gpu-operator:1.6.2', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.6.2 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.6.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.6.1 - images: ['nvcr.io/nvidia/gpu-operator:1.6.1', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.6.1 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.6.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.6.0 - images: ['nvcr.io/nvidia/gpu-operator:1.6.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.6.0 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.5.2 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.5.2 - images: ['nvcr.io/nvidia/gpu-operator:1.5.2', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.5.2 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.5.1 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.5.1 - images: ['nvcr.io/nvidia/gpu-operator:1.5.1', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.5.1 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.5.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.5.0 - images: ['nvcr.io/nvidia/gpu-operator:1.5.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.5.0 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] - version: 1.4.0 - kube: ['1.26', '1.25', '1.24'] + kube: + - '1.26' + - '1.25' + - '1.24' requirements: [] chart_version: 1.4.0 - images: ['nvcr.io/nvidia/gpu-operator:1.4.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] + images: + - nvcr.io/nvidia/gpu-operator:1.4.0 + - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 incompatibilities: [] name: gpu-operator - icon: https://avatars.githubusercontent.com/u/14012520?v=4 @@ -28858,67 +39166,84 @@ addons: chart_name: harbor versions: - version: 2.14.0 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Introduces a replication adapter whitelist to explicitly define - which replication adapters are actively supported (and therefore allowed)., - "Replication: optional \u201CSingle Active Replication\u201D mode to prevent\ - \ parallel executions under the same policy.", Proxy-cache behavior improved - to better synchronize with upstream registries (purges local cache when - upstream artifacts are deleted; can serve local manifests when digests match - upstream)., 'Artifact scanning enhancements: CVE reports can include fixVersion; - vulnerability checking behavior improved for non-scannable artifacts.', - 'Garbage collection UX improvement: shows GC progress while a run is in progress.', - 'CNAI (CloudNativeAI) integration enhanced: supports raw CNAI model format.', - 'Jobservice enhancement: retention count for job executions can be customized - via environment variable (new configurability).', Various component/dependency - updates and UI fixes; adds Russian language support.] - features: ["Enhanced proxy-cache: Harbor can delete local cached artifacts when\ - \ they\u2019re removed upstream and can serve a local manifest when its\ - \ digest matches upstream.", Single Active Replication option to ensure - only one replication execution runs at a time per policy (prevents overlapping - parallel runs)., 'Enhanced artifact scanning: CVE reports can include fixVersion - and Harbor can better handle/skip checks for non-scannable artifacts.', - 'Enhanced garbage collection visibility: GC progress is displayed while GC - is running.', 'Enhanced CNAI model support: raw CNAI model format is now - supported.'] - breaking_changes: ['Replication adapter whitelist introduced: deployments may - need to explicitly allow the replication adapters they use; unsupported/unlisted - adapters may no longer work until permitted.'] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Introduces a replication adapter whitelist to explicitly define which replication + adapters are actively supported (and therefore allowed). + - "Replication: optional \u201CSingle Active Replication\u201D mode to prevent\ + \ parallel executions under the same policy." + - Proxy-cache behavior improved to better synchronize with upstream registries + (purges local cache when upstream artifacts are deleted; can serve local manifests + when digests match upstream). + - 'Artifact scanning enhancements: CVE reports can include fixVersion; vulnerability + checking behavior improved for non-scannable artifacts.' + - 'Garbage collection UX improvement: shows GC progress while a run is in progress.' + - 'CNAI (CloudNativeAI) integration enhanced: supports raw CNAI model format.' + - 'Jobservice enhancement: retention count for job executions can be customized + via environment variable (new configurability).' + - Various component/dependency updates and UI fixes; adds Russian language support. + features: + - "Enhanced proxy-cache: Harbor can delete local cached artifacts when they\u2019\ + re removed upstream and can serve a local manifest when its digest matches\ + \ upstream." + - Single Active Replication option to ensure only one replication execution + runs at a time per policy (prevents overlapping parallel runs). + - 'Enhanced artifact scanning: CVE reports can include fixVersion and Harbor + can better handle/skip checks for non-scannable artifacts.' + - 'Enhanced garbage collection visibility: GC progress is displayed while GC + is running.' + - 'Enhanced CNAI model support: raw CNAI model format is now supported.' + breaking_changes: + - 'Replication adapter whitelist introduced: deployments may need to explicitly + allow the replication adapters they use; unsupported/unlisted adapters may + no longer work until permitted.' chart_version: 1.18.0 images: [] - version: 2.13.0 - kube: ['1.31', '1.30', '1.29'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Audit log extension: adds a new audit_log_ext table plus API/filtering - to provide more granular and performant audit event tracking (including - login/logout/config/user events).', 'Enhanced OIDC: adds PKCE support and - improves logout/session handling and related audit logging.', 'Redis TLS - support: Harbor core/jobservice can now connect to Redis over TLS (including - external Redis TLS options).', 'CloudNativeAI integration: introduces a - CNAI model processor and a new AI Model artifact type for managing AI model - artifacts.', 'Enhanced Dragonfly/P2P preheating: extends preheat policies - with new parameters, scope customization, and targeting (useful for large - AI model images).'] - breaking_changes: [CSRF key generation changed; existing deployments may need - to regenerate/rotate CSRF-related secrets to avoid login/session issues - after upgrade., Removed the with_signature option; any automation or integrations - relying on it must be updated/removed., 'RBAC change: Project maintainers/developers/guests - can no longer list project logs; only higher-privilege roles can access - those logs now.', robotV1 removed from the codebase (deprecation realized); - any clients/scripts using legacy robot APIs must migrate to the newer robot - account model.] + kube: + - '1.31' + - '1.30' + - '1.29' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - 'Audit log extension: adds a new audit_log_ext table plus API/filtering to + provide more granular and performant audit event tracking (including login/logout/config/user + events).' + - 'Enhanced OIDC: adds PKCE support and improves logout/session handling and + related audit logging.' + - 'Redis TLS support: Harbor core/jobservice can now connect to Redis over TLS + (including external Redis TLS options).' + - 'CloudNativeAI integration: introduces a CNAI model processor and a new AI + Model artifact type for managing AI model artifacts.' + - 'Enhanced Dragonfly/P2P preheating: extends preheat policies with new parameters, + scope customization, and targeting (useful for large AI model images).' + breaking_changes: + - CSRF key generation changed; existing deployments may need to regenerate/rotate + CSRF-related secrets to avoid login/session issues after upgrade. + - Removed the with_signature option; any automation or integrations relying + on it must be updated/removed. + - 'RBAC change: Project maintainers/developers/guests can no longer list project + logs; only higher-privilege roles can access those logs now.' + - robotV1 removed from the codebase (deprecation realized); any clients/scripts + using legacy robot APIs must migrate to the newer robot account model. chart_version: 1.17.0 images: [] - version: 2.12.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: null @@ -28932,152 +39257,257 @@ addons: readme_url: https://github.com/elastic/elasticsearch/blob/main/README.asciidoc versions: - version: 9.5.3 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: null chart_version: 9.5.3 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.5.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.5.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.5.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 9.5.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.5.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.5.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.4.6 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: null chart_version: 9.4.6 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.4.6', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.4.6 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.4.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 9.4.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.4.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.4.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.3.4 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 9.3.4 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.3.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.3.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.3.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 9.3.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.3.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.3.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.2.4 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 9.2.4 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.2.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.2.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.2.0 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 9.2.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.2.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.2.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.1.9 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 9.1.9 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.9', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.1.9 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.1.4 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 9.1.4 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.1.4 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.1.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 9.1.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.1.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 9.0.7 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 9.0.7 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.0.7', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.0.7 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 9.0.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 9.0.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:9.0.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:9.0.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 8.19.21 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: null chart_version: 8.19.21 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.21', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.19.21 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 8.19.14 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 8.19.14 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.14', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.19.14 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 8.19.10 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: null chart_version: 8.19.10 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.10', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.19.10 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 8.19.3 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 8.19.3 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.19.3 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 8.19.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 8.19.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.19.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 8.18.7 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null chart_version: 8.18.7 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.7', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.18.7 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 - version: 8.18.1 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: null chart_version: 8.18.1 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.18.1 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - version: 8.18.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: null chart_version: 8.18.0 - images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + images: + - docker.elastic.co/elastic-agent/elastic-agent:8.18.0 + - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 name: elastic-agent - icon: https://avatars.githubusercontent.com/u/96669?s=48&v=4 git_url: https://github.com/rabbitmq/cluster-operator @@ -29086,433 +39516,891 @@ addons: chart_name: rabbitmq-cluster-operator versions: - version: 2.16.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Support scaling RabbitMQ clusters down to zero replicas (introduced - in v2.16.0)., Operator now deploys RabbitMQ 4.1.3 by default (v2.16.1)., - 'Dependencies/tooling updates: Go toolchain bumped to address CVE-2025-4674 - and CVE-2025-47907, and dependabot config added for Go tooling (v2.16.1).'] - breaking_changes: ['Upgrading the cluster-operator triggers reconciliation that - will roll RabbitMQ cluster StatefulSets, causing a rolling update of the - RabbitMQ nodes. To control timing, pause reconciliation before upgrading - and resume when safe (noted for both v2.16.0 and v2.16.1).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Support scaling RabbitMQ clusters down to zero replicas (introduced in v2.16.0). + - Operator now deploys RabbitMQ 4.1.3 by default (v2.16.1). + - 'Dependencies/tooling updates: Go toolchain bumped to address CVE-2025-4674 + and CVE-2025-47907, and dependabot config added for Go tooling (v2.16.1).' + breaking_changes: + - Upgrading the cluster-operator triggers reconciliation that will roll RabbitMQ + cluster StatefulSets, causing a rolling update of the RabbitMQ nodes. To control + timing, pause reconciliation before upgrading and resume when safe (noted + for both v2.16.0 and v2.16.1). chart_version: 4.4.34 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.16.1-debian-12-r0', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.4-debian-12-r0'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.16.1-debian-12-r0 + - docker.io/bitnami/rmq-messaging-topology-operator:1.17.4-debian-12-r0 - version: 2.16.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [Operator now supports scaling RabbitMQ clusters down to zero replicas - (useful for dev/test or cost-saving scenarios).] - breaking_changes: ['Upgrading the operator triggers reconciliation that will - roll RabbitMQ StatefulSets (a rolling update of clusters). Pause reconciliation - before upgrading if you need to control when cluster pods roll, then resume - when safe.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Operator now supports scaling RabbitMQ clusters down to zero replicas (useful + for dev/test or cost-saving scenarios). + breaking_changes: + - Upgrading the operator triggers reconciliation that will roll RabbitMQ StatefulSets + (a rolling update of clusters). Pause reconciliation before upgrading if you + need to control when cluster pods roll, then resume when safe. chart_version: 4.4.32 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.16.0-debian-12-r2', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r2'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.16.0-debian-12-r2 + - docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r2 - version: 2.15.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator defaults to deploying RabbitMQ 4.1.1 and includes updated - Prometheus alerting/recording rules for RabbitMQ 4.1., Grafana queue dashboard - was updated., Operator Lifecycle Manager (OLM) workflow/refactor updates - (mostly packaging/ops plumbing)., Go toolchain/dependency bump to address - CVE-2025-22874.] - features: [Can optionally auto-enable all RabbitMQ feature flags (new operator - option)., Updated monitoring content (Prometheus rules and Grafana dashboard) - aligned with RabbitMQ 4.1., RabbitMQ 4.1.1 is now the default deployed version - when the operator manages clusters.] - breaking_changes: [Upgrading the operator will trigger reconciliation and may - cause a rolling update of managed RabbitMQ StatefulSets; pause reconciliation - if you need to control timing., Default RabbitMQ version change to 4.1.1 - can be a functional upgrade for clusters if you were previously relying - on the prior default image/version.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator defaults to deploying RabbitMQ 4.1.1 and includes updated Prometheus + alerting/recording rules for RabbitMQ 4.1. + - Grafana queue dashboard was updated. + - Operator Lifecycle Manager (OLM) workflow/refactor updates (mostly packaging/ops + plumbing). + - Go toolchain/dependency bump to address CVE-2025-22874. + features: + - Can optionally auto-enable all RabbitMQ feature flags (new operator option). + - Updated monitoring content (Prometheus rules and Grafana dashboard) aligned + with RabbitMQ 4.1. + - RabbitMQ 4.1.1 is now the default deployed version when the operator manages + clusters. + breaking_changes: + - Upgrading the operator will trigger reconciliation and may cause a rolling + update of managed RabbitMQ StatefulSets; pause reconciliation if you need + to control timing. + - Default RabbitMQ version change to 4.1.1 can be a functional upgrade for clusters + if you were previously relying on the prior default image/version. chart_version: 4.4.26 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.15.0-debian-12-r1', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r0'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.15.0-debian-12-r1 + - docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r0 - version: 2.14.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator upgrade to v2.14.0 is expected to trigger reconciliation - and a rolling update of managed RabbitMQ StatefulSets unless reconciliation - is paused., 'Mostly maintenance/refactor release: tooling refactor and dependency - bumps; no new operator-facing features called out beyond logging/doc tweaks.'] - features: [Documentation now explicitly includes the default `delayStartSeconds` - value., Operator logs an explicit line when FIPS mode is enabled (helps - compliance/debugging).] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator upgrade to v2.14.0 is expected to trigger reconciliation and a rolling + update of managed RabbitMQ StatefulSets unless reconciliation is paused. + - 'Mostly maintenance/refactor release: tooling refactor and dependency bumps; + no new operator-facing features called out beyond logging/doc tweaks.' + features: + - Documentation now explicitly includes the default `delayStartSeconds` value. + - Operator logs an explicit line when FIPS mode is enabled (helps compliance/debugging). breaking_changes: [] chart_version: 4.4.22 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.14.0-debian-12-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.1-debian-12-r3'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.14.0-debian-12-r3 + - docker.io/bitnami/rmq-messaging-topology-operator:1.17.1-debian-12-r3 - version: 2.13.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: ['Default RabbitMQ image (when `.spec.image` is not set) moves from - `rabbitmq:4.0.5-management` (v2.12.0 behavior) to `rabbitmq:4.1.0-management` - in v2.13.0, which can trigger a rolling update of StatefulSets.', "Resource\ - \ tuning: the init container defaults are reduced significantly (memory\ - \ 500Mi\u219264Mi, CPU 100m\u219220m).", Adds support for custom Service - labels via `spec.service.labels` on the RabbitMQ resource., 'Adds a `PrometheusRule` - for RabbitMQ alarm states and improves Prometheus rule handling (e.g., merging - `rabbitmq_identity_info`) plus validation via `promtool`.', 'Operational - improvements: better cluster deletion behavior, plus general dependency - bumps and codebase modernization.'] - breaking_changes: ['Upgrading the cluster-operator to v2.13.0 will update managed - RabbitMQ clusters (rolling update of underlying StatefulSets). If you need - to control timing, pause reconciliation before upgrading and resume afterward - when safe.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - Default RabbitMQ image (when `.spec.image` is not set) moves from `rabbitmq:4.0.5-management` + (v2.12.0 behavior) to `rabbitmq:4.1.0-management` in v2.13.0, which can trigger + a rolling update of StatefulSets. + - "Resource tuning: the init container defaults are reduced significantly (memory\ + \ 500Mi\u219264Mi, CPU 100m\u219220m)." + - Adds support for custom Service labels via `spec.service.labels` on the RabbitMQ + resource. + - Adds a `PrometheusRule` for RabbitMQ alarm states and improves Prometheus + rule handling (e.g., merging `rabbitmq_identity_info`) plus validation via + `promtool`. + - 'Operational improvements: better cluster deletion behavior, plus general + dependency bumps and codebase modernization.' + breaking_changes: + - Upgrading the cluster-operator to v2.13.0 will update managed RabbitMQ clusters + (rolling update of underlying StatefulSets). If you need to control timing, + pause reconciliation before upgrading and resume afterward when safe. chart_version: 4.4.13 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.13.0-debian-12-r0', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.0-debian-12-r1'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.13.0-debian-12-r0 + - docker.io/bitnami/rmq-messaging-topology-operator:1.17.0-debian-12-r1 - version: 2.12.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Default RabbitMQ image when none is specified is now `rabbitmq:4.0.5-management`.', - '`readinessProbe` and `livenessProbe` are now configurable/overridable.'] - features: ['Operator can now populate a `connection_string` entry in the default - user Secret, making it easier for apps to discover connection parameters.', - Web MQTT/STOMP TLS port enablement condition logic was updated to better reflect - intended behavior., Users can now override `readinessProbe` and `livenessProbe` - for RabbitMQ Pods to tune health checks., 'If no image is specified for - a RabbitMQ cluster, the operator now defaults to `rabbitmq:4.0.5-management`.'] - breaking_changes: ['Upgrading the operator can trigger rolling updates of managed - RabbitMQ clusters (StatefulSets). If you need to control timing, pause reconciliation - before upgrading and resume when safe.', 'The implicit default RabbitMQ - image changes to `rabbitmq:4.0.5-management` when `spec.image` is unset; - clusters relying on the previous implicit default may change RabbitMQ version/variant - after upgrade.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Default RabbitMQ image when none is specified is now `rabbitmq:4.0.5-management`. + - '`readinessProbe` and `livenessProbe` are now configurable/overridable.' + features: + - Operator can now populate a `connection_string` entry in the default user + Secret, making it easier for apps to discover connection parameters. + - Web MQTT/STOMP TLS port enablement condition logic was updated to better reflect + intended behavior. + - Users can now override `readinessProbe` and `livenessProbe` for RabbitMQ Pods + to tune health checks. + - If no image is specified for a RabbitMQ cluster, the operator now defaults + to `rabbitmq:4.0.5-management`. + breaking_changes: + - Upgrading the operator can trigger rolling updates of managed RabbitMQ clusters + (StatefulSets). If you need to control timing, pause reconciliation before + upgrading and resume when safe. + - The implicit default RabbitMQ image changes to `rabbitmq:4.0.5-management` + when `spec.image` is unset; clusters relying on the previous implicit default + may change RabbitMQ version/variant after upgrade. chart_version: 4.4.2 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.12.0-debian-12-r1', 'docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r5'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.12.0-debian-12-r1 + - docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r5 - version: 2.11.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator upgrade to v2.11.0 will trigger reconciliation changes - that can roll RabbitMQ StatefulSets; plan/pause reconciliation to control - timing., 'Default-user secret content changes: a `connection_string` key - is now added to the default_user Secret.', TLS listener condition logic - updated for Web MQTT/STOMP TLS ports (may affect when those ports are opened/advertised)., - 'Certificate handling fix: CA certs no longer override server certs (affects - TLS setups).', 'Operational robustness: ignore mirroring-related shutdown - errors during shutdown/scale events.', 'Misc: dependency updates and linter/CI - fixes (no functional action typically required).'] - features: [Default RabbitMQ user Secret now includes a `connection_string` value - to simplify client configuration., Improved condition handling for enabling - Web MQTT/STOMP TLS ports.] - breaking_changes: [Upgrading the operator to v2.11.0 will cause a rolling update - of managed RabbitMQ StatefulSets unless reconciliation is paused; schedule - maintenance or pause/resume reconciliation to control rollout., 'If you - have automation that consumes the default_user Secret and expects a fixed - schema, the new `connection_string` field may require updates (e.g., strict - JSON/YAML parsing or templating).'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator upgrade to v2.11.0 will trigger reconciliation changes that can roll + RabbitMQ StatefulSets; plan/pause reconciliation to control timing. + - 'Default-user secret content changes: a `connection_string` key is now added + to the default_user Secret.' + - TLS listener condition logic updated for Web MQTT/STOMP TLS ports (may affect + when those ports are opened/advertised). + - 'Certificate handling fix: CA certs no longer override server certs (affects + TLS setups).' + - 'Operational robustness: ignore mirroring-related shutdown errors during shutdown/scale + events.' + - 'Misc: dependency updates and linter/CI fixes (no functional action typically + required).' + features: + - Default RabbitMQ user Secret now includes a `connection_string` value to simplify + client configuration. + - Improved condition handling for enabling Web MQTT/STOMP TLS ports. + breaking_changes: + - Upgrading the operator to v2.11.0 will cause a rolling update of managed RabbitMQ + StatefulSets unless reconciliation is paused; schedule maintenance or pause/resume + reconciliation to control rollout. + - If you have automation that consumes the default_user Secret and expects a + fixed schema, the new `connection_string` field may require updates (e.g., + strict JSON/YAML parsing or templating). chart_version: 4.4.0 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.11.0-debian-12-r4', 'docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r2'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.11.0-debian-12-r4 + - docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r2 - version: 2.10.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Operator upgrade will trigger rolling updates of managed RabbitMQ - StatefulSets; to control timing, pause reconciliation before upgrading the - operator and resume when safe.', CRD updates included in v2.9.0 (ensure - CRDs are applied as part of the upgrade)., 'Default RabbitMQ version managed - by the operator changes (3.13.2 in v2.9.0; 3.13.7 in v2.10.0), which can - cause cluster rolling restarts if you rely on defaults.', "New optional\ - \ annotation `rabbitmq.com/disable-default-topology-spread-constraints`\ - \ allows disabling the operator\u2019s default topology spread constraints\ - \ behavior."] - features: [Adds support for disabling the default topology spread constraints - via a new `rabbitmq.com/disable-default-topology-spread-constraints` annotation., - 'Increases the maximum allowed length of `additionalConfig`, enabling larger - custom RabbitMQ configuration snippets.', 'Changes default managed RabbitMQ - version to 3.13.7 (from 3.13.2 in 2.9.0), bringing RabbitMQ patch-level - updates by default.'] - breaking_changes: ['ANONYMOUS login is now disabled by default, which can break - clients or tooling relying on unauthenticated access; verify configured - users/permissions and update integrations accordingly.', '`vm_memory_high_watermark_paging_ratio` - is removed; if you set it anywhere (additionalConfig, ConfigMap, definitions), - remove it to avoid invalid configuration warnings/errors on newer RabbitMQ - versions.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator upgrade will trigger rolling updates of managed RabbitMQ StatefulSets; + to control timing, pause reconciliation before upgrading the operator and + resume when safe. + - CRD updates included in v2.9.0 (ensure CRDs are applied as part of the upgrade). + - Default RabbitMQ version managed by the operator changes (3.13.2 in v2.9.0; + 3.13.7 in v2.10.0), which can cause cluster rolling restarts if you rely on + defaults. + - "New optional annotation `rabbitmq.com/disable-default-topology-spread-constraints`\ + \ allows disabling the operator\u2019s default topology spread constraints\ + \ behavior." + features: + - Adds support for disabling the default topology spread constraints via a new + `rabbitmq.com/disable-default-topology-spread-constraints` annotation. + - Increases the maximum allowed length of `additionalConfig`, enabling larger + custom RabbitMQ configuration snippets. + - Changes default managed RabbitMQ version to 3.13.7 (from 3.13.2 in 2.9.0), + bringing RabbitMQ patch-level updates by default. + breaking_changes: + - ANONYMOUS login is now disabled by default, which can break clients or tooling + relying on unauthenticated access; verify configured users/permissions and + update integrations accordingly. + - '`vm_memory_high_watermark_paging_ratio` is removed; if you set it anywhere + (additionalConfig, ConfigMap, definitions), remove it to avoid invalid configuration + warnings/errors on newer RabbitMQ versions.' chart_version: 4.3.24 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.10.0-debian-12-r2', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r6'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.10.0-debian-12-r2 + - docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r6 - version: 2.9.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator CRDs updated in v2.9.0 (plan to re-apply/upgrade CRDs - as part of the Helm upgrade and validate any CRD diff impacts).] - features: [RabbitMQ default/managed version moves forward (v2.8.0 defaulted - to 3.13; v2.9.0 bumps to RabbitMQ 3.13.2)., 'Improved scale-out behavior: - the operator avoids restarting the cluster after a scale-out.', 'Graceful - shutdown behavior was fixed, improving termination/drain reliability during - pod restarts/rollouts.'] - breaking_changes: ['Upgrading the cluster-operator to v2.9.0 will trigger rolling - updates of managed RabbitMQ clusters (StatefulSets). To control timing, - pause reconciliation before upgrading and resume when safe.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator CRDs updated in v2.9.0 (plan to re-apply/upgrade CRDs as part of + the Helm upgrade and validate any CRD diff impacts). + features: + - RabbitMQ default/managed version moves forward (v2.8.0 defaulted to 3.13; + v2.9.0 bumps to RabbitMQ 3.13.2). + - 'Improved scale-out behavior: the operator avoids restarting the cluster after + a scale-out.' + - Graceful shutdown behavior was fixed, improving termination/drain reliability + during pod restarts/rollouts. + breaking_changes: + - Upgrading the cluster-operator to v2.9.0 will trigger rolling updates of managed + RabbitMQ clusters (StatefulSets). To control timing, pause reconciliation + before upgrading and resume when safe. chart_version: 4.3.20 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.9.0-debian-12-r8', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r5'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.9.0-debian-12-r8 + - docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r5 - version: 2.8.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: [RabbitMQ 3.13 is now the default deployed RabbitMQ version when using - the operator defaults., 'The operator now filters which Kubernetes objects - it caches from the API, reducing memory/CPU usage and improving performance - at scale.', 'Certificate annotations for certificates generated via Vault - intermediate CA were corrected, improving compatibility with Vault-based - PKI workflows.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: + - RabbitMQ 3.13 is now the default deployed RabbitMQ version when using the + operator defaults. + - The operator now filters which Kubernetes objects it caches from the API, + reducing memory/CPU usage and improving performance at scale. + - Certificate annotations for certificates generated via Vault intermediate + CA were corrected, improving compatibility with Vault-based PKI workflows. breaking_changes: [] chart_version: 4.2.7 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.8.0-debian-12-r4', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.0-debian-12-r0'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.8.0-debian-12-r4 + - docker.io/bitnami/rmq-messaging-topology-operator:1.14.0-debian-12-r0 - version: 2.7.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Dependency bumps: apimachinery to 0.29 (Kubernetes 1.29 aligned) - and related dependency updates.', 'Maintenance cleanup: removal of deprecated - modules/function calls.', 'CI/build change: reverted docker/build-push-action - version bump due to a known issue.'] - features: [No user-facing features called out; this release is primarily maintenance - and dependency updates.] - breaking_changes: [Potential Kubernetes client/SDK compatibility change due - to apimachinery bump to 0.29; ensure your cluster/operator Kubernetes version - and any custom integrations are compatible.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Dependency bumps: apimachinery to 0.29 (Kubernetes 1.29 aligned) and related + dependency updates.' + - 'Maintenance cleanup: removal of deprecated modules/function calls.' + - 'CI/build change: reverted docker/build-push-action version bump due to a + known issue.' + features: + - No user-facing features called out; this release is primarily maintenance + and dependency updates. + breaking_changes: + - Potential Kubernetes client/SDK compatibility change due to apimachinery bump + to 0.29; ensure your cluster/operator Kubernetes version and any custom integrations + are compatible. chart_version: 4.2.0 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.7.0-debian-12-r8', 'docker.io/bitnami/rmq-messaging-topology-operator:1.13.0-debian-12-r7'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.7.0-debian-12-r8 + - docker.io/bitnami/rmq-messaging-topology-operator:1.13.0-debian-12-r7 - version: 2.6.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Dependencies bumped (client-go, kustomize) and overall dependency - update to Kubernetes 1.28 compatibility.', Operator adds support for Erlang - INET configuration., Documentation/network policy guidance updated to include - stream ports for inter-node traffic., CI/maintenance tweaks (exclude Google - Auth in PRs)., 'Behavioral/values-type change: `imagePullSecrets` is now - treated as an array.'] - features: [Support for Erlang INET configuration (lets you tune Erlang networking - via operator-managed config)., Docs update to include RabbitMQ stream ports - in the recommended inter-node traffic NetworkPolicy.] - breaking_changes: ['`imagePullSecrets` changed to be an array; if you previously - supplied a single object/string, update your manifests/values to list form - to avoid rendering or reconciliation issues.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Dependencies bumped (client-go, kustomize) and overall dependency update to + Kubernetes 1.28 compatibility. + - Operator adds support for Erlang INET configuration. + - Documentation/network policy guidance updated to include stream ports for + inter-node traffic. + - CI/maintenance tweaks (exclude Google Auth in PRs). + - 'Behavioral/values-type change: `imagePullSecrets` is now treated as an array.' + features: + - Support for Erlang INET configuration (lets you tune Erlang networking via + operator-managed config). + - Docs update to include RabbitMQ stream ports in the recommended inter-node + traffic NetworkPolicy. + breaking_changes: + - '`imagePullSecrets` changed to be an array; if you previously supplied a single + object/string, update your manifests/values to list form to avoid rendering + or reconciliation issues.' chart_version: 3.14.0 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.6.0-debian-11-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.2-debian-11-r1'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.6.0-debian-11-r3 + - docker.io/bitnami/rmq-messaging-topology-operator:1.12.2-debian-11-r1 - version: 2.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumped Go module major version to v2 (internal/module path change; - mainly affects developers building the operator)., 'CI/build updates to - produce images for additional architectures: ppc64le and s390x.', 'Kustomize-related - rename: `patches` -> `patchesStrategicMerge` (affects overlays/manifests - if you vendor kustomize configs from the repo).', Refactored Makefile (developer/build - change)., README corrected default RabbitMQ version documentation.] - features: ['Multi-architecture image build support was expanded to include ppc64le - and s390x, improving deployability on those platforms.'] - breaking_changes: ['If you use Kustomize manifests/overlays derived from this - repo, you may need to update `patches` to `patchesStrategicMerge` to match - newer kustomize syntax; otherwise kustomize builds can fail.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumped Go module major version to v2 (internal/module path change; mainly + affects developers building the operator). + - 'CI/build updates to produce images for additional architectures: ppc64le + and s390x.' + - 'Kustomize-related rename: `patches` -> `patchesStrategicMerge` (affects overlays/manifests + if you vendor kustomize configs from the repo).' + - Refactored Makefile (developer/build change). + - README corrected default RabbitMQ version documentation. + features: + - Multi-architecture image build support was expanded to include ppc64le and + s390x, improving deployability on those platforms. + breaking_changes: + - If you use Kustomize manifests/overlays derived from this repo, you may need + to update `patches` to `patchesStrategicMerge` to match newer kustomize syntax; + otherwise kustomize builds can fail. chart_version: 3.10.5 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.5.0-debian-11-r39', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.1-debian-11-r2'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.5.0-debian-11-r39 + - docker.io/bitnami/rmq-messaging-topology-operator:1.12.1-debian-11-r2 - version: 2.4.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Default RabbitMQ image version used by the operator changed - from 3.11.18 (in v2.3.0) to 3.12.2 (in v2.4.0).] - features: [Operator now uses RabbitMQ 3.12.2 by default.] - breaking_changes: [RabbitMQ default bumps to 3.12.x; upgrades from older RabbitMQ - require you to already be on 3.11.18+ and to have all feature flags enabled - before moving to 3.12.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Default RabbitMQ image version used by the operator changed from 3.11.18 (in + v2.3.0) to 3.12.2 (in v2.4.0). + features: + - Operator now uses RabbitMQ 3.12.2 by default. + breaking_changes: + - RabbitMQ default bumps to 3.12.x; upgrades from older RabbitMQ require you + to already be on 3.11.18+ and to have all feature flags enabled before moving + to 3.12. chart_version: 3.7.1 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.4.0-debian-11-r15', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-debian-11-r14'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.4.0-debian-11-r15 + - docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-debian-11-r14 - version: 2.3.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Update bundled Grafana dashboards (queue dashboard improvements: - fixed datasource usage, added meaningful legends, refresh set to 10s).', - 'Alerting tweak: fixed LowDiskWatermarkPredicted alert behavior.', Operator - now supports multi-namespace cache scoping., 'Build/release pipeline changes: - publish separate -amd64 and -arm64 release images; bump CI Kubernetes version; - move to Go 1.20; bump controller-runtime and Kubernetes API libraries to - 1.27; remove deprecated methods.', Fix plugin-related paths and environment - variable name used by examples/manifests., 'Examples: simplified import-definitions - example.', Default RabbitMQ image updated to 3.11.18 (from earlier 3.11.x).] - features: ['Multi-namespace cache scoping, enabling the operator to watch/cache - resources across multiple namespaces with more control.', 'Improved Grafana - dashboards (better legends, corrected datasource usage, and faster default - refresh).', Multi-arch release artifacts (-amd64 and -arm64) produced on - new releases.] - breaking_changes: ['Controller-runtime and Kubernetes API dependencies bumped - to 1.27 and deprecated methods removed; if you build/customize the operator - or rely on internal APIs, update your code and ensure cluster version compatibility.', - Default RabbitMQ image version changed to 3.11.18; existing clusters may roll - to the new patch version depending on your image/version pinning strategy.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Update bundled Grafana dashboards (queue dashboard improvements: fixed datasource + usage, added meaningful legends, refresh set to 10s).' + - 'Alerting tweak: fixed LowDiskWatermarkPredicted alert behavior.' + - Operator now supports multi-namespace cache scoping. + - 'Build/release pipeline changes: publish separate -amd64 and -arm64 release + images; bump CI Kubernetes version; move to Go 1.20; bump controller-runtime + and Kubernetes API libraries to 1.27; remove deprecated methods.' + - Fix plugin-related paths and environment variable name used by examples/manifests. + - 'Examples: simplified import-definitions example.' + - Default RabbitMQ image updated to 3.11.18 (from earlier 3.11.x). + features: + - Multi-namespace cache scoping, enabling the operator to watch/cache resources + across multiple namespaces with more control. + - Improved Grafana dashboards (better legends, corrected datasource usage, and + faster default refresh). + - Multi-arch release artifacts (-amd64 and -arm64) produced on new releases. + breaking_changes: + - Controller-runtime and Kubernetes API dependencies bumped to 1.27 and deprecated + methods removed; if you build/customize the operator or rely on internal APIs, + update your code and ensure cluster version compatibility. + - Default RabbitMQ image version changed to 3.11.18; existing clusters may roll + to the new patch version depending on your image/version pinning strategy. chart_version: 3.6.2 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.3.0-scratch-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-scratch-r2'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.3.0-scratch-r3 + - docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-scratch-r2 - version: 2.2.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator now allows the RabbitMQ operator to control images - (image selection/control improvements)., Adds support to override `StatefulSet.spec.persistentVolumeClaimRetentionPolicy` - in generated StatefulSets., 'Logging verbosity adjusted: some verbose log - lines moved to debug level.', 'Networking behavior update: opens the stream - port when the stream management plugin is enabled.', 'Release pipeline/build - changes: multi-arch image work continued (including generating arm64 and - single-arch artifacts, sha-based tags for amd64), plus CI/CD pipeline fixes.'] - features: ['Ability for the operator to control RabbitMQ images, giving more - flexibility over what images are deployed.', Support for overriding `persistentVolumeClaimRetentionPolicy` - on StatefulSets managed by the operator., Automatic opening of the RabbitMQ - stream port when the stream management plugin is enabled.] - breaking_changes: ['Default RabbitMQ version was bumped (ultimately to `3.11.10-management`), - which may trigger rolling updates or behavior changes unless you pin/override - the RabbitMQ image/version in your RabbitmqCluster spec.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator now allows the RabbitMQ operator to control images (image selection/control + improvements). + - Adds support to override `StatefulSet.spec.persistentVolumeClaimRetentionPolicy` + in generated StatefulSets. + - 'Logging verbosity adjusted: some verbose log lines moved to debug level.' + - 'Networking behavior update: opens the stream port when the stream management + plugin is enabled.' + - 'Release pipeline/build changes: multi-arch image work continued (including + generating arm64 and single-arch artifacts, sha-based tags for amd64), plus + CI/CD pipeline fixes.' + features: + - Ability for the operator to control RabbitMQ images, giving more flexibility + over what images are deployed. + - Support for overriding `persistentVolumeClaimRetentionPolicy` on StatefulSets + managed by the operator. + - Automatic opening of the RabbitMQ stream port when the stream management plugin + is enabled. + breaking_changes: + - Default RabbitMQ version was bumped (ultimately to `3.11.10-management`), + which may trigger rolling updates or behavior changes unless you pin/override + the RabbitMQ image/version in your RabbitmqCluster spec. chart_version: 3.4.1 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.2.0-scratch-r7', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.3-scratch-r1'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.2.0-scratch-r7 + - docker.io/bitnami/rmq-messaging-topology-operator:1.10.3-scratch-r1 - version: 2.1.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator image is now multi-architecture (amd64+arm64) and published - as a multi-arch OCI manifest; runtimes will pull the correct arch automatically., - Operator introduces a 30s delayed start behavior (likely to give the API server/CRDs - time to settle) which can affect perceived startup/rollout timing., StatefulSet - management now supports `minReadySeconds` in the generated/managed StatefulSetSpec., - PodDisruptionBudget manifest updated (behavior may change depending on your - prior expectations/overrides)., Service binding RBAC added via an aggregating - ClusterRole (new ClusterRole resources/permissions will appear)., External - Secret integration updated to allow skipping creation of the default user - and provides new examples (may change behavior if you rely on default user - provisioning)., Adds a label to improve service discoverability (affects - labels/selectors/monitoring discovery if you key off labels).] - features: [Multi-arch (AMD64 and ARM64) operator image support out of the box., - Support for `minReadySeconds` in RabbitMQ cluster StatefulSets managed by - the operator., 'Option in External Secret integration to skip creating the - default user, plus an admin external secret example.', New aggregating ClusterRole - to support Service Bindings and improved service discoverability labeling.] - breaking_changes: ['Upgrading the operator to v2.1.0 will trigger reconciliation - changes that roll RabbitMQ clusters (rolling update of StatefulSets). Pause - reconciliation before upgrading if you need to control when clusters roll, - then resume when safe.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator image is now multi-architecture (amd64+arm64) and published as a + multi-arch OCI manifest; runtimes will pull the correct arch automatically. + - Operator introduces a 30s delayed start behavior (likely to give the API server/CRDs + time to settle) which can affect perceived startup/rollout timing. + - StatefulSet management now supports `minReadySeconds` in the generated/managed + StatefulSetSpec. + - PodDisruptionBudget manifest updated (behavior may change depending on your + prior expectations/overrides). + - Service binding RBAC added via an aggregating ClusterRole (new ClusterRole + resources/permissions will appear). + - External Secret integration updated to allow skipping creation of the default + user and provides new examples (may change behavior if you rely on default + user provisioning). + - Adds a label to improve service discoverability (affects labels/selectors/monitoring + discovery if you key off labels). + features: + - Multi-arch (AMD64 and ARM64) operator image support out of the box. + - Support for `minReadySeconds` in RabbitMQ cluster StatefulSets managed by + the operator. + - Option in External Secret integration to skip creating the default user, plus + an admin external secret example. + - New aggregating ClusterRole to support Service Bindings and improved service + discoverability labeling. + breaking_changes: + - Upgrading the operator to v2.1.0 will trigger reconciliation changes that + roll RabbitMQ clusters (rolling update of StatefulSets). Pause reconciliation + before upgrading if you need to control when clusters roll, then resume when + safe. chart_version: 3.2.5 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.1.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.1-scratch-r2'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.1.0-scratch-r6 + - docker.io/bitnami/rmq-messaging-topology-operator:1.10.1-scratch-r2 - version: 2.0.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Operator now requires RabbitMQ >= 3.9.9 and drops support for - RabbitMQ 3.8., Upgrading the operator will trigger reconciliation that updates - existing RabbitMQ clusters (rolling update of StatefulSets) unless reconciliation - is paused., 'Kubernetes/controller-runtime dependencies were bumped (K8s - API to 1.25, controller-runtime 0.13); CRDs were regenerated accordingly.', - Added a pprof debug endpoint (introduced in 1.14.0)., 'Monitoring/alerting - tweak: fixed FileDescriptorsNearLimit alert rule; earlier 1.14.0 removed - Prometheus scrape annotation.', 'Build/test/tooling updates: Go bumped to - 1.19; system tests made more reliable; added govulncheck; CI/workflow updates - including OperatorHub PR automation and CodeQL updates.'] - features: [pprof debug endpoint for troubleshooting operator performance/issues., - Improved system test reliability and additional security scanning via govulncheck., - OperatorHub-related automation to streamline publishing.] - breaking_changes: [RabbitMQ 3.8 is no longer supported; RabbitMQ clusters must - be >= 3.9.9 before upgrading the operator or clusters may fail to start., - Operator upgrade can force rolling updates of managed RabbitMQ StatefulSets - via reconciliation; pause reconciliation if you need to control timing.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Operator now requires RabbitMQ >= 3.9.9 and drops support for RabbitMQ 3.8. + - Upgrading the operator will trigger reconciliation that updates existing RabbitMQ + clusters (rolling update of StatefulSets) unless reconciliation is paused. + - Kubernetes/controller-runtime dependencies were bumped (K8s API to 1.25, controller-runtime + 0.13); CRDs were regenerated accordingly. + - Added a pprof debug endpoint (introduced in 1.14.0). + - 'Monitoring/alerting tweak: fixed FileDescriptorsNearLimit alert rule; earlier + 1.14.0 removed Prometheus scrape annotation.' + - 'Build/test/tooling updates: Go bumped to 1.19; system tests made more reliable; + added govulncheck; CI/workflow updates including OperatorHub PR automation + and CodeQL updates.' + features: + - pprof debug endpoint for troubleshooting operator performance/issues. + - Improved system test reliability and additional security scanning via govulncheck. + - OperatorHub-related automation to streamline publishing. + breaking_changes: + - RabbitMQ 3.8 is no longer supported; RabbitMQ clusters must be >= 3.9.9 before + upgrading the operator or clusters may fail to start. + - Operator upgrade can force rolling updates of managed RabbitMQ StatefulSets + via reconciliation; pause reconciliation if you need to control timing. chart_version: 3.1.5 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.0.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.0-scratch-r0'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:2.0.0-scratch-r6 + - docker.io/bitnami/rmq-messaging-topology-operator:1.10.0-scratch-r0 - version: 1.14.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Manifests are now generated using Kubernetes 1.24 and controller-gen - 0.9 (affects generated CRDs/RBAC YAML output)., Prometheus scrape annotation - was removed (any metrics scraping should rely on ServiceMonitor/PodMonitor - or explicit configuration)., All errors are now wrapped (may change log - messages and error strings used by tests/alerting)., A pprof debug endpoint - was added (new debug surface; review exposure and network policies)., 'Operator - defaults refactored into a separate function (no functional change expected, - but could subtly affect defaulting behavior).', Controller-runtime bumped - from 0.11.2 to 0.12.1 and controller-tools to 0.9.0 (aligns with newer Kubernetes - APIs; may affect supported k8s versions).] - features: [Added a pprof debug endpoint to help with profiling/troubleshooting - the operator., 'Improved error handling by wrapping errors, making root - causes easier to trace in logs.'] - breaking_changes: [Prometheus scrape annotation removal can break existing Prometheus - setups that depended on annotations for auto-scraping; ensure you have an - alternative scrape configuration in place.] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Manifests are now generated using Kubernetes 1.24 and controller-gen 0.9 (affects + generated CRDs/RBAC YAML output). + - Prometheus scrape annotation was removed (any metrics scraping should rely + on ServiceMonitor/PodMonitor or explicit configuration). + - All errors are now wrapped (may change log messages and error strings used + by tests/alerting). + - A pprof debug endpoint was added (new debug surface; review exposure and network + policies). + - Operator defaults refactored into a separate function (no functional change + expected, but could subtly affect defaulting behavior). + - Controller-runtime bumped from 0.11.2 to 0.12.1 and controller-tools to 0.9.0 + (aligns with newer Kubernetes APIs; may affect supported k8s versions). + features: + - Added a pprof debug endpoint to help with profiling/troubleshooting the operator. + - Improved error handling by wrapping errors, making root causes easier to trace + in logs. + breaking_changes: + - Prometheus scrape annotation removal can break existing Prometheus setups + that depended on annotations for auto-scraping; ensure you have an alternative + scrape configuration in place. chart_version: 2.7.4 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:1.14.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.8.0-scratch-r1'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:1.14.0-scratch-r6 + - docker.io/bitnami/rmq-messaging-topology-operator:1.8.0-scratch-r1 - version: 1.13.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', - '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' + - '1.25' + - '1.24' + - '1.23' + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null chart_version: 2.6.6 - images: ['docker.io/bitnami/rabbitmq-cluster-operator:1.13.1-scratch-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.6.0-scratch-r0'] + images: + - docker.io/bitnami/rabbitmq-cluster-operator:1.13.1-scratch-r3 + - docker.io/bitnami/rmq-messaging-topology-operator:1.6.0-scratch-r0 name: rabbitmq-cluster-operator - icon: https://kserve.github.io/website/img/kserve-logo-small.png git_url: https://github.com/kserve/kserve @@ -29521,46 +40409,63 @@ addons: chart_name: kserve versions: - version: 0.20.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['KServe 0.20.0 includes new/updated CRD and resources Helm chart - artifacts (kserve-crd, kserve-resources, llmisvc-crd/resources, localmodel-crd/resources, - runtime-configs). Expect CRD and controller rollout as part of upgrade.', - Gateway API dependency bumped to v1.5.1; Envoy AI Gateway bumped to v1.0.0 - and Envoy Gateway to v1.8.1 (ensure cluster dependencies match)., 'LLMInferenceService - routing resources migrated to llm-d.ai CRDs; e2e updates indicate API group - changes for related CRDs (e.g., InferenceObjective).', Modelcache RBAC updated - (adds delete verb for localmodel PV/PVC)., LocalModel controller and related - resources include race-condition fixes; storage/OCI mounting support expanded., - 'LLMInferenceService webhook install/rollout ordering tightened in CI, implying - upgrade sequencing/rollout readiness is important. Look for webhook cert - readiness before proceeding.'] - features: [Forward Authorization header from transformer to predictor (helps - auth propagation through inference pipeline)., 'Support multiple OCI sources - in storageUris and add oci+native:// ImageVolume mounting for OCI artifacts.', - Add vLLM as a supported runtime; plus new AutoGluon server runtime option., - 'LLMInferenceService: model-based routing gates with models surfaced in status; - stable/version-independent URLs discovery; traffic splitting APIs including - group routing machinery and readiness gating.', 'LLMInferenceService: KV - cache offloading spec (CPU tiering + secondary filesystem tiers) and additional - llm-d baseline default alignments.', Add Managed DRA support for LLMInferenceService - (resource allocation integrations)., Add platform hooks for InferenceService - service customization; canary rollout support for RawDeployment mode., Add - support for confidential model serving.] - breaking_changes: [LLMInferenceService routing resources migrated to llm-d.ai - CRDs; existing clusters may need CRD updates and any manifests/controllers - referencing old API groups must be updated accordingly., 'Dependency bumps - (Gateway API v1.5.1, Envoy AI Gateway v1.0.0, Envoy Gateway v1.8.1) can - require compatible versions installed in-cluster; mismatches may break HTTPRoute/Gateway - behavior.', 'Security/dependency update: Starlette bumped to >=1.0.1 (CVE - fix). If you pin images or python deps in custom runtimes, ensure compatibility.'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - KServe 0.20.0 includes new/updated CRD and resources Helm chart artifacts + (kserve-crd, kserve-resources, llmisvc-crd/resources, localmodel-crd/resources, + runtime-configs). Expect CRD and controller rollout as part of upgrade. + - Gateway API dependency bumped to v1.5.1; Envoy AI Gateway bumped to v1.0.0 + and Envoy Gateway to v1.8.1 (ensure cluster dependencies match). + - LLMInferenceService routing resources migrated to llm-d.ai CRDs; e2e updates + indicate API group changes for related CRDs (e.g., InferenceObjective). + - Modelcache RBAC updated (adds delete verb for localmodel PV/PVC). + - LocalModel controller and related resources include race-condition fixes; + storage/OCI mounting support expanded. + - LLMInferenceService webhook install/rollout ordering tightened in CI, implying + upgrade sequencing/rollout readiness is important. Look for webhook cert readiness + before proceeding. + features: + - Forward Authorization header from transformer to predictor (helps auth propagation + through inference pipeline). + - Support multiple OCI sources in storageUris and add oci+native:// ImageVolume + mounting for OCI artifacts. + - Add vLLM as a supported runtime; plus new AutoGluon server runtime option. + - 'LLMInferenceService: model-based routing gates with models surfaced in status; + stable/version-independent URLs discovery; traffic splitting APIs including + group routing machinery and readiness gating.' + - 'LLMInferenceService: KV cache offloading spec (CPU tiering + secondary filesystem + tiers) and additional llm-d baseline default alignments.' + - Add Managed DRA support for LLMInferenceService (resource allocation integrations). + - Add platform hooks for InferenceService service customization; canary rollout + support for RawDeployment mode. + - Add support for confidential model serving. + breaking_changes: + - LLMInferenceService routing resources migrated to llm-d.ai CRDs; existing + clusters may need CRD updates and any manifests/controllers referencing old + API groups must be updated accordingly. + - Dependency bumps (Gateway API v1.5.1, Envoy AI Gateway v1.0.0, Envoy Gateway + v1.8.1) can require compatible versions installed in-cluster; mismatches may + break HTTPRoute/Gateway behavior. + - 'Security/dependency update: Starlette bumped to >=1.0.1 (CVE fix). If you + pin images or python deps in custom runtimes, ensure compatibility.' chart_version: v0.20.0 images: [] - version: 0.19.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -29578,42 +40483,57 @@ addons: \ CRD packaging fix**: v0.19.0 removes **incorrect CRDs included in `llmisvc-crd`**\ \ (PR #5428). Review your CRD installation path to avoid drift between previously-installed\ \ CRDs and the corrected set.\n" - chart_updates: [LLMISvc CRD chart content corrected (removed incorrect CRDs)., - Helm upgrade guard added to avoid deleting ClusterStorageContainer CRD., Defaults - updated to match kustomize for imagePullPolicy., Minimal (CRD-minimal) installs - now enable conversion webhooks., LLMISvc chart gains option to skip creating - GIE CRDs.] - features: [Standard mode InferenceService can now support dual-protocol routing - (REST and gRPC) for the same service., LocalModelCache support was added - for LLMInferenceService to improve reuse/efficiency of locally cached models., - LLMISvc now propagates spec labels/annotations to the Service and can emit - Kubernetes Events for readiness transitions., 'LLMISvc routing/status observability - improved (model-name based routing, topology/workload refs reporting, applied-configs - visibility).', 'Autoscaling support and testing for LLMISvc improved, including - better surfacing of HPA/KEDA scaling status in conditions.'] - breaking_changes: ['Minimal installs now enable conversion webhooks, which can - change requirements/behavior in clusters that previously ran minimal CRDs - without webhooks.', 'LLMISvc CRD packaging was corrected; if you previously - depended on the erroneous CRDs bundled in `llmisvc-crd`, your upgrade may - remove/stop managing them and you must install any needed CRDs explicitly.'] + chart_updates: + - LLMISvc CRD chart content corrected (removed incorrect CRDs). + - Helm upgrade guard added to avoid deleting ClusterStorageContainer CRD. + - Defaults updated to match kustomize for imagePullPolicy. + - Minimal (CRD-minimal) installs now enable conversion webhooks. + - LLMISvc chart gains option to skip creating GIE CRDs. + features: + - Standard mode InferenceService can now support dual-protocol routing (REST + and gRPC) for the same service. + - LocalModelCache support was added for LLMInferenceService to improve reuse/efficiency + of locally cached models. + - LLMISvc now propagates spec labels/annotations to the Service and can emit + Kubernetes Events for readiness transitions. + - LLMISvc routing/status observability improved (model-name based routing, topology/workload + refs reporting, applied-configs visibility). + - Autoscaling support and testing for LLMISvc improved, including better surfacing + of HPA/KEDA scaling status in conditions. + breaking_changes: + - Minimal installs now enable conversion webhooks, which can change requirements/behavior + in clusters that previously ran minimal CRDs without webhooks. + - LLMISvc CRD packaging was corrected; if you previously depended on the erroneous + CRDs bundled in `llmisvc-crd`, your upgrade may remove/stop managing them + and you must install any needed CRDs explicitly. chart_version: v0.19.0 images: [] - version: 0.18.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [v0.18.1 is a patch release containing a cherry-picked Helm chart - fix; no functional application feature changes are called out in the release - notes., No chart/values details are provided in the supplied notes; expect - minor packaging/templating corrections only.] + chart_updates: + - v0.18.1 is a patch release containing a cherry-picked Helm chart fix; no functional + application feature changes are called out in the release notes. + - No chart/values details are provided in the supplied notes; expect minor packaging/templating + corrections only. features: [] breaking_changes: [] chart_version: v0.18.1 images: [] - version: 0.18.0 - kube: ['1.35', '1.34', '1.33', '1.32'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -29630,29 +40550,35 @@ addons: - **Runtime-configs chart metadata:** `kserve-runtime-configs` now includes\ \ the **helm chart version** in its output/packaging, which may affect your\ \ internal artifact tracking.\n" - chart_updates: ['Main chart renamed to `kserve-resources` (PR #5190).', 'Packaging - fix: skip `_folder` when packaging charts (PR #5186).', 'Charts support - dependency version overrides (PR #5268).', '`kserve-runtime-configs` includes - helm chart version metadata (PR #5209).', 'KServe bundle includes GIE CRDs - (PR #5214).'] - features: [Adds CSV and Parquet marshallers for inference logging/marshalling - use cases., Inference logger now records occurrence/time in CloudEvents - for better traceability., ModelCache gains a namespace-scoped mode; download - jobs can run in a dedicated job namespace for tighter multi-tenancy controls., - 'LLMInferenceService (llmisvc) improvements: autoscaling integration (KEDA/HPA - and WVA), TLS/config updates, better URL discovery, and more robust validation.', - 'Gateway/GKE Gateway support improvements, including an option to disable - HTTPRoute timeouts and new `/v1/responses` route for OpenAI Responses API - support.'] - breaking_changes: ['Helm chart reference change: the primary KServe chart is - now `kserve-resources`; upgrade tooling/pipelines that still reference `kserve` - will fail until updated.', 'Potential installation/ownership conflicts if - you previously managed GIE CRDs separately, since they are now bundled with - KServe in v0.18.0.'] + chart_updates: + - 'Main chart renamed to `kserve-resources` (PR #5190).' + - 'Packaging fix: skip `_folder` when packaging charts (PR #5186).' + - 'Charts support dependency version overrides (PR #5268).' + - '`kserve-runtime-configs` includes helm chart version metadata (PR #5209).' + - 'KServe bundle includes GIE CRDs (PR #5214).' + features: + - Adds CSV and Parquet marshallers for inference logging/marshalling use cases. + - Inference logger now records occurrence/time in CloudEvents for better traceability. + - ModelCache gains a namespace-scoped mode; download jobs can run in a dedicated + job namespace for tighter multi-tenancy controls. + - 'LLMInferenceService (llmisvc) improvements: autoscaling integration (KEDA/HPA + and WVA), TLS/config updates, better URL discovery, and more robust validation.' + - Gateway/GKE Gateway support improvements, including an option to disable HTTPRoute + timeouts and new `/v1/responses` route for OpenAI Responses API support. + breaking_changes: + - 'Helm chart reference change: the primary KServe chart is now `kserve-resources`; + upgrade tooling/pipelines that still reference `kserve` will fail until updated.' + - Potential installation/ownership conflicts if you previously managed GIE CRDs + separately, since they are now bundled with KServe in v0.18.0. chart_version: v0.18.0 images: [] - version: 0.17.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -29666,17 +40592,23 @@ addons: chart packaging fixes. ' - chart_updates: [Includes the missing v0.17.0 installation scripts in the v0.17.1 - release artifacts (fix/cherry-pick)., Applies a Helm chart fix via cherry-pick - (release primarily addresses chart/release packaging)., 'Version bump to - v0.17.1; new Helm chart tarballs published for all subcharts (kserve-crd, - kserve-resources, runtime-configs, llmisvc-*, localmodel-*).'] + chart_updates: + - Includes the missing v0.17.0 installation scripts in the v0.17.1 release artifacts + (fix/cherry-pick). + - Applies a Helm chart fix via cherry-pick (release primarily addresses chart/release + packaging). + - Version bump to v0.17.1; new Helm chart tarballs published for all subcharts + (kserve-crd, kserve-resources, runtime-configs, llmisvc-*, localmodel-*). features: [] breaking_changes: [] chart_version: v0.17.1 images: [] - version: 0.17.0 - kube: ['1.35', '1.34', '1.33', '1.32'] + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -29708,46 +40640,57 @@ addons: \ `kserve` was a single chart.\n\n*(Release notes do not include a full values.yaml\ \ diff; you should run `helm show values` for v0.16.0 vs v0.17.0 charts and\ \ reconcile.)*" - chart_updates: ['Helm packaging now publishes multiple artifacts instead of - a single kserve chart; v0.17.0 release assets include CRD-only and resources-only - charts for KServe, LLMISVC, and LocalModel, plus a new runtime-configs chart.', - Manifests are restructured to a component-based layout (will change rendered - resource names/paths used by scripts/patching)., LLMISVC CRD installation - paths fixed; LLMISVC RBAC naming updated with `kserve` prefixes and bindings - adjusted accordingly., Quick install / dependency install scripts were centralized/refactored; - installation scripts updated to include required files and to fix several - bugs., 'Controller/webhook architecture change: LocalModelCache webhook - separated from KServe controller; LLMInferenceService webhook added with - E2E tests (may add/modify webhook deployments/services).', 'Security and - dependency refreshes across images and python deps (e.g., starlette pin, - cryptography CVE fixes), plus path traversal hardening in HTTP/tar extraction.'] - features: ['Storage initializer performance improvements: parallel S3/Azure - blob downloads and faster parallel S3 file downloads; plus new git download - support and ability to download only selected files.', New routing capability - for InferenceServices via `pathTemplate` configuration for inference service - routing., 'Additional runtimes added, including an OpenVINO model server - runtime and a new predictive inference server runtime (with build/publish - and E2E coverage).', 'LLMISVC enhancements: ability to stop LLMInferenceService, - optional storageInitializer, scheduler HA/scaling support, improved CA bundle/cert - management, improved Gateway API URL discovery, autoscaling API support, - and annotation/label propagation.', 'Gateway/API updates: upgrade to Gateway - API v1.4.0 and bump Gateway API Inference Extension (GIE) to v1.2.0.', 'Operational - knobs: new env var `INFERENCE_SERVICE_NAME`, new `schedulerName` field for - ServingRuntimePodSpec, configurable Uvicorn event loop, and configurable - agent container resources.'] - breaking_changes: ['Major Helm chart restructuring in v0.17.0: the old single - `kserve` chart is replaced/renamed and split into multiple charts (notably - `kserve-resources`, plus separate CRD/resources charts for KServe/LLMISVC/LocalModel). - Existing Helm release names, chart references, and patching automation will - need changes.', 'vLLM/runtime ecosystem changes: KServe bumps vLLM versions - and removes Python 3.9 support for the vLLM runtime line; if you build custom - runtime images or depend on Python 3.9, you must update accordingly.', RBAC/name - changes for LLMISVC components (prefixed roles/renamed resources) can break - custom RoleBinding/ClusterRoleBinding overrides if they referenced old names.] + chart_updates: + - Helm packaging now publishes multiple artifacts instead of a single kserve + chart; v0.17.0 release assets include CRD-only and resources-only charts for + KServe, LLMISVC, and LocalModel, plus a new runtime-configs chart. + - Manifests are restructured to a component-based layout (will change rendered + resource names/paths used by scripts/patching). + - LLMISVC CRD installation paths fixed; LLMISVC RBAC naming updated with `kserve` + prefixes and bindings adjusted accordingly. + - Quick install / dependency install scripts were centralized/refactored; installation + scripts updated to include required files and to fix several bugs. + - 'Controller/webhook architecture change: LocalModelCache webhook separated + from KServe controller; LLMInferenceService webhook added with E2E tests (may + add/modify webhook deployments/services).' + - Security and dependency refreshes across images and python deps (e.g., starlette + pin, cryptography CVE fixes), plus path traversal hardening in HTTP/tar extraction. + features: + - 'Storage initializer performance improvements: parallel S3/Azure blob downloads + and faster parallel S3 file downloads; plus new git download support and ability + to download only selected files.' + - New routing capability for InferenceServices via `pathTemplate` configuration + for inference service routing. + - Additional runtimes added, including an OpenVINO model server runtime and + a new predictive inference server runtime (with build/publish and E2E coverage). + - 'LLMISVC enhancements: ability to stop LLMInferenceService, optional storageInitializer, + scheduler HA/scaling support, improved CA bundle/cert management, improved + Gateway API URL discovery, autoscaling API support, and annotation/label propagation.' + - 'Gateway/API updates: upgrade to Gateway API v1.4.0 and bump Gateway API Inference + Extension (GIE) to v1.2.0.' + - 'Operational knobs: new env var `INFERENCE_SERVICE_NAME`, new `schedulerName` + field for ServingRuntimePodSpec, configurable Uvicorn event loop, and configurable + agent container resources.' + breaking_changes: + - 'Major Helm chart restructuring in v0.17.0: the old single `kserve` chart + is replaced/renamed and split into multiple charts (notably `kserve-resources`, + plus separate CRD/resources charts for KServe/LLMISVC/LocalModel). Existing + Helm release names, chart references, and patching automation will need changes.' + - 'vLLM/runtime ecosystem changes: KServe bumps vLLM versions and removes Python + 3.9 support for the vLLM runtime line; if you build custom runtime images + or depend on Python 3.9, you must update accordingly.' + - RBAC/name changes for LLMISVC components (prefixed roles/renamed resources) + can break custom RoleBinding/ClusterRoleBinding overrides if they referenced + old names. chart_version: v0.17.0 images: [] - version: 0.16.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: @@ -29764,180 +40707,276 @@ addons: \ to run LLMISVC, ensure it\u2019s disabled/not installed.\n- **CRD manifest\ \ naming:** CRD file was renamed to reflect all KServe CRDs; if you manage\ \ CRDs separately (GitOps), ensure your CRD sync picks up the renamed file." - chart_updates: ['Added/updated Helm templates and install logic for the new - LLMInferenceService (llmisvc) controller and webhooks, plus RBAC/templating - fixes and a quick-install script.', Chart now surfaces additional configuration - for OpenTelemetry collector and autoscaler components., 'Bugfixes to chart - packaging (e.g., llmisvc-crd-minimal chart) and a fix to the controller - image URL reference.', '`kserve-resources` chart behavior changed to not - enable desired ServingRuntimes by default (confirm ServingRuntime availability - post-upgrade).'] - features: ['Introduces new **LLMInferenceService** and **LLMInferenceServiceConfig** - CRDs/controllers (llmisvc) aimed at LLM workloads, with validating webhooks - and base configurations.', "Adds **stop/resume** capabilities across components\ - \ (InferenceService, Transformer, Explainer, InferenceGraph), including\ - \ support in \u201Craw/standard\u201D deployments.", 'Adds **inference logging - to blob storage**, expanding support to **GCS and Azure** in addition to - prior backends, with metadata/header handling improvements.', 'Adds support - for **multiple storage URIs** on InferenceServices and secure/extended storage - configuration options (e.g., S3 via secret data, CA bundle injection).', - 'Improves autoscaling/observability integrations: more flexible OpenTelemetry - metrics support for autoscaling and options for securing Prometheus access - in KEDA.', 'Runtime and dependency bumps/updates, including **vLLM 0.9.x** - updates and **Torch 2.6/2.7** upgrades in related images/components.'] - breaking_changes: ["Compatibility change: **removed \u201Cdefault\u201D suffix\ - \ compatibility** (if you relied on legacy resource naming/selection that\ - \ used a `-default` suffix, you may need to update manifests or references).", - 'Python SDK/deps: **dropped Pydantic v1 support** (SDK consumers using Pydantic - v1 must upgrade to v2 or pin/adjust integrations).', 'Removed deprecated - flag: **`EnableDirectPvcVolumeMount`** was removed (clusters/config relying - on this feature flag must migrate to the supported PVC/modelcar/storage - patterns).', 'API validation tightening: **disallow `name` field in standard - predictor** (manifests that set this field will fail validation/admission).', - "Terminology/refactor: \u201CRawDeployment\u201D renamed to **\u201CStandard\u201D\ - ** and \u201CServerless\u201D to **\u201CKNative\u201D** in code/docs; expect\ - \ configuration/docs/fields to reflect the new naming (verify any automation\ - \ that keys off old terms)."] + chart_updates: + - Added/updated Helm templates and install logic for the new LLMInferenceService + (llmisvc) controller and webhooks, plus RBAC/templating fixes and a quick-install + script. + - Chart now surfaces additional configuration for OpenTelemetry collector and + autoscaler components. + - Bugfixes to chart packaging (e.g., llmisvc-crd-minimal chart) and a fix to + the controller image URL reference. + - '`kserve-resources` chart behavior changed to not enable desired ServingRuntimes + by default (confirm ServingRuntime availability post-upgrade).' + features: + - Introduces new **LLMInferenceService** and **LLMInferenceServiceConfig** CRDs/controllers + (llmisvc) aimed at LLM workloads, with validating webhooks and base configurations. + - "Adds **stop/resume** capabilities across components (InferenceService, Transformer,\ + \ Explainer, InferenceGraph), including support in \u201Craw/standard\u201D\ + \ deployments." + - Adds **inference logging to blob storage**, expanding support to **GCS and + Azure** in addition to prior backends, with metadata/header handling improvements. + - Adds support for **multiple storage URIs** on InferenceServices and secure/extended + storage configuration options (e.g., S3 via secret data, CA bundle injection). + - 'Improves autoscaling/observability integrations: more flexible OpenTelemetry + metrics support for autoscaling and options for securing Prometheus access + in KEDA.' + - Runtime and dependency bumps/updates, including **vLLM 0.9.x** updates and + **Torch 2.6/2.7** upgrades in related images/components. + breaking_changes: + - "Compatibility change: **removed \u201Cdefault\u201D suffix compatibility**\ + \ (if you relied on legacy resource naming/selection that used a `-default`\ + \ suffix, you may need to update manifests or references)." + - 'Python SDK/deps: **dropped Pydantic v1 support** (SDK consumers using Pydantic + v1 must upgrade to v2 or pin/adjust integrations).' + - 'Removed deprecated flag: **`EnableDirectPvcVolumeMount`** was removed (clusters/config + relying on this feature flag must migrate to the supported PVC/modelcar/storage + patterns).' + - 'API validation tightening: **disallow `name` field in standard predictor** + (manifests that set this field will fail validation/admission).' + - "Terminology/refactor: \u201CRawDeployment\u201D renamed to **\u201CStandard\u201D\ + ** and \u201CServerless\u201D to **\u201CKNative\u201D** in code/docs; expect\ + \ configuration/docs/fields to reflect the new naming (verify any automation\ + \ that keys off old terms)." chart_version: v0.16.0 - images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.16.0', - 'kserve/huggingfaceserver:v0.16.0-gpu', 'kserve/kserve-controller:v0.16.0', - 'kserve/lgbserver:v0.16.0', 'kserve/paddleserver:v0.16.0', 'kserve/pmmlserver:v0.16.0', - 'kserve/sklearnserver:v0.16.0', 'kserve/storage-initializer:v0.16.0', 'kserve/xgbserver:v0.16.0', - 'nvcr.io/nvidia/tritonserver:23.05-py3', 'pytorch/torchserve-kfs:0.9.0', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', - 'tensorflow/serving:2.6.2'] + images: + - docker.io/seldonio/mlserver:1.5.0 + - kserve/huggingfaceserver:v0.16.0 + - kserve/huggingfaceserver:v0.16.0-gpu + - kserve/kserve-controller:v0.16.0 + - kserve/lgbserver:v0.16.0 + - kserve/paddleserver:v0.16.0 + - kserve/pmmlserver:v0.16.0 + - kserve/sklearnserver:v0.16.0 + - kserve/storage-initializer:v0.16.0 + - kserve/xgbserver:v0.16.0 + - nvcr.io/nvidia/tritonserver:23.05-py3 + - pytorch/torchserve-kfs:0.9.0 + - quay.io/brancz/kube-rbac-proxy:v0.18.0 + - tensorflow/serving:2.6.2 - version: 0.15.2 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: ['Model caching enhancements in 0.14.1: introduced LocalModelNode/LocalModelCache - resources, node agent, multi node-group support, redownload on missing models, - and an annotation to disable model cache.', 'In 0.15.2, ModelCar is enabled - by default and ModelServer init adds predictor_config support.', Autoscaler - reconciliation behavior updated by changing the order the Knative autoscaler - ConfigMap is read.] - breaking_changes: ['Potential behavior change: ModelCar is enabled by default - in 0.15.2, which may affect storage/runtime expectations and should be validated - in your environment.', 'Potential operational change: autoscaler settings - may be applied differently due to the changed ConfigMap read order during - reconciliation.'] + features: + - 'Model caching enhancements in 0.14.1: introduced LocalModelNode/LocalModelCache + resources, node agent, multi node-group support, redownload on missing models, + and an annotation to disable model cache.' + - In 0.15.2, ModelCar is enabled by default and ModelServer init adds predictor_config + support. + - Autoscaler reconciliation behavior updated by changing the order the Knative + autoscaler ConfigMap is read. + breaking_changes: + - 'Potential behavior change: ModelCar is enabled by default in 0.15.2, which + may affect storage/runtime expectations and should be validated in your environment.' + - 'Potential operational change: autoscaler settings may be applied differently + due to the changed ConfigMap read order during reconciliation.' chart_version: v0.15.2 - images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.15.2', - 'kserve/huggingfaceserver:v0.15.2-gpu', 'kserve/kserve-controller:v0.15.2', - 'kserve/lgbserver:v0.15.2', 'kserve/paddleserver:v0.15.2', 'kserve/pmmlserver:v0.15.2', - 'kserve/sklearnserver:v0.15.2', 'kserve/storage-initializer:v0.15.2', 'kserve/xgbserver:v0.15.2', - 'nvcr.io/nvidia/tritonserver:23.05-py3', 'pytorch/torchserve-kfs:0.9.0', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', - 'tensorflow/serving:2.6.2'] + images: + - docker.io/seldonio/mlserver:1.5.0 + - kserve/huggingfaceserver:v0.15.2 + - kserve/huggingfaceserver:v0.15.2-gpu + - kserve/kserve-controller:v0.15.2 + - kserve/lgbserver:v0.15.2 + - kserve/paddleserver:v0.15.2 + - kserve/pmmlserver:v0.15.2 + - kserve/sklearnserver:v0.15.2 + - kserve/storage-initializer:v0.15.2 + - kserve/xgbserver:v0.15.2 + - nvcr.io/nvidia/tritonserver:23.05-py3 + - pytorch/torchserve-kfs:0.9.0 + - quay.io/brancz/kube-rbac-proxy:v0.18.0 + - tensorflow/serving:2.6.2 - version: 0.14.1 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [v0.14.1 introduces a new LocalModelNode CR plus a node agent and - updated model-cache controller to support node-local model caching workflows., - 'Model cache functionality is expanded with multiple node groups, an admission - webhook for LocalModelCache, and an annotation to disable model cache per - resource.', Inference protocol responses now support datetime object serialization - for both v1 and v2 APIs.] - breaking_changes: [The ClusterLocalModel resource was renamed to LocalModelCache; - existing manifests/controllers referencing ClusterLocalModel must be updated - accordingly.] + features: + - v0.14.1 introduces a new LocalModelNode CR plus a node agent and updated model-cache + controller to support node-local model caching workflows. + - Model cache functionality is expanded with multiple node groups, an admission + webhook for LocalModelCache, and an annotation to disable model cache per + resource. + - Inference protocol responses now support datetime object serialization for + both v1 and v2 APIs. + breaking_changes: + - The ClusterLocalModel resource was renamed to LocalModelCache; existing manifests/controllers + referencing ClusterLocalModel must be updated accordingly. chart_version: v0.14.1 - images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.14.1', - 'kserve/kserve-controller:v0.14.1', 'kserve/lgbserver:v0.14.1', 'kserve/modelmesh-controller:v0.12.0', - 'kserve/paddleserver:v0.14.1', 'kserve/pmmlserver:v0.14.1', 'kserve/sklearnserver:v0.14.1', - 'kserve/storage-initializer:v0.14.1', 'kserve/xgbserver:v0.14.1', 'nvcr.io/nvidia/tritonserver:23.04-py3', - 'nvcr.io/nvidia/tritonserver:23.05-py3', 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', - 'pytorch/torchserve:0.7.1-cpu', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', 'seldonio/mlserver:1.3.2', - 'tensorflow/serving:2.6.2'] + images: + - docker.io/seldonio/mlserver:1.5.0 + - kserve/huggingfaceserver:v0.14.1 + - kserve/kserve-controller:v0.14.1 + - kserve/lgbserver:v0.14.1 + - kserve/modelmesh-controller:v0.12.0 + - kserve/paddleserver:v0.14.1 + - kserve/pmmlserver:v0.14.1 + - kserve/sklearnserver:v0.14.1 + - kserve/storage-initializer:v0.14.1 + - kserve/xgbserver:v0.14.1 + - nvcr.io/nvidia/tritonserver:23.04-py3 + - nvcr.io/nvidia/tritonserver:23.05-py3 + - openvino/model_server:2022.2 + - pytorch/torchserve-kfs:0.9.0 + - pytorch/torchserve:0.7.1-cpu + - quay.io/brancz/kube-rbac-proxy:v0.18.0 + - seldonio/mlserver:1.3.2 + - tensorflow/serving:2.6.2 - version: 0.13.1 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [HuggingFace vLLM runtime updated to vLLM 0.4.3 and now includes the - NCCL package for improved GPU/distributed performance., 'vLLM startup now - propagates the trust_remote_code flag more consistently, improving compatibility - with models that require remote code.', 'Chat template generation now uses - add_generation_prompt, improving prompt formatting for chat-style models.', - 'vLLM logprobs handling was fixed, improving correctness for applications - relying on token probability outputs.', 'Additional packages required for - vLLM model loading are installed by default, reducing runtime load failures.'] + features: + - HuggingFace vLLM runtime updated to vLLM 0.4.3 and now includes the NCCL package + for improved GPU/distributed performance. + - vLLM startup now propagates the trust_remote_code flag more consistently, + improving compatibility with models that require remote code. + - Chat template generation now uses add_generation_prompt, improving prompt + formatting for chat-style models. + - vLLM logprobs handling was fixed, improving correctness for applications relying + on token probability outputs. + - Additional packages required for vLLM model loading are installed by default, + reducing runtime load failures. breaking_changes: [] chart_version: v0.13.1 - images: ['docker.io/seldonio/mlserver:1.3.2', 'gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1', - 'kserve/huggingfaceserver:v0.13.1', 'kserve/kserve-controller:v0.13.1', 'kserve/lgbserver:v0.13.1', - 'kserve/modelmesh-controller:v0.12.0-rc0', 'kserve/paddleserver:v0.13.1', 'kserve/pmmlserver:v0.13.1', - 'kserve/sklearnserver:v0.13.1', 'kserve/storage-initializer:v0.13.1', 'kserve/xgbserver:v0.13.1', - 'nvcr.io/nvidia/tritonserver:23.04-py3', 'nvcr.io/nvidia/tritonserver:23.05-py3', - 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', 'pytorch/torchserve:0.7.1-cpu', - 'seldonio/mlserver:1.3.2', 'tensorflow/serving:2.6.2'] + images: + - docker.io/seldonio/mlserver:1.3.2 + - gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 + - kserve/huggingfaceserver:v0.13.1 + - kserve/kserve-controller:v0.13.1 + - kserve/lgbserver:v0.13.1 + - kserve/modelmesh-controller:v0.12.0-rc0 + - kserve/paddleserver:v0.13.1 + - kserve/pmmlserver:v0.13.1 + - kserve/sklearnserver:v0.13.1 + - kserve/storage-initializer:v0.13.1 + - kserve/xgbserver:v0.13.1 + - nvcr.io/nvidia/tritonserver:23.04-py3 + - nvcr.io/nvidia/tritonserver:23.05-py3 + - openvino/model_server:2022.2 + - pytorch/torchserve-kfs:0.9.0 + - pytorch/torchserve:0.7.1-cpu + - seldonio/mlserver:1.3.2 + - tensorflow/serving:2.6.2 - version: 0.12.1 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Updates FastAPI to 0.109.1 and adds/keeps support for Ray 2.10 in - the 0.12.1 release line., Adds Pydantic v2 support for the Python components/runtime - in 0.12.1.] + features: + - Updates FastAPI to 0.109.1 and adds/keeps support for Ray 2.10 in the 0.12.1 + release line. + - Adds Pydantic v2 support for the Python components/runtime in 0.12.1. breaking_changes: [] chart_version: v0.12.1 - images: ['docker.io/seldonio/mlserver:1.3.2', 'gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1', - 'kserve/huggingfaceserver:v0.12.1', 'kserve/kserve-controller:v0.12.1', 'kserve/lgbserver:v0.12.1', - 'kserve/modelmesh-controller:v0.11.2', 'kserve/paddleserver:v0.12.1', 'kserve/pmmlserver:v0.12.1', - 'kserve/sklearnserver:v0.12.1', 'kserve/storage-initializer:v0.12.1', 'kserve/xgbserver:v0.12.1', - 'nvcr.io/nvidia/tritonserver:23.04-py3', 'nvcr.io/nvidia/tritonserver:23.05-py3', - 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', 'pytorch/torchserve:0.7.1-cpu', - 'seldonio/mlserver:1.3.2', 'tensorflow/serving:2.6.2'] + images: + - docker.io/seldonio/mlserver:1.3.2 + - gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 + - kserve/huggingfaceserver:v0.12.1 + - kserve/kserve-controller:v0.12.1 + - kserve/lgbserver:v0.12.1 + - kserve/modelmesh-controller:v0.11.2 + - kserve/paddleserver:v0.12.1 + - kserve/pmmlserver:v0.12.1 + - kserve/sklearnserver:v0.12.1 + - kserve/storage-initializer:v0.12.1 + - kserve/xgbserver:v0.12.1 + - nvcr.io/nvidia/tritonserver:23.04-py3 + - nvcr.io/nvidia/tritonserver:23.05-py3 + - openvino/model_server:2022.2 + - pytorch/torchserve-kfs:0.9.0 + - pytorch/torchserve:0.7.1-cpu + - seldonio/mlserver:1.3.2 + - tensorflow/serving:2.6.2 - version: 0.11.2 - kube: ['1.27', '1.26', '1.25'] + kube: + - '1.27' + - '1.26' + - '1.25' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Performance fix in KServe Python server by switching back to standard - sockets (v0.10.2)., Security hardening via cherry-picks related to CVE-2023-44487 - (v0.11.2).] + features: + - Performance fix in KServe Python server by switching back to standard sockets + (v0.10.2). + - Security hardening via cherry-picks related to CVE-2023-44487 (v0.11.2). breaking_changes: [] chart_version: v0.11.2 images: [] - version: 0.10.2 - kube: ['1.25', '1.24', '1.23', '1.22'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ["KServe manager/controller was converted from a StatefulSet\ - \ to a Deployment to support HA; the StatefulSet is slated for removal in\ - \ 0.10 (so on 0.10.x you should expect/ensure you\u2019re running the Deployment\ - \ form)."] - features: [InferenceGraph introduced (initial API + Python SDK) for advanced - routing/composition of inference steps., ModelMesh became fully compatible - with the KServe InferenceService API; transformers can work with ModelMesh., - 'New/expanded model serving integrations and knobs: MLflow support, configurable - ingress class name, configurable URL scheme, and autoscaling target/metric - configuration per InferenceService component.', 'Storage spec was unified - and expanded (new storage spec, webhdfs support, Azure file share support).', - 'ServingRuntime spec expanded (protocolVersion, volumes in pod spec, more - container fields, env for built-in adapters).', Model Status API added to - InferenceService with controller logic to update it.] - breaking_changes: ['Operational change: controller/manager moved from StatefulSet - to Deployment (HA); if you had StatefulSet-specific overrides or relied - on stable pod identity/PVCs, you must adapt. The StatefulSet is removed - in 0.10 per the 0.9.0 notes.'] + kube: + - '1.25' + - '1.24' + - '1.23' + - '1.22' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - "KServe manager/controller was converted from a StatefulSet to a Deployment\ + \ to support HA; the StatefulSet is slated for removal in 0.10 (so on 0.10.x\ + \ you should expect/ensure you\u2019re running the Deployment form)." + features: + - InferenceGraph introduced (initial API + Python SDK) for advanced routing/composition + of inference steps. + - ModelMesh became fully compatible with the KServe InferenceService API; transformers + can work with ModelMesh. + - 'New/expanded model serving integrations and knobs: MLflow support, configurable + ingress class name, configurable URL scheme, and autoscaling target/metric + configuration per InferenceService component.' + - Storage spec was unified and expanded (new storage spec, webhdfs support, + Azure file share support). + - ServingRuntime spec expanded (protocolVersion, volumes in pod spec, more container + fields, env for built-in adapters). + - Model Status API added to InferenceService with controller logic to update + it. + breaking_changes: + - 'Operational change: controller/manager moved from StatefulSet to Deployment + (HA); if you had StatefulSet-specific overrides or relied on stable pod identity/PVCs, + you must adapt. The StatefulSet is removed in 0.10 per the 0.9.0 notes.' chart_version: v0.10.2 images: [] - version: 0.9.0 - kube: ['1.24', '1.23', '1.22', '1.21'] + kube: + - '1.24' + - '1.23' + - '1.22' + - '1.21' requirements: [] incompatibilities: [] summary: @@ -29954,59 +40993,78 @@ addons: \ after CRD upgrade.\n- **New unified storage configuration** introduced (new\ \ storage spec). If you set model storage via configmaps/old knobs, check\ \ chart values for moved/renamed storage settings.\n" - chart_updates: [KServe manager workload type changed from StatefulSet to Deployment - to enable HA (StatefulSet planned for removal in 0.10)., Helm chart updated - to reflect the new manager kind (Deployment) and related manifests., Chart - is published as a release asset starting in this release line (easier to - pin/download exact chart artifact).] - features: ['InferenceGraph: new API to define model inference DAGs/pipelines - (fan-out, ensembles, chaining) managed by KServe.', 'ModelMesh compatibility: - ModelMesh is now fully compatible with the KServe InferenceService API (unified - deployment API surface).', 'Unified storage spec: new storage configuration - model, plus new providers like Azure File Share and webhdfs support.', 'InferenceService - improvements: configurable URL scheme, ingress class name support, domain - template generation, and additional autoscaling metric/target settings.', - 'ServingRuntime enhancements: protocolVersion plus more pod/container customization - (volumes, env, additional container fields).'] - breaking_changes: ['kserve-manager moved from StatefulSet to Deployment. If - you depended on StatefulSet-specific semantics, behavior will change; StatefulSet - is slated for removal in 0.10 so treat this as the migration step.', "Python\ - \ SDK class renames happened in the prior release (0.8): `KFModel`\u2192\ - `Model`, `KFServer`\u2192`ModelServer`, `KFModelRepository`\u2192`ModelRepository`.\ - \ If you are jumping versions and still use old names, update imports/usages."] + chart_updates: + - KServe manager workload type changed from StatefulSet to Deployment to enable + HA (StatefulSet planned for removal in 0.10). + - Helm chart updated to reflect the new manager kind (Deployment) and related + manifests. + - Chart is published as a release asset starting in this release line (easier + to pin/download exact chart artifact). + features: + - 'InferenceGraph: new API to define model inference DAGs/pipelines (fan-out, + ensembles, chaining) managed by KServe.' + - 'ModelMesh compatibility: ModelMesh is now fully compatible with the KServe + InferenceService API (unified deployment API surface).' + - 'Unified storage spec: new storage configuration model, plus new providers + like Azure File Share and webhdfs support.' + - 'InferenceService improvements: configurable URL scheme, ingress class name + support, domain template generation, and additional autoscaling metric/target + settings.' + - 'ServingRuntime enhancements: protocolVersion plus more pod/container customization + (volumes, env, additional container fields).' + breaking_changes: + - kserve-manager moved from StatefulSet to Deployment. If you depended on StatefulSet-specific + semantics, behavior will change; StatefulSet is slated for removal in 0.10 + so treat this as the migration step. + - "Python SDK class renames happened in the prior release (0.8): `KFModel`\u2192\ + `Model`, `KFServer`\u2192`ModelServer`, `KFModelRepository`\u2192`ModelRepository`.\ + \ If you are jumping versions and still use old names, update imports/usages." chart_version: v0.9.0 images: [] - version: 0.8.0 - kube: ['1.22', '1.21', '1.20'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Helm chart updated for KServe release v0.8.0 (chart changes - not detailed in provided notes; review chart diff/values schema when upgrading).] - features: ['Introduces ServingRuntime and ClusterServingRuntime CRDs to define - serving runtimes (images, supported model formats) as Kubernetes resources - instead of a control-plane ConfigMap.', Adds automatic runtime selection - based on model format and ServingRuntime/ClusterServingRuntime definitions., - Adds a multiModel field to ServingRuntime spec to support runtimes capable - of serving multiple models., Adds Python SDK support for ServingRuntime - resources and updates CloudEvent handling in the SDK., Adds support for - gRPC communication between transformer and predictor., Adds TorchServe v2 - REST protocol support and improves sklearnserver to allow mixed-type inputs.] - breaking_changes: ["Python SDK class names were renamed: KFModel\u2192Model,\ - \ KFServer\u2192ModelServer, KFModelRepository\u2192ModelRepository; client\ - \ code must be updated accordingly.", 'KServe pytorchserver is deprecated; - PyTorch models now default to TorchServe runtime, which may change runtime - behavior/configuration.', 'ONNX runtime server is deprecated; ONNX models - now default to Triton Inference Server, potentially changing serving image, - args, and supported features.', cert-manager dependency upgraded to v1; - clusters using older cert-manager APIs/CRDs must be updated before/with - the upgrade., 'Controller updated to Knative 1.0; if using Knative-based - mode, ensure Knative components are compatible (API versions/CRDs).'] + kube: + - '1.22' + - '1.21' + - '1.20' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Helm chart updated for KServe release v0.8.0 (chart changes not detailed in + provided notes; review chart diff/values schema when upgrading). + features: + - Introduces ServingRuntime and ClusterServingRuntime CRDs to define serving + runtimes (images, supported model formats) as Kubernetes resources instead + of a control-plane ConfigMap. + - Adds automatic runtime selection based on model format and ServingRuntime/ClusterServingRuntime + definitions. + - Adds a multiModel field to ServingRuntime spec to support runtimes capable + of serving multiple models. + - Adds Python SDK support for ServingRuntime resources and updates CloudEvent + handling in the SDK. + - Adds support for gRPC communication between transformer and predictor. + - Adds TorchServe v2 REST protocol support and improves sklearnserver to allow + mixed-type inputs. + breaking_changes: + - "Python SDK class names were renamed: KFModel\u2192Model, KFServer\u2192ModelServer,\ + \ KFModelRepository\u2192ModelRepository; client code must be updated accordingly." + - KServe pytorchserver is deprecated; PyTorch models now default to TorchServe + runtime, which may change runtime behavior/configuration. + - ONNX runtime server is deprecated; ONNX models now default to Triton Inference + Server, potentially changing serving image, args, and supported features. + - cert-manager dependency upgraded to v1; clusters using older cert-manager + APIs/CRDs must be updated before/with the upgrade. + - Controller updated to Knative 1.0; if using Knative-based mode, ensure Knative + components are compatible (API versions/CRDs). chart_version: v0.8.0 images: [] - version: 0.7.0 - kube: ['1.22', '1.21', '1.20', '1.19'] + kube: + - '1.22' + - '1.21' + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null @@ -30020,7 +41078,10 @@ addons: helm_values: clusterName=example,account=example versions: - version: 1.40.4 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: @@ -30053,42 +41114,53 @@ addons: \ - **Workload container securityContexts** now drop **all Linux capabilities**.\n\ \ - Action: if you had workloads/sidecars depending on additional capabilities\ \ or node-agent deleting pods, confirm your flows still work.\n" - chart_updates: ['Updated component images/versions: operator bumped to v0.2.162 - (Bottlerocket detection support); storage image bumped to v0.0.298 (chart - note) and upstream storage includes additional fixes/features in this release - train.', 'Node-agent behavior update: auto-set `super_t` on Bottlerocket - node groups; Prometheus OTEL exporter enabled; malware detection changed - (ClamAV removed, moved to hash sensor).', 'Security hardening in templates: - drop all Linux capabilities in workload container securityContexts; pin - `runAsGroup` wherever `runAsUser` is pinned.', "Reliability/compat fixes:\ - \ mount CA certs into sbom-scanner sidecar; mount `config.json` as a file\ - \ (avoid masking policy dir); don\u2019t mask baked policy library when\ - \ downloads are off.", 'CRD/template polish: omit empty annotations key - on seccompprofiles CRD when empty; align SecurityException vulnerability - schema with kubevuln types.'] - features: [Configurable `defaultFrameworks` for operator posture scans; operator - honors the install-time setting for default frameworks., Opt-in RBAC support - for agent runtime posture (feature gated)., Storage APIServer can be run - on the host network (opt-in)., Autoupdater supports pod metadata overrides - (labels/annotations)., 'Bottlerocket node groups: node-agent can auto-detect - and auto-set `super_t` to work correctly on Bottlerocket.', Options added - to disable exec tracing and open tracing.] - breaking_changes: ['Node-agent malware detection change: **ClamAV removed** - and malware detection moved to the **hash sensor**. If you depended on ClamAV-specific - behavior/artifacts, validate the new detection path.', 'Node-agent RBAC - reduced: **pods/delete permission removed**. If you had automation relying - on node-agent deleting pods, it will no longer be allowed by default.', - "Node-agent values structure change: some \u201Cextra node-agent configuration\u201D\ - \ moved under an `extra` section; existing `values.yaml` may need path updates.", - 'SecurityContext hardening: workloads now **drop all Linux capabilities** - by default and `runAsGroup` is pinned alongside `runAsUser`; if any container - required extra capabilities or different group IDs, you must override explicitly.'] + chart_updates: + - 'Updated component images/versions: operator bumped to v0.2.162 (Bottlerocket + detection support); storage image bumped to v0.0.298 (chart note) and upstream + storage includes additional fixes/features in this release train.' + - 'Node-agent behavior update: auto-set `super_t` on Bottlerocket node groups; + Prometheus OTEL exporter enabled; malware detection changed (ClamAV removed, + moved to hash sensor).' + - 'Security hardening in templates: drop all Linux capabilities in workload + container securityContexts; pin `runAsGroup` wherever `runAsUser` is pinned.' + - "Reliability/compat fixes: mount CA certs into sbom-scanner sidecar; mount\ + \ `config.json` as a file (avoid masking policy dir); don\u2019t mask baked\ + \ policy library when downloads are off." + - 'CRD/template polish: omit empty annotations key on seccompprofiles CRD when + empty; align SecurityException vulnerability schema with kubevuln types.' + features: + - Configurable `defaultFrameworks` for operator posture scans; operator honors + the install-time setting for default frameworks. + - Opt-in RBAC support for agent runtime posture (feature gated). + - Storage APIServer can be run on the host network (opt-in). + - Autoupdater supports pod metadata overrides (labels/annotations). + - 'Bottlerocket node groups: node-agent can auto-detect and auto-set `super_t` + to work correctly on Bottlerocket.' + - Options added to disable exec tracing and open tracing. + breaking_changes: + - 'Node-agent malware detection change: **ClamAV removed** and malware detection + moved to the **hash sensor**. If you depended on ClamAV-specific behavior/artifacts, + validate the new detection path.' + - 'Node-agent RBAC reduced: **pods/delete permission removed**. If you had automation + relying on node-agent deleting pods, it will no longer be allowed by default.' + - "Node-agent values structure change: some \u201Cextra node-agent configuration\u201D\ + \ moved under an `extra` section; existing `values.yaml` may need path updates." + - 'SecurityContext hardening: workloads now **drop all Linux capabilities** + by default and `runAsGroup` is pinned alongside `runAsUser`; if any container + required extra capabilities or different group IDs, you must override explicitly.' chart_version: 1.40.4 - images: ['quay.io/kubescape/http-request:v0.2.23', 'quay.io/kubescape/kubescape:v4.0.13', - 'quay.io/kubescape/kubevuln:v0.3.430', 'quay.io/kubescape/node-agent:v0.3.219', - 'quay.io/kubescape/operator:v0.2.169', 'quay.io/kubescape/storage:v0.0.331'] + images: + - quay.io/kubescape/http-request:v0.2.23 + - quay.io/kubescape/kubescape:v4.0.13 + - quay.io/kubescape/kubevuln:v0.3.430 + - quay.io/kubescape/node-agent:v0.3.219 + - quay.io/kubescape/operator:v0.2.169 + - quay.io/kubescape/storage:v0.0.331 - version: 1.40.3 - kube: ['1.37', '1.36', '1.35'] + kube: + - '1.37' + - '1.36' + - '1.35' requirements: [] incompatibilities: [] summary: @@ -30110,39 +41182,51 @@ addons: \ targeting**: node-agent targeting updated to include **label-less nodes**\ \ (affinity `DoesNotExist`); also mount guards aligned for the operator node-agent\ \ autoscaler.\n" - chart_updates: [Enables/ships **CEL admission rules** support in the operator - and adds **CEL validation** to `SecurityException` CRDs (plus a CEL rule - tweak for GitOps reconcilers using `oldSelf` semantics)., 'Synchronizer - now syncs additional resource types, including **ServiceAccounts**, **ContainerProfiles**, - and registers **AISandboxHeartbeats httpEndpoint** resource.', 'Node-agent - GKE Autopilot allowlist: default bumped to **1.40-v2**, plus drift-gating - tooling and optional **AllowlistSynchronizer** install when enabled.', 'Storage: - pod now restarts on storage config changes (to apply config reliably).', - 'Label hygiene: sanitizes `''+''` in `app.kubernetes.io/version` label to - comply with label constraints.'] - features: [Operator can run **CRD-driven CEL admission rules** (including async - validation) and chart enables this capability., '`SecurityException` CRDs - gain **CEL validation**, improving early rejection of invalid exceptions; - operator also watches exceptions and can rescan on change/expiry.', '**Opt-in - remediation capability** (`capabilities.remediation`) with the required - mutating RBAC gates.', 'Kubevuln gains **registry/proxy mapping and matching - controls** (`proxyRegistryMap`, `cveMatchingMode`, `trustedVendors`) to - tune vuln matching in enterprise registries.', Node-agent OTEL improvements - and config exposure (notably `alertDeduplication.bypass`) plus better scheduling - behavior on nodes missing grouping labels., 'Synchronizer expands what it - syncs (ServiceAccounts, ContainerProfiles) and adds optional **Kafka backend** - support (component-level).'] - breaking_changes: [Chart enforces **Kubernetes >= 1.28**; installs/upgrades - will fail on older clusters until the cluster is upgraded., 'Chart **no - longer bundles an OpenTelemetry collector**; if you depended on it, you - must deploy/operate your own OTEL collector and configure node-agent to - use it via `otelUrl`.'] + chart_updates: + - Enables/ships **CEL admission rules** support in the operator and adds **CEL + validation** to `SecurityException` CRDs (plus a CEL rule tweak for GitOps + reconcilers using `oldSelf` semantics). + - Synchronizer now syncs additional resource types, including **ServiceAccounts**, + **ContainerProfiles**, and registers **AISandboxHeartbeats httpEndpoint** + resource. + - 'Node-agent GKE Autopilot allowlist: default bumped to **1.40-v2**, plus drift-gating + tooling and optional **AllowlistSynchronizer** install when enabled.' + - 'Storage: pod now restarts on storage config changes (to apply config reliably).' + - 'Label hygiene: sanitizes `''+''` in `app.kubernetes.io/version` label to + comply with label constraints.' + features: + - Operator can run **CRD-driven CEL admission rules** (including async validation) + and chart enables this capability. + - '`SecurityException` CRDs gain **CEL validation**, improving early rejection + of invalid exceptions; operator also watches exceptions and can rescan on + change/expiry.' + - '**Opt-in remediation capability** (`capabilities.remediation`) with the required + mutating RBAC gates.' + - Kubevuln gains **registry/proxy mapping and matching controls** (`proxyRegistryMap`, + `cveMatchingMode`, `trustedVendors`) to tune vuln matching in enterprise registries. + - Node-agent OTEL improvements and config exposure (notably `alertDeduplication.bypass`) + plus better scheduling behavior on nodes missing grouping labels. + - Synchronizer expands what it syncs (ServiceAccounts, ContainerProfiles) and + adds optional **Kafka backend** support (component-level). + breaking_changes: + - Chart enforces **Kubernetes >= 1.28**; installs/upgrades will fail on older + clusters until the cluster is upgraded. + - Chart **no longer bundles an OpenTelemetry collector**; if you depended on + it, you must deploy/operate your own OTEL collector and configure node-agent + to use it via `otelUrl`. chart_version: 1.40.3 - images: ['quay.io/kubescape/http-request:v0.2.20', 'quay.io/kubescape/kubescape:v4.0.11', - 'quay.io/kubescape/kubevuln:v0.3.159', 'quay.io/kubescape/node-agent:v0.3.158', - 'quay.io/kubescape/operator:v0.2.159', 'quay.io/kubescape/storage:v0.0.297'] + images: + - quay.io/kubescape/http-request:v0.2.20 + - quay.io/kubescape/kubescape:v4.0.11 + - quay.io/kubescape/kubevuln:v0.3.159 + - quay.io/kubescape/node-agent:v0.3.158 + - quay.io/kubescape/operator:v0.2.159 + - quay.io/kubescape/storage:v0.0.297 - version: 1.40.0 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: @@ -30163,119 +41247,153 @@ addons: - If adopting GitOps, the chart adds **Argo CD GitOps support** (review any new annotations/packaging expectations in your environment).' - chart_updates: ['Templates: remove redundant `GOMAXPROCS` wiring.', Argo CD - GitOps support added for the chart., Helm chart releases now include artifact - provenance attestations., 'Node-agent + kubevuln: set `GOMEMLIMIT` to ~80% - of container memory limit.', Rules CRD updated with `profileDataRequired` - to support rule-aware projection., 'Runtime sensing architecture change: - host sensor replaced with node-agent sensing.'] - features: ["Argo CD\u2013friendly GitOps support for deploying Kubescape via\ - \ Helm.", 'Supply-chain enhancement: Helm chart releases now publish artifact - provenance attestations.', 'Improved memory management: node-agent and kubevuln - set `GOMEMLIMIT` relative to pod memory limits; operator autoscaler can - compute it per node group.', Rule-aware profile projection support via new - `profileDataRequired` field in the rules CRD., 'Multiple performance and - correctness improvements across scanning, OPA processing, and error surfacing - in partial resource collection.'] - breaking_changes: ['Runtime sensing change: **host sensor is replaced by node-agent - sensing**. If you relied on host-sensor behavior, config, or DaemonSet specifics, - validate equivalent coverage and update any assumptions/allowlists.', CRD - schema changes (rules CRD adds `profileDataRequired`) require CRDs to be - updated; mismatched CRDs can cause reconciliation/validation issues during - upgrade.] + chart_updates: + - 'Templates: remove redundant `GOMAXPROCS` wiring.' + - Argo CD GitOps support added for the chart. + - Helm chart releases now include artifact provenance attestations. + - 'Node-agent + kubevuln: set `GOMEMLIMIT` to ~80% of container memory limit.' + - Rules CRD updated with `profileDataRequired` to support rule-aware projection. + - 'Runtime sensing architecture change: host sensor replaced with node-agent + sensing.' + features: + - "Argo CD\u2013friendly GitOps support for deploying Kubescape via Helm." + - 'Supply-chain enhancement: Helm chart releases now publish artifact provenance + attestations.' + - 'Improved memory management: node-agent and kubevuln set `GOMEMLIMIT` relative + to pod memory limits; operator autoscaler can compute it per node group.' + - Rule-aware profile projection support via new `profileDataRequired` field + in the rules CRD. + - Multiple performance and correctness improvements across scanning, OPA processing, + and error surfacing in partial resource collection. + breaking_changes: + - 'Runtime sensing change: **host sensor is replaced by node-agent sensing**. + If you relied on host-sensor behavior, config, or DaemonSet specifics, validate + equivalent coverage and update any assumptions/allowlists.' + - CRD schema changes (rules CRD adds `profileDataRequired`) require CRDs to + be updated; mismatched CRDs can cause reconciliation/validation issues during + upgrade. chart_version: 1.40.0 images: [] - version: 1.30.7 - kube: ['1.36', '1.35', '1.34'] + kube: + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['From 1.30.0 release notes: otel-collector deployment fix to - allow external OTEL URL without requiring a cloud provider.', 'NetworkPolicy - fixes: prometheus-exporter egress + storage ingress rules corrected.', NetworkPolicy - fix to allow Prometheus ServiceMonitor traffic to kubescape., 'Feature added: - image-based capability (per PR ''Feat/image based'').', No specific changelog - items were provided for 1.30.7 in the notes you shared (release exists but - has no listed changes).] - features: ['Adds an image-based mode/capability (details depend on chart values; - see PR #770 in kubescape/helm-charts).'] + chart_updates: + - 'From 1.30.0 release notes: otel-collector deployment fix to allow external + OTEL URL without requiring a cloud provider.' + - 'NetworkPolicy fixes: prometheus-exporter egress + storage ingress rules corrected.' + - NetworkPolicy fix to allow Prometheus ServiceMonitor traffic to kubescape. + - 'Feature added: image-based capability (per PR ''Feat/image based'').' + - No specific changelog items were provided for 1.30.7 in the notes you shared + (release exists but has no listed changes). + features: + - 'Adds an image-based mode/capability (details depend on chart values; see + PR #770 in kubescape/helm-charts).' breaking_changes: [] chart_version: 1.30.7 images: [] - version: 1.30.0 - kube: ['1.35', '1.34', '1.33'] + kube: + - '1.35' + - '1.34' + - '1.33' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Fix otel-collector deployment so an external OTEL URL works - even when no cloud provider is set (#766)., Fix NetworkPolicy for prometheus-exporter - egress and storage ingress (#768)., Fix NetworkPolicy to allow Prometheus - ServiceMonitor traffic for Kubescape (#767)., 'Add feature: image-based - mode/support (#770).'] - features: [Adds image-based functionality (image-based scanning/mode) to the - operator.] + chart_updates: + - Fix otel-collector deployment so an external OTEL URL works even when no cloud + provider is set (#766). + - Fix NetworkPolicy for prometheus-exporter egress and storage ingress (#768). + - Fix NetworkPolicy to allow Prometheus ServiceMonitor traffic for Kubescape + (#767). + - 'Add feature: image-based mode/support (#770).' + features: + - Adds image-based functionality (image-based scanning/mode) to the operator. breaking_changes: [] chart_version: 1.30.0 images: [] - version: 1.29.12 - kube: ['1.35', '1.34', '1.33'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Bumps component images/versions across the stack (operator and - synchronizer) between chart 1.29.1 and 1.29.12., 'Includes dependency refreshes - in operator (armoapi-go, registryx) and synchronizer (jose2go v1.7.0).'] - features: [No new user-facing features called out in the provided 1.29.12 notes; - changes appear to be dependency/version bumps for operator and synchronizer., - 'From 1.29.1 notes (baseline), notable functional behavior includes improved - handling on startup (process existing APs/SBOMs) and vulnerability scanning - behavior (error when severity threshold exceeded), plus node-agent performance/robustness - improvements and Prometheus support.'] + kube: + - '1.35' + - '1.34' + - '1.33' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps component images/versions across the stack (operator and synchronizer) + between chart 1.29.1 and 1.29.12. + - Includes dependency refreshes in operator (armoapi-go, registryx) and synchronizer + (jose2go v1.7.0). + features: + - No new user-facing features called out in the provided 1.29.12 notes; changes + appear to be dependency/version bumps for operator and synchronizer. + - From 1.29.1 notes (baseline), notable functional behavior includes improved + handling on startup (process existing APs/SBOMs) and vulnerability scanning + behavior (error when severity threshold exceeded), plus node-agent performance/robustness + improvements and Prometheus support. breaking_changes: [] chart_version: 1.29.12 images: [] - version: 1.29.1 - kube: ['1.34', '1.33', '1.32'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Bumps bundled component versions across the Kubescape stack - (kubescape core, operator, kubevuln, storage, node-agent, synchronizer).', - General stability/performance tweaks in node-agent; improved startup behavior - in operator; logging noise reduction in storage. No chart-structure changes - mentioned in provided notes.] - features: ['Kubescape core: image scanning can now return an error when the - configured severity threshold is exceeded (enables fail-fast/CI-style enforcement - behavior).', 'Operator: on startup, it processes existing ApplicationProfiles - (APs) and SBOMs instead of only handling newly created ones.', 'Kubevuln: - supports non-image source types (broader input support beyond container - images).', 'Node-agent: adds Prometheus-related work and introduces configurable - worker pool behavior for tuning throughput/resource usage.'] + kube: + - '1.34' + - '1.33' + - '1.32' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Bumps bundled component versions across the Kubescape stack (kubescape core, + operator, kubevuln, storage, node-agent, synchronizer). + - General stability/performance tweaks in node-agent; improved startup behavior + in operator; logging noise reduction in storage. No chart-structure changes + mentioned in provided notes. + features: + - 'Kubescape core: image scanning can now return an error when the configured + severity threshold is exceeded (enables fail-fast/CI-style enforcement behavior).' + - 'Operator: on startup, it processes existing ApplicationProfiles (APs) and + SBOMs instead of only handling newly created ones.' + - 'Kubevuln: supports non-image source types (broader input support beyond container + images).' + - 'Node-agent: adds Prometheus-related work and introduces configurable worker + pool behavior for tuning throughput/resource usage.' breaking_changes: [] chart_version: 1.29.1 images: [] - version: 1.29.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [No explicit chart/values changes are described in the provided - notes for `kubescape-operator-1.29.0` (release entry contains only metadata)., - 'From `1.28.0`, the chart added **kubelet directory support** in the node-agent - configuration (PR #707).'] - features: ['(From 1.28.0 notes) Node agent configuration gained support for - specifying/handling the kubelet directory, improving compatibility across - node layouts/distributions.'] + chart_updates: + - No explicit chart/values changes are described in the provided notes for `kubescape-operator-1.29.0` + (release entry contains only metadata). + - 'From `1.28.0`, the chart added **kubelet directory support** in the node-agent + configuration (PR #707).' + features: + - (From 1.28.0 notes) Node agent configuration gained support for specifying/handling + the kubelet directory, improving compatibility across node layouts/distributions. breaking_changes: [] chart_version: 1.29.0 images: [] - version: 1.28.0 - kube: ['1.33', '1.32', '1.31'] + kube: + - '1.33' + - '1.32' + - '1.31' requirements: [] incompatibilities: [] summary: @@ -30285,38 +41403,49 @@ addons: directory path if your kubelet uses a non-default location. ' - chart_updates: [Bumped kubescape-operator chart/app version to **1.28.0**., - Added kubelet directory support in node-agent configuration.] - features: ['Node-agent can now be configured with an explicit kubelet directory - path, improving compatibility with clusters where kubelet uses non-standard - directories.'] + chart_updates: + - Bumped kubescape-operator chart/app version to **1.28.0**. + - Added kubelet directory support in node-agent configuration. + features: + - Node-agent can now be configured with an explicit kubelet directory path, + improving compatibility with clusters where kubelet uses non-standard directories. breaking_changes: [] chart_version: 1.28.0 images: [] - version: 1.27.3 - kube: ['1.33', '1.32', '1.31'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Added Kubernetes recommended labels and other additional labels - across resources., Added additional labels for ServiceMonitor resources., - Enabled node SBOM generation (nodeSbomGeneration)., Migrated AppArmor configuration - from annotations to native AppArmor fields., Fixed HTTP detection flag wiring/behavior., - "Bumped subcomponents: operator v0.2.82\u2192v0.2.84, kubevuln v0.3.69\u2192\ - v0.3.72, node-agent v0.2.287\u2192v0.2.298, inspektor-gadget to v0.39.0,\ - \ and registryx to address a panic."] - features: [Consistent Kubernetes recommended labels (and extra chart labels) - are applied to resources; ServiceMonitor now supports additional labels., - Node SBOM generation can be enabled to produce SBOMs at the node level., Generated - SBOMs include an artifact type label for better identification.] - breaking_changes: [AppArmor moved from pod annotations to the newer Kubernetes - AppArmor fields; clusters relying on legacy annotation-based AppArmor need - to validate their policies/manifests still apply.] + kube: + - '1.33' + - '1.32' + - '1.31' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Added Kubernetes recommended labels and other additional labels across resources. + - Added additional labels for ServiceMonitor resources. + - Enabled node SBOM generation (nodeSbomGeneration). + - Migrated AppArmor configuration from annotations to native AppArmor fields. + - Fixed HTTP detection flag wiring/behavior. + - "Bumped subcomponents: operator v0.2.82\u2192v0.2.84, kubevuln v0.3.69\u2192\ + v0.3.72, node-agent v0.2.287\u2192v0.2.298, inspektor-gadget to v0.39.0, and\ + \ registryx to address a panic." + features: + - Consistent Kubernetes recommended labels (and extra chart labels) are applied + to resources; ServiceMonitor now supports additional labels. + - Node SBOM generation can be enabled to produce SBOMs at the node level. + - Generated SBOMs include an artifact type label for better identification. + breaking_changes: + - AppArmor moved from pod annotations to the newer Kubernetes AppArmor fields; + clusters relying on legacy annotation-based AppArmor need to validate their + policies/manifests still apply. chart_version: 1.27.3 images: [] - version: 1.27.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -30333,26 +41462,37 @@ addons: \ values changes are called out in the snippet (mostly component bumps and\ \ internal changes), but still run a `helm diff upgrade` to catch template/value\ \ drift." - chart_updates: ['1.26.0: Enable host sensor configurations (#624).', '1.26.0: - Change default chart settings for node SBOM, mTLS, Admission Controller, - and HTTP (#625).', '1.26.0: Add missing nodeSelector for linux OS (#626).', - '1.27.0: Bump referenced component versions across kubescape, operator, kubevuln, - storage, node-agent, synchronizer, prometheus-exporter (various PRs).'] - features: [Prerequisites UI enhanced with new review-values flow and improved - prerequisites experience (kubescape v3.0.34 range)., Prerequisites updated - to support custom kubeconfig (kubescape)., 'Operator: added process tree - information for exec-to-pod events (operator).', 'Node-agent: added task-based - enricher and additional alert/enrichment improvements (node-agent).', 'Storage: - reduced SQLite connection lock contention (storage).'] - breaking_changes: ['Storage: **NetworkNeighbors deprecated and removed** (storage). - If you have any downstream tooling/queries relying on this data/model, validate - compatibility before upgrading.'] + chart_updates: + - '1.26.0: Enable host sensor configurations (#624).' + - '1.26.0: Change default chart settings for node SBOM, mTLS, Admission Controller, + and HTTP (#625).' + - '1.26.0: Add missing nodeSelector for linux OS (#626).' + - '1.27.0: Bump referenced component versions across kubescape, operator, kubevuln, + storage, node-agent, synchronizer, prometheus-exporter (various PRs).' + features: + - Prerequisites UI enhanced with new review-values flow and improved prerequisites + experience (kubescape v3.0.34 range). + - Prerequisites updated to support custom kubeconfig (kubescape). + - 'Operator: added process tree information for exec-to-pod events (operator).' + - 'Node-agent: added task-based enricher and additional alert/enrichment improvements + (node-agent).' + - 'Storage: reduced SQLite connection lock contention (storage).' + breaking_changes: + - 'Storage: **NetworkNeighbors deprecated and removed** (storage). If you have + any downstream tooling/queries relying on this data/model, validate compatibility + before upgrading.' chart_version: 1.27.0 - images: ['quay.io/kubescape/kubescape:v3.0.34', 'quay.io/kubescape/kubevuln:v0.3.69', - 'quay.io/kubescape/node-agent:v0.2.282', 'quay.io/kubescape/operator:v0.2.81', - 'quay.io/kubescape/storage:v0.0.172'] + images: + - quay.io/kubescape/kubescape:v3.0.34 + - quay.io/kubescape/kubevuln:v0.3.69 + - quay.io/kubescape/node-agent:v0.2.282 + - quay.io/kubescape/operator:v0.2.81 + - quay.io/kubescape/storage:v0.0.172 - version: 1.26.0 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: @@ -30371,137 +41511,203 @@ addons: your custom patch/override. ' - chart_updates: [Enabled/configured host sensor options in the chart., 'Adjusted - default chart settings affecting node SBOM, mTLS, admission controller, - and HTTP.', Added missing `nodeSelector` for Linux OS scheduling.] - features: [Host sensor configurations are now enabled/configurable via the chart., - Improved correctness around continuous scanning setting validation (operator - change).] - breaking_changes: ['Default behavior changes for node SBOM, mTLS, admission - controller, and HTTP may alter runtime behavior after upgrade if you relied - on prior defaults. Treat as potentially breaking unless you pin explicit - values.'] + chart_updates: + - Enabled/configured host sensor options in the chart. + - Adjusted default chart settings affecting node SBOM, mTLS, admission controller, + and HTTP. + - Added missing `nodeSelector` for Linux OS scheduling. + features: + - Host sensor configurations are now enabled/configurable via the chart. + - Improved correctness around continuous scanning setting validation (operator + change). + breaking_changes: + - Default behavior changes for node SBOM, mTLS, admission controller, and HTTP + may alter runtime behavior after upgrade if you relied on prior defaults. + Treat as potentially breaking unless you pin explicit values. chart_version: 1.26.0 - images: ['quay.io/kubescape/kubescape:v3.0.30', 'quay.io/kubescape/kubevuln:v0.3.62', - 'quay.io/kubescape/node-agent:v0.2.259', 'quay.io/kubescape/operator:v0.2.74', - 'quay.io/kubescape/storage:v0.0.161'] + images: + - quay.io/kubescape/kubescape:v3.0.30 + - quay.io/kubescape/kubevuln:v0.3.62 + - quay.io/kubescape/node-agent:v0.2.259 + - quay.io/kubescape/operator:v0.2.74 + - quay.io/kubescape/storage:v0.0.161 - version: 1.25.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Added support for air-gapped scans., Made recurring scan request - body configurable., Expanded ClusterRole permissions when workload metrics - are enabled., Updated/filled missing test values and refreshed E2E tests., - Synchronizer no longer retries on invalid credentials., Fixed node-agent annotation - to use a dynamic name., Added node-agent mounts., Fixed whitespace issue - affecting `serviceScanConfig.enabled`., Deprecated the gateway component.] - features: [Air-gapped scans can now be enabled for environments without external - network access., Recurring scan request body is now configurable., 'When - workload metrics are enabled, required RBAC resources are added automatically.', - Node-agent has additional mounts and uses a dynamic annotation name for better - correctness across installs.] - breaking_changes: ['Gateway is deprecated; plan to remove/disable it and ensure - your deployment works without it (e.g., route traffic directly to the recommended - component).'] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Added support for air-gapped scans. + - Made recurring scan request body configurable. + - Expanded ClusterRole permissions when workload metrics are enabled. + - Updated/filled missing test values and refreshed E2E tests. + - Synchronizer no longer retries on invalid credentials. + - Fixed node-agent annotation to use a dynamic name. + - Added node-agent mounts. + - Fixed whitespace issue affecting `serviceScanConfig.enabled`. + - Deprecated the gateway component. + features: + - Air-gapped scans can now be enabled for environments without external network + access. + - Recurring scan request body is now configurable. + - When workload metrics are enabled, required RBAC resources are added automatically. + - Node-agent has additional mounts and uses a dynamic annotation name for better + correctness across installs. + breaking_changes: + - Gateway is deprecated; plan to remove/disable it and ensure your deployment + works without it (e.g., route traffic directly to the recommended component). chart_version: 1.25.0 - images: ['quay.io/kubescape/kubescape:v3.0.23', 'quay.io/kubescape/kubevuln:v0.3.52', - 'quay.io/kubescape/node-agent:v0.2.210', 'quay.io/kubescape/operator:v0.2.63', - 'quay.io/kubescape/storage:v0.0.148'] + images: + - quay.io/kubescape/kubescape:v3.0.23 + - quay.io/kubescape/kubevuln:v0.3.52 + - quay.io/kubescape/node-agent:v0.2.210 + - quay.io/kubescape/operator:v0.2.63 + - quay.io/kubescape/storage:v0.0.148 - version: 1.24.0 - kube: ['1.32', '1.31', '1.30'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: ['Node-agent: switched to using the released node-agent image - and updated the chart in preparation for the 1.24.0 release.', 'Node-agent: - added SBOM generation capability (introduced in 1.23.4).', 'Image pull secrets: - chart can now generate an imagePullSecret when registry credentials are - provided.', "Relevancy logic: switched from SBOM-based relevancy (\u201C\ - sbomp\u201D) to using Application Profile for relevancy in 1.24.0.", 'Release - engineering updates: pre-release image bumps and general release prep changes - in 1.24.0.'] - features: [Node-agent SBOM generation support (added in 1.23.4)., Automatic - creation of imagePullSecret from provided registry credentials (added in - 1.23.4)., "Relevancy now uses Application Profile instead of SBOM (\u201C\ - sbomp\u201D) (changed in 1.24.0)."] - breaking_changes: ["Relevancy mechanism changed from SBOM (\u201Csbomp\u201D\ - ) to Application Profile in 1.24.0; any workflows or expectations tied to\ - \ SBOM-based relevancy may change and should be validated post-upgrade."] + kube: + - '1.32' + - '1.31' + - '1.30' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - 'Node-agent: switched to using the released node-agent image and updated the + chart in preparation for the 1.24.0 release.' + - 'Node-agent: added SBOM generation capability (introduced in 1.23.4).' + - 'Image pull secrets: chart can now generate an imagePullSecret when registry + credentials are provided.' + - "Relevancy logic: switched from SBOM-based relevancy (\u201Csbomp\u201D) to\ + \ using Application Profile for relevancy in 1.24.0." + - 'Release engineering updates: pre-release image bumps and general release + prep changes in 1.24.0.' + features: + - Node-agent SBOM generation support (added in 1.23.4). + - Automatic creation of imagePullSecret from provided registry credentials (added + in 1.23.4). + - "Relevancy now uses Application Profile instead of SBOM (\u201Csbomp\u201D\ + ) (changed in 1.24.0)." + breaking_changes: + - "Relevancy mechanism changed from SBOM (\u201Csbomp\u201D) to Application\ + \ Profile in 1.24.0; any workflows or expectations tied to SBOM-based relevancy\ + \ may change and should be validated post-upgrade." chart_version: 1.24.0 - images: ['quay.io/kubescape/kubescape:v3.0.22', 'quay.io/kubescape/kubevuln:v0.3.48', - 'quay.io/kubescape/node-agent:v0.2.204', 'quay.io/kubescape/operator:v0.2.55', - 'quay.io/kubescape/storage:v0.0.146'] + images: + - quay.io/kubescape/kubescape:v3.0.22 + - quay.io/kubescape/kubevuln:v0.3.48 + - quay.io/kubescape/node-agent:v0.2.204 + - quay.io/kubescape/operator:v0.2.55 + - quay.io/kubescape/storage:v0.0.146 - version: 1.23.4 - kube: ['1.32', '1.31', '1.30'] + kube: + - '1.32' + - '1.31' + - '1.30' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Fix node-agent Service selector (was not working)., Fix inspektor-gadget - access to Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`., - Use released node-agent image (align chart to released node-agent for 1.23.4)., - Add imagePullSecret generation capability when registry credentials are provided.] - features: [Node-agent can generate SBOMs (new optional feature introduced in - 1.23.4)., Chart can generate an imagePullSecret from provided registry credentials - to simplify pulling images from private registries.] + chart_updates: + - Fix node-agent Service selector (was not working). + - Fix inspektor-gadget access to Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`. + - Use released node-agent image (align chart to released node-agent for 1.23.4). + - Add imagePullSecret generation capability when registry credentials are provided. + features: + - Node-agent can generate SBOMs (new optional feature introduced in 1.23.4). + - Chart can generate an imagePullSecret from provided registry credentials to + simplify pulling images from private registries. breaking_changes: [] chart_version: 1.23.4 - images: ['quay.io/kubescape/kubescape:v3.0.21', 'quay.io/kubescape/kubevuln:v0.3.41', - 'quay.io/kubescape/node-agent:v0.2.197', 'quay.io/kubescape/operator:v0.2.51', - 'quay.io/kubescape/storage:v0.0.141'] + images: + - quay.io/kubescape/kubescape:v3.0.21 + - quay.io/kubescape/kubevuln:v0.3.41 + - quay.io/kubescape/node-agent:v0.2.197 + - quay.io/kubescape/operator:v0.2.51 + - quay.io/kubescape/storage:v0.0.141 - version: 1.23.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Fixed node-agent Service selector so it correctly selects the - intended pods., Fixed inspektor-gadget access to the Kubernetes node proxy - endpoint `api/v1/nodes//proxy/configz`., Release prep/version - bump for kubescape-operator 1.23.0.] + chart_updates: + - Fixed node-agent Service selector so it correctly selects the intended pods. + - Fixed inspektor-gadget access to the Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`. + - Release prep/version bump for kubescape-operator 1.23.0. features: [] breaking_changes: [] chart_version: 1.23.0 - images: ['quay.io/kubescape/kubescape:v3.0.21', 'quay.io/kubescape/kubevuln:v0.3.36', - 'quay.io/kubescape/node-agent:v0.2.178', 'quay.io/kubescape/operator:v0.2.41', - 'quay.io/kubescape/storage:v0.0.137'] + images: + - quay.io/kubescape/kubescape:v3.0.21 + - quay.io/kubescape/kubevuln:v0.3.36 + - quay.io/kubescape/node-agent:v0.2.178 + - quay.io/kubescape/operator:v0.2.41 + - quay.io/kubescape/storage:v0.0.137 - version: 1.22.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Fix prometheus-exporter missing endpoints., Add permissions - to application profile., Add configurable endpoint detection., Add missing - service account to jobs., Bump synchronizer component.] - features: [Configurable endpoint detection was added., Application profile permissions - were extended to support required access.] + chart_updates: + - Fix prometheus-exporter missing endpoints. + - Add permissions to application profile. + - Add configurable endpoint detection. + - Add missing service account to jobs. + - Bump synchronizer component. + features: + - Configurable endpoint detection was added. + - Application profile permissions were extended to support required access. breaking_changes: [] chart_version: 1.22.0 - images: ['quay.io/kubescape/kubescape:v3.0.17', 'quay.io/kubescape/kubevuln:v0.3.33', - 'quay.io/kubescape/node-agent:v0.2.141', 'quay.io/kubescape/operator:v0.2.31', - 'quay.io/kubescape/storage:v0.0.117'] + images: + - quay.io/kubescape/kubescape:v3.0.17 + - quay.io/kubescape/kubevuln:v0.3.33 + - quay.io/kubescape/node-agent:v0.2.141 + - quay.io/kubescape/operator:v0.2.31 + - quay.io/kubescape/storage:v0.0.117 - version: 1.21.0 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [Added standard Kubernetes labels to chart resources (#486)., - Added a new rule to the operator/chart configuration (#489).] - features: [Standardized labels across deployed Kubernetes resources to align - with common labeling conventions., Introduced an additional security/scanning - rule (details not included in the provided notes).] + chart_updates: + - Added standard Kubernetes labels to chart resources (#486). + - Added a new rule to the operator/chart configuration (#489). + features: + - Standardized labels across deployed Kubernetes resources to align with common + labeling conventions. + - Introduced an additional security/scanning rule (details not included in the + provided notes). breaking_changes: [] chart_version: 1.21.0 - images: ['docker.io/bitnami/kubectl:1.30.3', 'quay.io/kubescape/kubescape:v3.0.16', - 'quay.io/kubescape/kubevuln:v0.3.30', 'quay.io/kubescape/node-agent:v0.2.130', - 'quay.io/kubescape/operator:v0.2.28', 'quay.io/kubescape/storage:v0.0.106'] + images: + - docker.io/bitnami/kubectl:1.30.3 + - quay.io/kubescape/kubescape:v3.0.16 + - quay.io/kubescape/kubevuln:v0.3.30 + - quay.io/kubescape/node-agent:v0.2.130 + - quay.io/kubescape/operator:v0.2.28 + - quay.io/kubescape/storage:v0.0.106 - version: 1.20.3 - kube: ['1.31', '1.30', '1.29'] + kube: + - '1.31' + - '1.30' + - '1.29' requirements: [] incompatibilities: [] summary: @@ -30512,41 +41718,58 @@ addons: \ by digest** for `grype-offline-db`. If you previously used custom image\ \ overrides, you may optionally switch to digest pinning for supply-chain\ \ immutability.\n" - chart_updates: ['Node-agent bugfix: resource size limits are now enforced again - for application profiles and network neighbourhoods (fixes prior non-enforcement).', - Updated bundled `docker.io/bitnami/kubectl` image tag from 1.27.6 to 1.30.3., - 'Helm chart enhancement: allow specifying `grype-offline-db` image via tag - or digest.'] - features: ['Ability to reference the `grype-offline-db` image by digest (or - tag), improving flexibility and enabling immutable image pinning.', (Behavioral - fix) Resource size limits for application profiles and network neighbourhoods - are enforced again due to node-agent fix.] + chart_updates: + - 'Node-agent bugfix: resource size limits are now enforced again for application + profiles and network neighbourhoods (fixes prior non-enforcement).' + - Updated bundled `docker.io/bitnami/kubectl` image tag from 1.27.6 to 1.30.3. + - 'Helm chart enhancement: allow specifying `grype-offline-db` image via tag + or digest.' + features: + - Ability to reference the `grype-offline-db` image by digest (or tag), improving + flexibility and enabling immutable image pinning. + - (Behavioral fix) Resource size limits for application profiles and network + neighbourhoods are enforced again due to node-agent fix. breaking_changes: [] chart_version: 1.20.3 - images: ['quay.io/kubescape/kubescape:v3.0.15', 'quay.io/kubescape/kubevuln:v0.3.25', - 'quay.io/kubescape/node-agent:v0.2.109', 'quay.io/kubescape/operator:v0.2.20', - 'quay.io/kubescape/storage:v0.0.90'] + images: + - quay.io/kubescape/kubescape:v3.0.15 + - quay.io/kubescape/kubevuln:v0.3.25 + - quay.io/kubescape/node-agent:v0.2.109 + - quay.io/kubescape/operator:v0.2.20 + - quay.io/kubescape/storage:v0.0.90 - version: 1.20.1 - kube: ['1.30', '1.29', '1.28'] - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [Fixed the include/exclude namespace feature behavior., Added - a `skipKernelVersionCheck` capability to the node-agent., Fixed Harbor image - scanning., Renamed CRDs generated by CronJobs.] - features: [Added `skipKernelVersionCheck` feature to node-agent to allow bypassing - kernel version validation in environments with non-standard or unsupported - kernels.] - breaking_changes: ['CRDs generated by CronJobs were renamed; any existing references, - RBAC rules, scripts, or automation targeting the old CRD names may need - updating and resources may be recreated on upgrade.'] + kube: + - '1.30' + - '1.29' + - '1.28' + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: + - Fixed the include/exclude namespace feature behavior. + - Added a `skipKernelVersionCheck` capability to the node-agent. + - Fixed Harbor image scanning. + - Renamed CRDs generated by CronJobs. + features: + - Added `skipKernelVersionCheck` feature to node-agent to allow bypassing kernel + version validation in environments with non-standard or unsupported kernels. + breaking_changes: + - CRDs generated by CronJobs were renamed; any existing references, RBAC rules, + scripts, or automation targeting the old CRD names may need updating and resources + may be recreated on upgrade. chart_version: 1.20.1 - images: ['quay.io/kubescape/kubescape:v3.0.15', 'quay.io/kubescape/kubevuln:v0.3.25', - 'quay.io/kubescape/node-agent:v0.2.105', 'quay.io/kubescape/operator:v0.2.20', - 'quay.io/kubescape/storage:v0.0.90'] + images: + - quay.io/kubescape/kubescape:v3.0.15 + - quay.io/kubescape/kubevuln:v0.3.25 + - quay.io/kubescape/node-agent:v0.2.105 + - quay.io/kubescape/operator:v0.2.20 + - quay.io/kubescape/storage:v0.0.90 - version: 1.19.1 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: @@ -30564,71 +41787,102 @@ addons: \ - `alertCRD.scopeClustered=true`\n - `nodeAgent.config.prometheusExporter=enable`\n\ \ Re-validate these values are still correct/needed in 1.19.1 and that the\ \ chart hasn\u2019t renamed any keys." - chart_updates: [Release packaging updates for 1.19.1 (chart release prep)., - Chart adds configuration hooks for skipping SSL verification., Chart adds - `imagePullSecrets` wiring for node-agent and servicediscovery.] - features: ['Option to skip SSL verification (useful for environments with intercepting - proxies or custom CAs, but reduces transport security if misused).', Support - for setting imagePullSecrets on node-agent and servicediscovery to pull - from private registries.] + chart_updates: + - Release packaging updates for 1.19.1 (chart release prep). + - Chart adds configuration hooks for skipping SSL verification. + - Chart adds `imagePullSecrets` wiring for node-agent and servicediscovery. + features: + - Option to skip SSL verification (useful for environments with intercepting + proxies or custom CAs, but reduces transport security if misused). + - Support for setting imagePullSecrets on node-agent and servicediscovery to + pull from private registries. breaking_changes: [] chart_version: 1.19.1 - images: ['quay.io/kubescape/kubescape:v3.0.13', 'quay.io/kubescape/kubevuln:v0.3.25', - 'quay.io/kubescape/node-agent:v0.2.93', 'quay.io/kubescape/operator:v0.2.13', - 'quay.io/kubescape/storage:v0.0.89'] + images: + - quay.io/kubescape/kubescape:v3.0.13 + - quay.io/kubescape/kubevuln:v0.3.25 + - quay.io/kubescape/node-agent:v0.2.93 + - quay.io/kubescape/operator:v0.2.13 + - quay.io/kubescape/storage:v0.0.89 - version: 1.18.11 - kube: ['1.30', '1.29', '1.28'] + kube: + - '1.30' + - '1.29' + - '1.28' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Adds beta (release-candidate) rule-based alerting support. Enable - by setting `runtimeDetection` (unexpected file exec/open) and `malwareDetection` - (anti-virus) during install.] + features: + - Adds beta (release-candidate) rule-based alerting support. Enable by setting + `runtimeDetection` (unexpected file exec/open) and `malwareDetection` (anti-virus) + during install. breaking_changes: [] chart_version: 1.18.11 - images: ['quay.io/kubescape/kubescape:v3.0.8', 'quay.io/kubescape/kubevuln:v0.3.14', - 'quay.io/kubescape/node-agent:v0.2.50', 'quay.io/kubescape/operator:v0.2.9', - 'quay.io/kubescape/storage:v0.0.81'] + images: + - quay.io/kubescape/kubescape:v3.0.8 + - quay.io/kubescape/kubevuln:v0.3.14 + - quay.io/kubescape/node-agent:v0.2.50 + - quay.io/kubescape/operator:v0.2.9 + - quay.io/kubescape/storage:v0.0.81 - version: 1.18.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [1.17.0 enables network policy generation., 1.17.0 enables Application - Profiles and exposes them via `kubectl get applicationprofiles -A`., 1.17.0 - makes Application Activities available by default and exposes them via `kubectl - get applicationactivities -A`., 1.17.0 enables the Synchronizer component - for future development work., '1.18.0 switches the internal SBOM format - from SPDX to Syft, which is expected to reduce false positives.'] - breaking_changes: ["1.18.0 SBOM format change (SPDX \u2192 Syft): previously\ - \ collected SBOM-related data is ignored and must be re-collected after\ - \ upgrade; SPDX is no longer supported."] + features: + - 1.17.0 enables network policy generation. + - 1.17.0 enables Application Profiles and exposes them via `kubectl get applicationprofiles + -A`. + - 1.17.0 makes Application Activities available by default and exposes them + via `kubectl get applicationactivities -A`. + - 1.17.0 enables the Synchronizer component for future development work. + - 1.18.0 switches the internal SBOM format from SPDX to Syft, which is expected + to reduce false positives. + breaking_changes: + - "1.18.0 SBOM format change (SPDX \u2192 Syft): previously collected SBOM-related\ + \ data is ignored and must be re-collected after upgrade; SPDX is no longer\ + \ supported." chart_version: 1.18.0 - images: ['quay.io/kubescape/kubescape:v3.0.3', 'quay.io/kubescape/kubevuln:v0.3.0', - 'quay.io/kubescape/node-agent:v0.2.4', 'quay.io/kubescape/operator:v0.2.1', - 'quay.io/kubescape/storage:v0.0.60'] + images: + - quay.io/kubescape/kubescape:v3.0.3 + - quay.io/kubescape/kubevuln:v0.3.0 + - quay.io/kubescape/node-agent:v0.2.4 + - quay.io/kubescape/operator:v0.2.1 + - quay.io/kubescape/storage:v0.0.60 - version: 1.17.0 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ["Release notes provided don\u2019t include Helm chart values/templating\ - \ changes between 1.16.5 and 1.17.0 (the 1.16.5 notes failed to load). Treat\ - \ this as an application-focused upgrade and review the chart diff/`values.yaml`\ - \ between tags before upgrading."] - features: [Application profiles are enabled in 1.17.0., Application activities - are enabled by default., A Synchronizer component is enabled to support - future developments., Automatic generation of NetworkPolicies is enabled.] + chart_updates: + - "Release notes provided don\u2019t include Helm chart values/templating changes\ + \ between 1.16.5 and 1.17.0 (the 1.16.5 notes failed to load). Treat this\ + \ as an application-focused upgrade and review the chart diff/`values.yaml`\ + \ between tags before upgrading." + features: + - Application profiles are enabled in 1.17.0. + - Application activities are enabled by default. + - A Synchronizer component is enabled to support future developments. + - Automatic generation of NetworkPolicies is enabled. breaking_changes: [] chart_version: 1.17.0 images: [] - version: 1.16.5 - kube: ['1.29', '1.28', '1.27'] + kube: + - '1.29' + - '1.28' + - '1.27' requirements: [] incompatibilities: [] summary: @@ -30639,7 +41893,10 @@ addons: chart_version: 1.16.5 images: [] - version: 1.16.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: @@ -30650,22 +41907,31 @@ addons: chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: ['1.28', '1.27', '1.26'] + kube: + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: ['Release notes provided are only the GitHub release metadata - (no changelog entries for values, templates, CRDs, RBAC, or defaults). Cannot - infer chart changes between 0.29.6 and 1.15.0 from this data alone.'] - features: [Not specified in the provided notes (no feature list or commit/changelog - details included).] - breaking_changes: [Not specified in the provided notes (no breaking-change section - or migration guidance included).] + chart_updates: + - Release notes provided are only the GitHub release metadata (no changelog + entries for values, templates, CRDs, RBAC, or defaults). Cannot infer chart + changes between 0.29.6 and 1.15.0 from this data alone. + features: + - Not specified in the provided notes (no feature list or commit/changelog details + included). + breaking_changes: + - Not specified in the provided notes (no breaking-change section or migration + guidance included). chart_version: 1.15.0 images: [] - version: 0.29.6 - kube: ['1.34', '1.33', '1.32'] + kube: + - '1.34' + - '1.33' + - '1.32' requirements: [] incompatibilities: [] summary: null @@ -30678,56 +41944,74 @@ addons: helm_repository_url: https://raw.githubusercontent.com/Dynatrace/dynatrace-operator/main/config/helm/repos/stable versions: - version: 1.8.1 - kube: ['1.35'] + kube: + - '1.35' requirements: [] incompatibilities: [] summary: null chart_version: 1.8.1 images: [] - version: 1.8.0 - kube: ['1.35'] + kube: + - '1.35' requirements: [] incompatibilities: [] summary: null chart_version: 1.8.0 images: [] - version: 1.7.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26'] + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + - '1.27' + - '1.26' requirements: [] incompatibilities: [] summary: null chart_version: 1.7.0 images: [] - version: 1.4.0 - kube: ['1.25'] + kube: + - '1.25' requirements: [] incompatibilities: [] summary: null chart_version: 1.4.0 images: [] - version: 1.3.0 - kube: ['1.24'] + kube: + - '1.24' requirements: [] incompatibilities: [] summary: null chart_version: 1.3.0 images: [] - version: 1.0.0 - kube: ['1.23', '1.22'] + kube: + - '1.23' + - '1.22' requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 images: [] - version: 0.12.0 - kube: ['1.21'] + kube: + - '1.21' requirements: [] incompatibilities: [] summary: null chart_version: 0.12.0 images: [] - version: 0.6.0 - kube: ['1.20', '1.19'] + kube: + - '1.20' + - '1.19' requirements: [] incompatibilities: [] summary: null @@ -30742,24 +42026,34 @@ addons: chart_name: wiz-sensor versions: - version: 1.0.11966 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: [Release package published for wiz-sensor chart/application version - 1.0.11966.] + features: + - Release package published for wiz-sensor chart/application version 1.0.11966. breaking_changes: [] chart_version: 1.0.11966 - images: ['wizio.azurecr.io/sensor:v1'] + images: + - wizio.azurecr.io/sensor:v1 - version: 1.0.3999 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 1.0.3999 - images: ['wizio.azurecr.io/sensor:v1'] + images: + - wizio.azurecr.io/sensor:v1 name: wiz-sensor - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts @@ -30769,119 +42063,195 @@ addons: chart_name: wiz-admission-controller versions: - version: 2.12.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.12.10-preview images: [] - version: 2.12.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.12.10-preview images: [] - version: 2.11.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.12.0-preview.2 images: [] - version: 2.10.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.11.0-preview images: [] - version: 2.9.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.9.4 images: [] - version: 2.8.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.8.0-preview images: [] - version: 2.7.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.7.0-preview - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.7'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.7 - version: 2.6.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.6.0-preview - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.6'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.6 - version: 2.5.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.5.0-alpha - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.5'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.5 - version: 2.4.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.4.0-alpha - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.4'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.4 - version: 2.3.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.1.3 - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.3'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.3 - version: 2.2.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 3.1.0-alpha - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.2'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.2 - version: 2.1.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 2.3.0-alpha - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.1'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.1 - version: 2.0.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2 - version: 1.0.152921 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 images: [] - version: 0.2.119420 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 0.0.11 images: [] - version: 0.0.1 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null @@ -30896,17 +42266,100 @@ addons: chart_name: wiz-network-analyzer versions: - version: 0.1.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: ['wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1 - version: 0.1.0 - kube: ['1.37', '1.36', '1.35', '1.34'] + kube: + - '1.37' + - '1.36' + - '1.35' + - '1.34' requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: ['wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1'] + images: + - wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1 name: wiz-network-analyzer +- icon: https://helm.elastic.co/icons/eck.png + git_url: https://github.com/elastic/cloud-on-k8s + release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} + helm_repository_url: https://helm.elastic.co + versions: + - version: 3.5.0 + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + chart_version: 3.5.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.4.1 + kube: + - '1.36' + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + chart_version: 3.4.1 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.3.2 + kube: + - '1.35' + - '1.34' + - '1.33' + - '1.32' + - '1.31' + chart_version: 3.3.2 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.2.0 + kube: + - '1.34' + - '1.33' + - '1.32' + - '1.31' + - '1.30' + chart_version: 3.2.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.1.0 + kube: + - '1.33' + - '1.32' + - '1.31' + - '1.30' + - '1.29' + chart_version: 3.1.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.0.0 + kube: + - '1.32' + - '1.31' + - '1.30' + - '1.29' + - '1.28' + chart_version: 3.0.0 + requirements: [] + incompatibilities: [] + summary: null + name: eck-operator From b93cb4a59ec16edffd26acdf3c131efaeef2afe6 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:29:55 +0100 Subject: [PATCH 08/17] chore: regenerate ECK aggregate with repo formatter --- .../workflows/eck-regenerate-aggregate.yml | 43 ++++++++++++------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/.github/workflows/eck-regenerate-aggregate.yml b/.github/workflows/eck-regenerate-aggregate.yml index d95a1e7853..7256f445c8 100644 --- a/.github/workflows/eck-regenerate-aggregate.yml +++ b/.github/workflows/eck-regenerate-aggregate.yml @@ -14,30 +14,43 @@ jobs: regenerate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout feature branch + uses: actions/checkout@v6 with: ref: feat/eck-operator-compatibility - - uses: actions/setup-python@v6 + + - name: Set up Python + uses: actions/setup-python@v6 with: python-version: '3.13' - - run: pip install pyyaml - - name: Regenerate aggregate + + - name: Install compatibility utility dependencies + run: python -m pip install PyYAML==6.0.2 requests==2.33.0 semantic-version==2.10.0 colorama==0.4.6 packaging==24.1 + + - name: Regenerate aggregate with repository formatter + working-directory: utils/compatibility run: | python - <<'PY' - import yaml - from pathlib import Path - - aggregate_path = Path('static/compatibilities.yaml') - addon_path = Path('static/compatibilities/eck-operator.yaml') - aggregate = yaml.safe_load(aggregate_path.read_text()) or {'addons': []} - addon = yaml.safe_load(addon_path.read_text()) - addon['name'] = 'eck-operator' - aggregate['addons'] = [a for a in aggregate.get('addons', []) if a.get('name') != 'eck-operator'] - aggregate['addons'].append(addon) - aggregate_path.write_text(yaml.dump(aggregate, default_flow_style=False, sort_keys=False)) + import utils + + manifest = utils.read_yaml('../../static/compatibilities/manifest.yaml') + if not manifest or not manifest.get('names'): + raise SystemExit('compatibility manifest is empty') + + addons = [] + for name in manifest['names']: + addon = utils.read_yaml(f'../../static/compatibilities/{name}.yaml') + if not addon: + raise SystemExit(f'missing compatibility data for {name}') + addons.append(addon) + + if not utils.write_yaml('../../static/compatibilities.yaml', {'addons': addons}): + raise SystemExit('failed to write aggregate compatibility matrix') PY + - name: Commit aggregate run: | + git diff --check git config user.name 'github-actions[bot]' git config user.email '41898282+github-actions[bot]@users.noreply.github.com' git add static/compatibilities.yaml From 105b4380cae49c0dbd71380dd3a69678cc4da3b5 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:30:16 +0100 Subject: [PATCH 09/17] ci: remove temporary aggregate workflow --- .../workflows/eck-regenerate-aggregate.yml | 59 ------------------- 1 file changed, 59 deletions(-) delete mode 100644 .github/workflows/eck-regenerate-aggregate.yml diff --git a/.github/workflows/eck-regenerate-aggregate.yml b/.github/workflows/eck-regenerate-aggregate.yml deleted file mode 100644 index 7256f445c8..0000000000 --- a/.github/workflows/eck-regenerate-aggregate.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Regenerate ECK compatibility aggregate - -on: - push: - branches: - - feat/eck-operator-compatibility - paths: - - '.github/workflows/eck-regenerate-aggregate.yml' - -permissions: - contents: write - -jobs: - regenerate: - runs-on: ubuntu-latest - steps: - - name: Checkout feature branch - uses: actions/checkout@v6 - with: - ref: feat/eck-operator-compatibility - - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: '3.13' - - - name: Install compatibility utility dependencies - run: python -m pip install PyYAML==6.0.2 requests==2.33.0 semantic-version==2.10.0 colorama==0.4.6 packaging==24.1 - - - name: Regenerate aggregate with repository formatter - working-directory: utils/compatibility - run: | - python - <<'PY' - import utils - - manifest = utils.read_yaml('../../static/compatibilities/manifest.yaml') - if not manifest or not manifest.get('names'): - raise SystemExit('compatibility manifest is empty') - - addons = [] - for name in manifest['names']: - addon = utils.read_yaml(f'../../static/compatibilities/{name}.yaml') - if not addon: - raise SystemExit(f'missing compatibility data for {name}') - addons.append(addon) - - if not utils.write_yaml('../../static/compatibilities.yaml', {'addons': addons}): - raise SystemExit('failed to write aggregate compatibility matrix') - PY - - - name: Commit aggregate - run: | - git diff --check - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add static/compatibilities.yaml - git diff --cached --quiet && exit 0 - git commit -m 'chore: regenerate compatibility aggregate for ECK' - git push origin HEAD:feat/eck-operator-compatibility From 65369c85d256430466a1760dfc63479067409fd9 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:31:16 +0100 Subject: [PATCH 10/17] ci: regenerate ECK aggregate with repo formatter --- .../workflows/eck-regenerate-aggregate.yml | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/eck-regenerate-aggregate.yml diff --git a/.github/workflows/eck-regenerate-aggregate.yml b/.github/workflows/eck-regenerate-aggregate.yml new file mode 100644 index 0000000000..7256f445c8 --- /dev/null +++ b/.github/workflows/eck-regenerate-aggregate.yml @@ -0,0 +1,59 @@ +name: Regenerate ECK compatibility aggregate + +on: + push: + branches: + - feat/eck-operator-compatibility + paths: + - '.github/workflows/eck-regenerate-aggregate.yml' + +permissions: + contents: write + +jobs: + regenerate: + runs-on: ubuntu-latest + steps: + - name: Checkout feature branch + uses: actions/checkout@v6 + with: + ref: feat/eck-operator-compatibility + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.13' + + - name: Install compatibility utility dependencies + run: python -m pip install PyYAML==6.0.2 requests==2.33.0 semantic-version==2.10.0 colorama==0.4.6 packaging==24.1 + + - name: Regenerate aggregate with repository formatter + working-directory: utils/compatibility + run: | + python - <<'PY' + import utils + + manifest = utils.read_yaml('../../static/compatibilities/manifest.yaml') + if not manifest or not manifest.get('names'): + raise SystemExit('compatibility manifest is empty') + + addons = [] + for name in manifest['names']: + addon = utils.read_yaml(f'../../static/compatibilities/{name}.yaml') + if not addon: + raise SystemExit(f'missing compatibility data for {name}') + addons.append(addon) + + if not utils.write_yaml('../../static/compatibilities.yaml', {'addons': addons}): + raise SystemExit('failed to write aggregate compatibility matrix') + PY + + - name: Commit aggregate + run: | + git diff --check + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add static/compatibilities.yaml + git diff --cached --quiet && exit 0 + git commit -m 'chore: regenerate compatibility aggregate for ECK' + git push origin HEAD:feat/eck-operator-compatibility From 265111cfecc4007028cca35245b591d0709732cf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:31:33 +0000 Subject: [PATCH 11/17] chore: regenerate compatibility aggregate for ECK --- static/compatibilities.yaml | 40322 ++++++++++++---------------------- 1 file changed, 14438 insertions(+), 25884 deletions(-) diff --git a/static/compatibilities.yaml b/static/compatibilities.yaml index 46ebf66b78..128f7d644b 100644 --- a/static/compatibilities.yaml +++ b/static/compatibilities.yaml @@ -5,1785 +5,953 @@ addons: readme_url: https://github.com/kubevirt/sig-release/blob/main/releases/k8s-support-matrix.md versions: - version: 1.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null - version: 1.8.4 - kube: - - '1.35' - - '1.34' + kube: ['1.35', '1.34'] requirements: [] incompatibilities: [] summary: null - version: 1.7.4 - kube: - - '1.34' + kube: ['1.34'] requirements: [] incompatibilities: [] summary: null - version: 1.6.6 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null - version: 1.5.3 - kube: - - '1.32' - - '1.31' + kube: ['1.32', '1.31'] requirements: [] incompatibilities: [] summary: null - version: 1.4.1 - kube: - - '1.31' + kube: ['1.31'] requirements: [] incompatibilities: [] summary: null - name: kubevirt - icon: https://avatars.githubusercontent.com/u/30269780?s=200&v=4 git_url: https://github.com/argoproj/argo-rollouts release_url: https://github.com/argoproj/argo-rollouts/releases/tag/v{vsn} helm_repository_url: https://argoproj.github.io/argo-helm versions: - version: 1.8.3 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No Helm chart changelog was provided in the notes you pasted (only application\ - \ GitHub release notes). Treat this as an application-only summary; verify\ - \ the Helm chart version you\u2019ll deploy and diff `values.yaml` separately." - features: - - 'Prometheus metric provider: adds range query support, enabling analyses over - a time range instead of single-point queries.' - - 'Analysis/New Relic: can now set a timeout and the provider returns the resolved - query as metadata (useful for debugging/traceability).' - - 'Datadog metric provider: supports multi-account configurations and adds support - for providing credentials to download plugins.' - - 'Controller: adds an (alpha) canary steps plugin mechanism for extending canary - step behavior.' - - 'Controller: canary ingress support allows specifying full annotations for - nginx canary ingresses (more flexibility for NGINX users).' - - 'Controller: enables pprof profiling support for debugging performance issues.' - - 'Analysis: adds ConsecutiveSuccessLimit to Analysis (lets you require N consecutive - successful measurements).' - - 'Metrics/observability: new Prometheus `build_info` metric is emitted.' + kube: ['1.34', '1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No Helm chart changelog was provided in the notes you pasted\ + \ (only application GitHub release notes). Treat this as an application-only\ + \ summary; verify the Helm chart version you\u2019ll deploy and diff `values.yaml`\ + \ separately."] + features: ['Prometheus metric provider: adds range query support, enabling analyses + over a time range instead of single-point queries.', 'Analysis/New Relic: + can now set a timeout and the provider returns the resolved query as metadata + (useful for debugging/traceability).', 'Datadog metric provider: supports + multi-account configurations and adds support for providing credentials + to download plugins.', 'Controller: adds an (alpha) canary steps plugin + mechanism for extending canary step behavior.', 'Controller: canary ingress + support allows specifying full annotations for nginx canary ingresses (more + flexibility for NGINX users).', 'Controller: enables pprof profiling support + for debugging performance issues.', 'Analysis: adds ConsecutiveSuccessLimit + to Analysis (lets you require N consecutive successful measurements).', + 'Metrics/observability: new Prometheus `build_info` metric is emitted.'] breaking_changes: [] chart_version: 2.40.5 - images: - - quay.io/argoproj/argo-rollouts:v1.8.3 + images: ['quay.io/argoproj/argo-rollouts:v1.8.3'] - version: 1.8.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Prometheus metric provider: adds Prometheus range query support for Analysis - metrics (enables querying over a time window instead of only instant queries).' - - 'Controller: introduces an (alpha) canary steps plugin mechanism, allowing - canary step behavior/logic to be extended via plugins.' - - 'Controller: allows specifying full annotations for NGINX canary ingresses - (not just limited/filtered subsets).' - - 'Metrics/Analysis providers: expands New Relic provider (adds timeout support - and returns resolved queries as metadata) and adds multi-account support for - Datadog metrics provider; also adds support for providing credentials to download - metric provider plugins.' - - 'Observability: adds pprof profiling support in the controller for performance - troubleshooting.' - - 'Monitoring: adds a new Prometheus build_info metric to expose version/build - metadata.' + kube: ['1.31', '1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Prometheus metric provider: adds Prometheus range query support + for Analysis metrics (enables querying over a time window instead of only + instant queries).', 'Controller: introduces an (alpha) canary steps plugin + mechanism, allowing canary step behavior/logic to be extended via plugins.', + 'Controller: allows specifying full annotations for NGINX canary ingresses + (not just limited/filtered subsets).', 'Metrics/Analysis providers: expands + New Relic provider (adds timeout support and returns resolved queries as + metadata) and adds multi-account support for Datadog metrics provider; also + adds support for providing credentials to download metric provider plugins.', + 'Observability: adds pprof profiling support in the controller for performance + troubleshooting.', 'Monitoring: adds a new Prometheus build_info metric + to expose version/build metadata.'] breaking_changes: [] chart_version: 2.39.1 - images: - - quay.io/argoproj/argo-rollouts:v1.8.0 + images: ['quay.io/argoproj/argo-rollouts:v1.8.0'] - version: 1.7.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Support multiple ALB ingresses for ALB traffic routing (useful when a rollout - needs to manage traffic across more than one ALB resource). - - 'Prometheus metric provider enhancements: configurable request timeout, optional - TLS verification disable (insecure), and support for custom HTTP headers when - querying Prometheus.' - - 'AnalysisRun/AnalysisTemplate enhancements: support custom metadata on AnalysisRun, - allow setting job metadata via metrics.provider.job.metadata, include Rollout - selector MatchLabels in generated AnalysisRuns, and add a merge key to AnalysisTemplate.' - - 'UI/UX: refreshed Rollouts dashboard.' - - 'Events/notifications: controller can emit Kubernetes events on informer add; - adds self-service notification support.' - breaking_changes: - - No explicit breaking changes were called out in the provided notes for v1.7.0; - however, verify any custom traffic router plugins and ALB configuration fields - against your current manifests because several ALB-related behaviors changed - in 1.7.0. + kube: ['1.29', '1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Support multiple ALB ingresses for ALB traffic routing (useful when + a rollout needs to manage traffic across more than one ALB resource)., 'Prometheus + metric provider enhancements: configurable request timeout, optional TLS + verification disable (insecure), and support for custom HTTP headers when + querying Prometheus.', 'AnalysisRun/AnalysisTemplate enhancements: support + custom metadata on AnalysisRun, allow setting job metadata via metrics.provider.job.metadata, + include Rollout selector MatchLabels in generated AnalysisRuns, and add + a merge key to AnalysisTemplate.', 'UI/UX: refreshed Rollouts dashboard.', + 'Events/notifications: controller can emit Kubernetes events on informer add; + adds self-service notification support.'] + breaking_changes: ['No explicit breaking changes were called out in the provided + notes for v1.7.0; however, verify any custom traffic router plugins and + ALB configuration fields against your current manifests because several + ALB-related behaviors changed in 1.7.0.'] chart_version: 2.36.0 - images: - - quay.io/argoproj/argo-rollouts:v1.7.0 + images: ['quay.io/argoproj/argo-rollouts:v1.7.0'] - version: 1.6.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No Helm chart changelog/values information was provided in the notes you\ - \ pasted (these are Argo Rollouts *application* release notes). Treat the\ - \ Helm upgrade as potentially requiring chart value review (RBAC, container\ - \ args, extraVolumes/extraArgs, dashboard/service) but confirm against the\ - \ chart\u2019s own CHANGELOG/values.yaml for the versions you\u2019re moving\ - \ between." - features: - - Dashboard UI refresh in v1.6.0 improves Rollouts dashboard look/UX. - - AnalysisRun supports custom metadata, plus additional context/merge behavior - (e.g., merge key) to help manage metric/analysis configuration. - - 'Prometheus metric provider enhancements: configurable timeout, optional insecure - TLS, and support for custom HTTP headers.' - - 'Traffic routing/ingress improvements: support multiple ALB ingresses and - retain TLS config for NGINX canary ingresses; additional docs/plugins for - routers like Contour and guidance for other ingress controllers.' - - 'Operational/observability improvements: controller emits additional Kubernetes - events and logging improvements (klog/logrus bridge).' - breaking_changes: - - Traffic router plugin naming pattern was standardized/changed; if you use - trafficrouter plugins (or custom plugins), verify plugin names/identifiers - and update any references accordingly. + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No Helm chart changelog/values information was provided in\ + \ the notes you pasted (these are Argo Rollouts *application* release notes).\ + \ Treat the Helm upgrade as potentially requiring chart value review (RBAC,\ + \ container args, extraVolumes/extraArgs, dashboard/service) but confirm\ + \ against the chart\u2019s own CHANGELOG/values.yaml for the versions you\u2019\ + re moving between."] + features: [Dashboard UI refresh in v1.6.0 improves Rollouts dashboard look/UX., + 'AnalysisRun supports custom metadata, plus additional context/merge behavior + (e.g., merge key) to help manage metric/analysis configuration.', 'Prometheus + metric provider enhancements: configurable timeout, optional insecure TLS, + and support for custom HTTP headers.', 'Traffic routing/ingress improvements: + support multiple ALB ingresses and retain TLS config for NGINX canary ingresses; + additional docs/plugins for routers like Contour and guidance for other + ingress controllers.', 'Operational/observability improvements: controller + emits additional Kubernetes events and logging improvements (klog/logrus + bridge).'] + breaking_changes: ['Traffic router plugin naming pattern was standardized/changed; + if you use trafficrouter plugins (or custom plugins), verify plugin names/identifiers + and update any references accordingly.'] chart_version: 2.32.0 - images: - - quay.io/argoproj/argo-rollouts:v1.6.0 + images: ['quay.io/argoproj/argo-rollouts:v1.6.0'] - version: 1.2.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No Helm chart changelog was provided in the notes; summary below covers application/controller\ - \ changes only. If you are upgrading via Helm, also review the chart\u2019\ - s own CHANGELOG/values for your chart version bump (image tag, CRDs install/upgrade\ - \ behavior, RBAC, ServiceAccount, leaderElection settings, ingress apiVersion\ - \ handling)." - features: - - HA (active-passive) leader election support for rollouts-controller, enabling - higher availability controller deployments. - - Networking.k8s.io/v1 Ingress support (Kubernetes v1.22+), improving compatibility - with newer clusters. - - "Analysis \u201Cdry-run\u201D mode (also for experiments), allowing you to\ - \ validate analysis definitions without enforcing failures." - - Support for weighted experiment steps and richer experiment traffic routing - behavior. - - Ping-pong service management to simplify blue/green-style service swapping - patterns. - - Customizable metric/measurement retention limits for AnalysisRuns/metrics, - improving resource usage control. - - AWS App Mesh traffic routing support as an additional provider. - - Support for multiple traffic routing providers simultaneously via multiple - TrafficRoutingReconcilers. - - Web metric providers now support POST/PUT requests (not just GET), enabling - more flexible integrations. - - Additional metadata surfaced from analysis providers (useful for debugging) - and Argo Rollouts version exported on the /metrics endpoint. - - Scalability/performance improvements including higher default Kubernetes client - QPS/Burst (and making them tunable). - breaking_changes: - - Canary rollout calculation/approximation behavior was changed to improve accuracy - and to honor maxSurge (marked as a breaking fix in the release notes). This - can change how many pods are created at each step compared to v1.1, so watch - capacity and rollout pacing during the first upgrades. + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No Helm chart changelog was provided in the notes; summary\ + \ below covers application/controller changes only. If you are upgrading\ + \ via Helm, also review the chart\u2019s own CHANGELOG/values for your chart\ + \ version bump (image tag, CRDs install/upgrade behavior, RBAC, ServiceAccount,\ + \ leaderElection settings, ingress apiVersion handling)."] + features: ['HA (active-passive) leader election support for rollouts-controller, + enabling higher availability controller deployments.', 'Networking.k8s.io/v1 + Ingress support (Kubernetes v1.22+), improving compatibility with newer + clusters.', "Analysis \u201Cdry-run\u201D mode (also for experiments), allowing\ + \ you to validate analysis definitions without enforcing failures.", Support + for weighted experiment steps and richer experiment traffic routing behavior., + Ping-pong service management to simplify blue/green-style service swapping + patterns., 'Customizable metric/measurement retention limits for AnalysisRuns/metrics, + improving resource usage control.', AWS App Mesh traffic routing support + as an additional provider., Support for multiple traffic routing providers + simultaneously via multiple TrafficRoutingReconcilers., 'Web metric providers + now support POST/PUT requests (not just GET), enabling more flexible integrations.', + Additional metadata surfaced from analysis providers (useful for debugging) + and Argo Rollouts version exported on the /metrics endpoint., Scalability/performance + improvements including higher default Kubernetes client QPS/Burst (and making + them tunable).] + breaking_changes: ['Canary rollout calculation/approximation behavior was changed + to improve accuracy and to honor maxSurge (marked as a breaking fix in the + release notes). This can change how many pods are created at each step compared + to v1.1, so watch capacity and rollout pacing during the first upgrades.'] chart_version: 2.12.0 - images: - - quay.io/argoproj/argo-rollouts:v1.2.0 + images: ['quay.io/argoproj/argo-rollouts:v1.2.0'] - version: 1.1.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: - - quay.io/argoproj/argo-rollouts:v1.1.0 - name: argo-rollouts + images: ['quay.io/argoproj/argo-rollouts:v1.1.0'] - icon: https://kubernetes.io/images/blog-logging/2018-04-10-container-storage-interface-beta/csi-logo.png git_url: https://github.com/kubernetes-sigs/aws-ebs-csi-driver release_url: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/tag/v{vsn} helm_repository_url: https://kubernetes-sigs.github.io/aws-ebs-csi-driver versions: - version: 1.65.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific features are listed in the provided v1.65.0 release notes snippet; - it only links to the upstream CHANGELOG for details. - breaking_changes: - - No breaking changes are listed in the provided v1.65.0 release notes snippet; - you need to review the upstream CHANGELOG for any behavior/config changes - between v1.64.0 and v1.65.0. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific features are listed in the provided v1.65.0 release notes + snippet; it only links to the upstream CHANGELOG for details.] + breaking_changes: [No breaking changes are listed in the provided v1.65.0 release + notes snippet; you need to review the upstream CHANGELOG for any behavior/config + changes between v1.64.0 and v1.65.0.] chart_version: 2.65.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.7 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.7 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.6 - - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.5 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.7 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.65.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.7', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.7', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.6', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.5', + 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.7', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.65.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master'] - version: 1.64.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature details provided in the supplied release notes for v1.64.0; - they only point to the upstream CHANGELOG.md. - breaking_changes: - - No breaking changes are mentioned in the supplied release notes; details (if - any) would be in the upstream CHANGELOG.md. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature details provided in the supplied release notes + for v1.64.0; they only point to the upstream CHANGELOG.md.] + breaking_changes: [No breaking changes are mentioned in the supplied release + notes; details (if any) would be in the upstream CHANGELOG.md.] chart_version: 2.64.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.64.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.64.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260817-81577dc432-master'] - version: 1.63.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not enumerate changes; both versions only link to - the upstream CHANGELOG. - breaking_changes: - - Unknown from provided notes; need to review upstream CHANGELOG between v1.62.0 - and v1.63.0 (and Helm chart changelog, if using the Helm chart) to confirm - any breaking changes. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not enumerate changes; both versions only + link to the upstream CHANGELOG.] + breaking_changes: ['Unknown from provided notes; need to review upstream CHANGELOG + between v1.62.0 and v1.63.0 (and Helm chart changelog, if using the Helm + chart) to confirm any breaking changes.'] chart_version: 2.63.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.1 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.3 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.63.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260720-39d457d26c-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.2.1-eksbuild.1', + 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.63.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260720-39d457d26c-master'] - version: 1.62.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not include any v1.62.0 change entries beyond a - link to the full CHANGELOG; no specific new features can be extracted from - the text shared. - breaking_changes: - - No breaking changes are mentioned in the provided release notes; full upstream - CHANGELOG must be reviewed to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not include any v1.62.0 change entries + beyond a link to the full CHANGELOG; no specific new features can be extracted + from the text shared.] + breaking_changes: [No breaking changes are mentioned in the provided release + notes; full upstream CHANGELOG must be reviewed to confirm.] chart_version: 2.62.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1 - - public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.62.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260615-b4199512ce-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1', 'public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2', + 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.62.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260615-b4199512ce-master'] - version: 1.61.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided contain no detailed changes; both versions point to - the repository CHANGELOG for details. - breaking_changes: - - No breaking changes are described in the provided release notes; must review - the upstream CHANGELOG between v1.60.0 and v1.61.1 to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided contain no detailed changes; both versions + point to the repository CHANGELOG for details.] + breaking_changes: [No breaking changes are described in the provided release + notes; must review the upstream CHANGELOG between v1.60.0 and v1.61.1 to + confirm.] chart_version: 2.61.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7 - - public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.61.1 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260601-2cbf4bdb47-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.12.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7', 'public.ecr.aws/csi-components/csi-resizer:v2.2.0-eksbuild.2', + 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.61.1', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260601-2cbf4bdb47-master'] - version: 1.60.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include any itemized changes; v1.60.0 points\ - \ to the upstream CHANGELOG for details." - breaking_changes: - - No breaking changes are stated in the provided release notes; need the upstream - CHANGELOG diff between v1.59.0 and v1.60.0 to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include any itemized changes;\ + \ v1.60.0 points to the upstream CHANGELOG for details."] + breaking_changes: [No breaking changes are stated in the provided release notes; + need the upstream CHANGELOG diff between v1.59.0 and v1.60.0 to confirm.] chart_version: 2.60.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.5 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.60.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260512-1f34ef0df3-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.5', + 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.60.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260512-1f34ef0df3-master'] - version: 1.59.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific features were included in the provided v1.59.0 release note excerpt; - it only links to the upstream CHANGELOG for details. - breaking_changes: - - No breaking changes were listed in the provided release note excerpt; you - must review the upstream CHANGELOG between v1.58.0 and v1.59.0 to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific features were included in the provided v1.59.0 release + note excerpt; it only links to the upstream CHANGELOG for details.] + breaking_changes: [No breaking changes were listed in the provided release note + excerpt; you must review the upstream CHANGELOG between v1.58.0 and v1.59.0 + to confirm.] chart_version: 2.59.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.59.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260414-5a49ebcf1f-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.59.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260414-5a49ebcf1f-master'] - version: 1.58.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature details provided in the supplied release notes for v1.58.0 - (only a link to the upstream CHANGELOG). - breaking_changes: - - No breaking change details provided in the supplied release notes for v1.58.0 - (only a link to the upstream CHANGELOG). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature details provided in the supplied release notes + for v1.58.0 (only a link to the upstream CHANGELOG).] + breaking_changes: [No breaking change details provided in the supplied release + notes for v1.58.0 (only a link to the upstream CHANGELOG).] chart_version: 2.58.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.58.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.58.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master'] - version: 1.57.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes between v1.56.0\ - \ and v1.57.1; they only point to the upstream CHANGELOG. No concrete new\ - \ features can be derived from the supplied text." - breaking_changes: - - No breaking changes are listed in the provided release notes; they only reference - the upstream CHANGELOG, so breaking changes (if any) cannot be confirmed from - the supplied data. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include itemized changes between\ + \ v1.56.0 and v1.57.1; they only point to the upstream CHANGELOG. No concrete\ + \ new features can be derived from the supplied text."] + breaking_changes: ['No breaking changes are listed in the provided release notes; + they only reference the upstream CHANGELOG, so breaking changes (if any) + cannot be confirmed from the supplied data.'] chart_version: 2.57.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.57.1 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.57.1', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260316-e86cefa561-master'] - version: 1.56.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific v1.56.0 features provided in the supplied notes; release notes - only link to the upstream CHANGELOG. - breaking_changes: - - No breaking changes identified from the provided notes; must review the upstream - CHANGELOG for v1.56.0 to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific v1.56.0 features provided in the supplied notes; release + notes only link to the upstream CHANGELOG.] + breaking_changes: [No breaking changes identified from the provided notes; must + review the upstream CHANGELOG for v1.56.0 to confirm.] chart_version: 2.56.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.1 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.1 - - public.ecr.aws/csi-components/csi-provisioner:v6.1.1-eksbuild.1 - - public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.1 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.1 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.56.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260217-29ba10ecec-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.11.0-eksbuild.1', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.1', + 'public.ecr.aws/csi-components/csi-provisioner:v6.1.1-eksbuild.1', 'public.ecr.aws/csi-components/csi-resizer:v2.1.0-eksbuild.1', + 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.1', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.56.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260217-29ba10ecec-master'] - version: 1.55.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t list specific changes; both versions point\ - \ to the upstream CHANGELOG for details." - breaking_changes: - - "Cannot determine breaking changes from the provided notes because the detailed\ - \ CHANGELOG content wasn\u2019t included." + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t list specific changes; both versions\ + \ point to the upstream CHANGELOG for details."] + breaking_changes: ["Cannot determine breaking changes from the provided notes\ + \ because the detailed CHANGELOG content wasn\u2019t included."] chart_version: 2.55.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.4 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.55.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260120-e2c483ffe9-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.55.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260120-e2c483ffe9-master'] - version: 1.54.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not include detailed changes; both versions point - to the upstream CHANGELOG for the full list of changes. - breaking_changes: - - Potential breaking changes cannot be determined from the provided notes because - no detailed changelog entries were included. Review the upstream CHANGELOG - between v1.53.0 and v1.54.0 before upgrading. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not include detailed changes; both versions + point to the upstream CHANGELOG for the full list of changes.] + breaking_changes: [Potential breaking changes cannot be determined from the + provided notes because no detailed changelog entries were included. Review + the upstream CHANGELOG between v1.53.0 and v1.54.0 before upgrading.] chart_version: 2.54.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.54.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251209-855adc2699-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v2.0.0-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.54.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251209-855adc2699-master'] - version: 1.53.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature details provided in the supplied release notes for v1.53.0; - consult the project CHANGELOG.md between v1.52.0 and v1.53.0 for the actual - set of enhancements. - breaking_changes: - - No breaking changes were listed in the supplied release notes; verify in CHANGELOG.md - and the Helm chart changelog before upgrading. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature details provided in the supplied release notes + for v1.53.0; consult the project CHANGELOG.md between v1.52.0 and v1.53.0 + for the actual set of enhancements.] + breaking_changes: [No breaking changes were listed in the supplied release notes; + verify in CHANGELOG.md and the Helm chart changelog before upgrading.] chart_version: 2.53.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.5 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.53.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251021-e2c2c9806f-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.10.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.53.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20251021-e2c2c9806f-master'] - version: 1.52.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature notes were included in the provided release notes; they - only reference the upstream CHANGELOG for details. - breaking_changes: - - "No breaking-change information was included in the provided release notes;\ - \ you\u2019ll need to review the upstream CHANGELOG for v1.52.0 to confirm." + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature notes were included in the provided release notes; + they only reference the upstream CHANGELOG for details.] + breaking_changes: ["No breaking-change information was included in the provided\ + \ release notes; you\u2019ll need to review the upstream CHANGELOG for v1.52.0\ + \ to confirm."] chart_version: 2.52.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.52.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.52.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] - version: 1.51.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not enumerate changes; both versions only link to - the upstream CHANGELOG without details. - breaking_changes: - - Unknown from provided notes; no breaking changes listed in the release notes - excerpt (must consult upstream CHANGELOG for confirmation). + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not enumerate changes; both versions only + link to the upstream CHANGELOG without details.] + breaking_changes: [Unknown from provided notes; no breaking changes listed in + the release notes excerpt (must consult upstream CHANGELOG for confirmation).] chart_version: 2.51.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.51.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.51.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] - version: 1.50.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes; only point to\ - \ the upstream CHANGELOG.md. No new features can be reliably extracted from\ - \ the provided text." - breaking_changes: - - No breaking changes are stated in the provided release notes; need the linked - CHANGELOG.md or Helm chart changelog to assess potential breaking changes. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include itemized changes; only\ + \ point to the upstream CHANGELOG.md. No new features can be reliably extracted\ + \ from the provided text."] + breaking_changes: [No breaking changes are stated in the provided release notes; + need the linked CHANGELOG.md or Helm chart changelog to assess potential + breaking changes.] chart_version: 2.50.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.50.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.50.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250925-95b5a2c7a5-master'] - version: 1.49.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No feature details were provided in the supplied release notes; both v1.48.0 - and v1.49.0 entries only link to the project CHANGELOG. - breaking_changes: - - No breaking-change details were provided in the supplied release notes; review - the upstream CHANGELOG for v1.49.0 and any intervening commits. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No feature details were provided in the supplied release notes; both + v1.48.0 and v1.49.0 entries only link to the project CHANGELOG.] + breaking_changes: [No breaking-change details were provided in the supplied + release notes; review the upstream CHANGELOG for v1.49.0 and any intervening + commits.] chart_version: 2.49.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.49.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250905-c89b045f57-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.49.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250905-c89b045f57-master'] - version: 1.48.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific changes are included in the provided release notes beyond pointers - to the full CHANGELOG for v1.48.0. - breaking_changes: - - No breaking changes are stated in the provided release notes; you must consult - the upstream CHANGELOG for v1.48.0 vs v1.47.0 to confirm. + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific changes are included in the provided release notes beyond + pointers to the full CHANGELOG for v1.48.0.] + breaking_changes: [No breaking changes are stated in the provided release notes; + you must consult the upstream CHANGELOG for v1.48.0 vs v1.47.0 to confirm.] chart_version: 2.48.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.48.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250815-171060767f-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.48.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250815-171060767f-master'] - version: 1.47.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature details were provided in the supplied release notes for - v1.47.0 (they only link to the main CHANGELOG). - breaking_changes: - - No breaking-change details were provided in the supplied release notes for - v1.47.0 (they only link to the main CHANGELOG). + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature details were provided in the supplied release + notes for v1.47.0 (they only link to the main CHANGELOG).] + breaking_changes: [No breaking-change details were provided in the supplied + release notes for v1.47.0 (they only link to the main CHANGELOG).] chart_version: 2.47.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.47.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250722-31ecdfb417-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.47.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250722-31ecdfb417-master'] - version: 1.46.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific changes were provided in the supplied release notes; they only - link to the upstream CHANGELOG.md. - breaking_changes: - - No breaking changes were described in the supplied release notes; review the - upstream CHANGELOG.md between v1.45.0 and v1.46.0 to confirm. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific changes were provided in the supplied release notes; + they only link to the upstream CHANGELOG.md.] + breaking_changes: [No breaking changes were described in the supplied release + notes; review the upstream CHANGELOG.md between v1.45.0 and v1.46.0 to confirm.] chart_version: 2.46.0 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.46.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.3', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.3', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.4', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.46.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master'] - version: 1.45.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No concrete feature details provided in the pasted release notes; both v1.44.0 - and v1.45.0 notes only point to the upstream CHANGELOG. - breaking_changes: - - No breaking changes can be identified from the provided notes; the release - notes contain no change details beyond a link to CHANGELOG. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No concrete feature details provided in the pasted release notes; + both v1.44.0 and v1.45.0 notes only point to the upstream CHANGELOG.] + breaking_changes: [No breaking changes can be identified from the provided notes; + the release notes contain no change details beyond a link to CHANGELOG.] chart_version: 2.45.1 - images: - - public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.2 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.3 - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.45.0 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master + images: ['public.ecr.aws/csi-components/csi-attacher:v4.9.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.2', 'public.ecr.aws/csi-components/csi-resizer:v1.14.0-eksbuild.2', + 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.3', 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.45.0', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250613-876fb90a97-master'] - version: 1.44.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific features are listed in the provided release notes for v1.44.0; - both v1.43.0 and v1.44.0 entries only point to the upstream CHANGELOG for - details. - breaking_changes: - - No breaking changes are called out in the provided release notes; you must - review the linked upstream CHANGELOG between v1.43.0 and v1.44.0 to confirm. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific features are listed in the provided release notes for + v1.44.0; both v1.43.0 and v1.44.0 entries only point to the upstream CHANGELOG + for details.] + breaking_changes: [No breaking changes are called out in the provided release + notes; you must review the linked upstream CHANGELOG between v1.43.0 and + v1.44.0 to confirm.] chart_version: 2.44.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.44.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-3 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-3 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-3 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-3 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250513-98d205aae3-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.44.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-3', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250513-98d205aae3-master'] - version: 1.43.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided only link to the upstream CHANGELOG; no specific v1.43.0 - changes are included here, so features cannot be reliably summarized from - the supplied text. - breaking_changes: - - No breaking changes are mentioned in the provided release notes; need to consult - the linked CHANGELOG for v1.43.0 vs v1.42.0 details. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Release notes provided only link to the upstream CHANGELOG; no specific + v1.43.0 changes are included here, so features cannot be reliably summarized + from the supplied text.'] + breaking_changes: [No breaking changes are mentioned in the provided release + notes; need to consult the linked CHANGELOG for v1.43.0 vs v1.42.0 details.] chart_version: 2.43.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.43.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.43.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master'] - version: 1.42.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes; v1.42.0 points\ - \ to the upstream CHANGELOG for details." - breaking_changes: - - No breaking changes are listed in the provided notes; need the linked CHANGELOG - (or Helm chart changelog) to verify. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include itemized changes; v1.42.0\ + \ points to the upstream CHANGELOG for details."] + breaking_changes: [No breaking changes are listed in the provided notes; need + the linked CHANGELOG (or Helm chart changelog) to verify.] chart_version: 2.42.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.42.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.42.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-1', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250411-0688312353-master'] - version: 1.41.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific feature details were included in the provided release notes; both - v1.40.0 and v1.41.0 notes only reference the repository CHANGELOG link. - breaking_changes: - - No breaking changes were listed in the provided release notes; need to consult - the upstream CHANGELOG between v1.40.0 and v1.41.0 to confirm. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific feature details were included in the provided release + notes; both v1.40.0 and v1.41.0 notes only reference the repository CHANGELOG + link.] + breaking_changes: [No breaking changes were listed in the provided release notes; + need to consult the upstream CHANGELOG between v1.40.0 and v1.41.0 to confirm.] chart_version: 2.41.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.41.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-32-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-32-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-7 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250311-73aac21714-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.41.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.1-eks-1-32-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.2-eks-1-32-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-7', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250311-73aac21714-master'] - version: 1.40.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided contain no itemized changes between v1.39.0 and v1.40.0 - (they only link to the upstream CHANGELOG). - breaking_changes: - - No breaking changes are stated in the provided release notes; consult the - upstream CHANGELOG for v1.40.0 details before upgrading. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided contain no itemized changes between v1.39.0 + and v1.40.0 (they only link to the upstream CHANGELOG).] + breaking_changes: [No breaking changes are stated in the provided release notes; + consult the upstream CHANGELOG for v1.40.0 details before upgrading.] chart_version: 2.40.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.40.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-32-6 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-6 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.1-eks-1-32-6 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-6 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250212-686cf422c6-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.40.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-32-6', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-6', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.13.1-eks-1-32-6', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-6', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20250212-686cf422c6-master'] - version: 1.39.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes for v1.39.0\u2014\ - only a pointer to the upstream CHANGELOG, so no concrete new features can\ - \ be confirmed from the supplied text." - breaking_changes: - - No breaking changes are listed in the provided notes; need the actual v1.39.0 - CHANGELOG diff to verify. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include itemized changes for v1.39.0\u2014\ + only a pointer to the upstream CHANGELOG, so no concrete new features can\ + \ be confirmed from the supplied text."] + breaking_changes: [No breaking changes are listed in the provided notes; need + the actual v1.39.0 CHANGELOG diff to verify.] chart_version: 2.39.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.39.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-31-12 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-12 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-11 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-12 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-31-12 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241230-3006692a6f-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.39.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.8.0-eks-1-31-12', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-12', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-11', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-12', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-31-12', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241230-3006692a6f-master'] - version: 1.38.1 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes between v1.37.0\ - \ and v1.38.1 (they only point to the upstream CHANGELOG)." - breaking_changes: - - Unknown from the provided notes; must review the upstream CHANGELOG entries - for v1.38.1 (and intermediate tags) to identify any breaking changes. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include itemized changes between\ + \ v1.37.0 and v1.38.1 (they only point to the upstream CHANGELOG)."] + breaking_changes: [Unknown from the provided notes; must review the upstream + CHANGELOG entries for v1.38.1 (and intermediate tags) to identify any breaking + changes.] chart_version: 2.38.1 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.38.1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-32-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-32-1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-32-1 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-32-1 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241128-8df65c072f-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.38.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-32-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-32-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-32-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-32-1', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241128-8df65c072f-master'] - version: 1.37.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t enumerate changes between v1.36.0 and v1.37.0;\ - \ both point to the upstream CHANGELOG for details." - breaking_changes: - - No breaking changes can be identified from the provided notes; you must consult - the upstream CHANGELOG for v1.37.0 to confirm. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t enumerate changes between v1.36.0\ + \ and v1.37.0; both point to the upstream CHANGELOG for details."] + breaking_changes: [No breaking changes can be identified from the provided notes; + you must consult the upstream CHANGELOG for v1.37.0 to confirm.] chart_version: 2.37.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.37.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-7 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241021-d3a4913879-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.37.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-7', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241021-d3a4913879-master'] - version: 1.36.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific features are listed in the provided release notes; both versions - point to the project CHANGELOG for details. - breaking_changes: - - No breaking changes are listed in the provided release notes; you must consult - the upstream CHANGELOG between v1.35.0 and v1.36.0 to confirm. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific features are listed in the provided release notes; both + versions point to the project CHANGELOG for details.] + breaking_changes: [No breaking changes are listed in the provided release notes; + you must consult the upstream CHANGELOG between v1.35.0 and v1.36.0 to confirm.] chart_version: 2.36.0 - images: - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.36.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 - - us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241011-e8871c079d-master + images: ['public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.36.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5', + 'us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20241011-e8871c079d-master'] - version: 1.35.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include detailed change items beyond a\ - \ pointer to the upstream CHANGELOG; no specific features can be derived from\ - \ the text shared." - breaking_changes: - - "Release notes provided don\u2019t list any breaking changes; need to review\ - \ the linked CHANGELOG between v1.34.0 and v1.35.0 to confirm." + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include detailed change items\ + \ beyond a pointer to the upstream CHANGELOG; no specific features can be\ + \ derived from the text shared."] + breaking_changes: ["Release notes provided don\u2019t list any breaking changes;\ + \ need to review the linked CHANGELOG between v1.34.0 and v1.35.0 to confirm."] chart_version: 2.35.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240903-6a352c5344-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.35.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-3 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-3 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-3 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-3 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-3 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240903-6a352c5344-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.35.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-31-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-31-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-3', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-3'] - version: 1.34.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided only link to the full CHANGELOG; no feature-level details - are included in the supplied notes for v1.34.0. - breaking_changes: - - No breaking changes are stated in the provided release notes; must review - upstream CHANGELOG for any upgrade-impacting changes between v1.33.0 and v1.34.0. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided only link to the full CHANGELOG; no feature-level + details are included in the supplied notes for v1.34.0.] + breaking_changes: [No breaking changes are stated in the provided release notes; + must review upstream CHANGELOG for any upgrade-impacting changes between + v1.33.0 and v1.34.0.] chart_version: 2.34.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240803-cf1183f2db-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.34.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240803-cf1183f2db-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.34.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10'] - version: 1.33.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided only link to the full CHANGELOG; no specific feature - items were included in the notes you shared, so features for 1.33.0 vs 1.32.0 - cannot be determined from this input. - breaking_changes: - - No breaking changes are mentioned in the provided release notes; the notes - only point to the upstream CHANGELOG, so breaking changes (if any) cannot - be confirmed from this input. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Release notes provided only link to the full CHANGELOG; no specific + feature items were included in the notes you shared, so features for 1.33.0 + vs 1.32.0 cannot be determined from this input.'] + breaking_changes: ['No breaking changes are mentioned in the provided release + notes; the notes only point to the upstream CHANGELOG, so breaking changes + (if any) cannot be confirmed from this input.'] chart_version: 2.33.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240705-131cd74733-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.33.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240705-131cd74733-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.33.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-10', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-10'] - version: 1.32.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided only link to the upstream CHANGELOG; no concrete feature - list included in the supplied notes. - breaking_changes: - - No breaking changes were described in the supplied release notes; need to - consult the upstream CHANGELOG for v1.32.0 details. + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided only link to the upstream CHANGELOG; no concrete + feature list included in the supplied notes.] + breaking_changes: [No breaking changes were described in the supplied release + notes; need to consult the upstream CHANGELOG for v1.32.0 details.] chart_version: 2.32.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240611-597c402033-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.32.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-8 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-8 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-8 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-8 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-8 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240611-597c402033-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.32.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.6.1-eks-1-30-8', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.0.1-eks-1-30-8', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.11.1-eks-1-30-8', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.13.0-eks-1-30-8', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.11.0-eks-1-30-8'] - version: 1.31.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No substantive v1.31.0 release notes were provided beyond a pointer to the - full CHANGELOG; expect mostly incremental fixes/maintenance since v1.30.0 - was the major feature release in your notes. + features: [No substantive v1.31.0 release notes were provided beyond a pointer + to the full CHANGELOG; expect mostly incremental fixes/maintenance since + v1.30.0 was the major feature release in your notes.] breaking_changes: [] chart_version: 2.31.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.31.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-4 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-4 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-4 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-4 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-4 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.31.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-4'] - version: 1.30.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Retry Manager to reduce EC2 API RateLimitExceeded errors during high churn/scale - events. - - Prometheus metrics endpoint can be served over HTTPS by providing a certificate. - - 'Improved node drain behavior: supports Cluster Autoscaler taint and prestop - hook now handles deleted Node objects to avoid ~6 minute attachment delays.' - - Migrated AWS interactions to AWS SDK for Go v2 for continued support and newer - SDK features. - - Batch polling for DescribeVolumesModifications across volume modify/expand - paths to reduce non-mutating API token limit issues at scale. - - Refactored node service to be platform-agnostic, improving modularity, testability, - and code coverage. - - Improved configuration management and internal architecture (entrypoint/controller/cloud - module relationships). - - Added explicit AttachVolume call during attachment-state polling to handle - EC2 eventual consistency mismatches. - breaking_changes: - - Migration to AWS SDK for Go v2 may change behavior of AWS credential/config - resolution and retry semantics; validate IAM/IRSA, endpoints, and any custom - AWS config assumptions before/after upgrade. + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Retry Manager to reduce EC2 API RateLimitExceeded errors during high + churn/scale events., Prometheus metrics endpoint can be served over HTTPS + by providing a certificate., 'Improved node drain behavior: supports Cluster + Autoscaler taint and prestop hook now handles deleted Node objects to avoid + ~6 minute attachment delays.', Migrated AWS interactions to AWS SDK for + Go v2 for continued support and newer SDK features., Batch polling for DescribeVolumesModifications + across volume modify/expand paths to reduce non-mutating API token limit + issues at scale., 'Refactored node service to be platform-agnostic, improving + modularity, testability, and code coverage.', Improved configuration management + and internal architecture (entrypoint/controller/cloud module relationships)., + Added explicit AttachVolume call during attachment-state polling to handle + EC2 eventual consistency mismatches.] + breaking_changes: ['Migration to AWS SDK for Go v2 may change behavior of AWS + credential/config resolution and retry semantics; validate IAM/IRSA, endpoints, + and any custom AWS config assumptions before/after upgrade.'] chart_version: 2.30.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.30.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-2 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-2 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-2 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.30.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.1-eks-1-30-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.1-eks-1-30-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.1-eks-1-30-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-30-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.1-eks-1-30-2'] - version: 1.29.1 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - No specific changes listed in the provided release notes; both v1.29.0 and - v1.29.1 entries only link to the main CHANGELOG without details. - breaking_changes: - - No breaking changes identified from the provided release notes (no details - included). + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [No specific changes listed in the provided release notes; both v1.29.0 + and v1.29.1 entries only link to the main CHANGELOG without details.] + breaking_changes: [No breaking changes identified from the provided release + notes (no details included).] chart_version: 2.29.1 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] - version: 1.29.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not include specific changes; both v1.28.0 and v1.29.0 - point to the repository CHANGELOG for details. No concrete features can be - derived from the pasted notes alone. - breaking_changes: - - No breaking changes are mentioned in the provided release notes; need the - linked CHANGELOG (and Helm chart changelog/values diff) to assess potential - breaking changes. + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not include specific changes; both v1.28.0 + and v1.29.0 point to the repository CHANGELOG for details. No concrete features + can be derived from the pasted notes alone.] + breaking_changes: [No breaking changes are mentioned in the provided release + notes; need the linked CHANGELOG (and Helm chart changelog/values diff) + to assess potential breaking changes.] chart_version: 2.29.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20240311-b09cdeb92c-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.29.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] - version: 1.28.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', + '1.20'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided don\u2019t include specific changes; both versions\ - \ only link to the upstream CHANGELOG. No concrete feature list can be derived\ - \ from the text provided." - breaking_changes: - - Unknown from the provided release notes; need to review the upstream CHANGELOG - entries between v1.26.1 and v1.28.0 to confirm any breaking changes. + features: ["Release notes provided don\u2019t include specific changes; both\ + \ versions only link to the upstream CHANGELOG. No concrete feature list\ + \ can be derived from the text provided."] + breaking_changes: [Unknown from the provided release notes; need to review the + upstream CHANGELOG entries between v1.26.1 and v1.28.0 to confirm any breaking + changes.] chart_version: 2.28.0 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.28.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-5 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-5 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-5 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-5 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-5 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.28.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.5.0-eks-1-29-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.10.0-eks-1-29-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-5'] - version: 1.26.1 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided only include links to the upstream CHANGELOG for both - v1.23.1 and v1.26.1; no specific features are listed in the provided text. - breaking_changes: - - No breaking changes are called out in the provided release notes; you must - review the upstream CHANGELOG between v1.23.1 and v1.26.1 to confirm. + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided only include links to the upstream CHANGELOG + for both v1.23.1 and v1.26.1; no specific features are listed in the provided + text.] + breaking_changes: [No breaking changes are called out in the provided release + notes; you must review the upstream CHANGELOG between v1.23.1 and v1.26.1 + to confirm.] chart_version: 2.26.1 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.26.1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.3-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.3-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2 + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20231206-f7b83ffbe6-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.26.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.3-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.3-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2'] - version: 1.23.1 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', + '1.20'] requirements: [] incompatibilities: [] summary: null chart_version: 2.23.1 - images: - - gcr.io/k8s-staging-test-infra/kubekins-e2e:v20230727-ea685f8747-master - - public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.3.0-eks-1-28-4 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-4 - - public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4 - name: aws-ebs-csi-driver + images: ['gcr.io/k8s-staging-test-infra/kubekins-e2e:v20230727-ea685f8747-master', + 'public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.3.0-eks-1-28-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4'] - icon: https://cdn.worldvectorlogo.com/logos/amazon-elastic-file-system.svg git_url: https://github.com/kubernetes-sigs/aws-efs-csi-driver release_url: https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v{vsn} @@ -1796,18 +964,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided don\u2019t list specific changes; both versions only\ - \ point to the project CHANGELOG for details." - breaking_changes: - - No breaking changes are called out in the provided release notes; consult - CHANGELOG-3.x.md for any upgrade-impacting changes between v3.4.0 and v3.4.2. + features: ["Release notes provided don\u2019t list specific changes; both versions\ + \ only point to the project CHANGELOG for details."] + breaking_changes: [No breaking changes are called out in the provided release + notes; consult CHANGELOG-3.x.md for any upgrade-impacting changes between + v3.4.0 and v3.4.2.] chart_version: 4.4.2 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.2 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.4', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.5', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.2'] - version: 3.4.0 kube: [] requirements: [] @@ -1815,18 +980,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided don\u2019t list specific changes; v3.4.0 points to\ - \ the upstream CHANGELOG-3.x.md for details." - breaking_changes: - - No breaking changes are stated in the provided notes; need to review CHANGELOG-3.x.md - between v3.3.0 and v3.4.0 to confirm. + features: ["Release notes provided don\u2019t list specific changes; v3.4.0\ + \ points to the upstream CHANGELOG-3.x.md for details."] + breaking_changes: [No breaking changes are stated in the provided notes; need + to review CHANGELOG-3.x.md between v3.3.0 and v3.4.0 to confirm.] chart_version: 4.4.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v6.3.0-eksbuild.1', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.4.0'] - version: 3.3.0 kube: [] requirements: [] @@ -1834,18 +995,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No concrete feature details provided in the supplied release notes; v3.3.0 - points to the upstream CHANGELOG for the actual list of changes. - breaking_changes: - - No breaking-change information provided in the supplied release notes; must - review CHANGELOG-3.x.md between v3.2.0 and v3.3.0 to confirm. + features: [No concrete feature details provided in the supplied release notes; + v3.3.0 points to the upstream CHANGELOG for the actual list of changes.] + breaking_changes: [No breaking-change information provided in the supplied release + notes; must review CHANGELOG-3.x.md between v3.2.0 and v3.3.0 to confirm.] chart_version: 4.3.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7 - - public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.3.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.17.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.7', 'public.ecr.aws/csi-components/livenessprobe:v2.19.0-eksbuild.2', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.3.0'] - version: 3.2.0 kube: [] requirements: [] @@ -1853,18 +1010,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No specific feature details were included in the provided release notes; both - versions only point to the upstream CHANGELOG-3.x.md. - breaking_changes: - - No breaking changes were listed in the provided release notes; need to review - CHANGELOG-3.x.md and the Helm chart changelog for v3.2.0 to confirm. + features: [No specific feature details were included in the provided release + notes; both versions only point to the upstream CHANGELOG-3.x.md.] + breaking_changes: [No breaking changes were listed in the provided release notes; + need to review CHANGELOG-3.x.md and the Helm chart changelog for v3.2.0 + to confirm.] chart_version: 4.2.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.2.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.2.0'] - version: 3.1.0 kube: [] requirements: [] @@ -1872,18 +1026,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided do not enumerate changes; v3.1.0 points to the CHANGELOG-3.x.md - for details. - breaking_changes: - - No breaking changes are listed in the provided release notes; must review - CHANGELOG-3.x.md between v3.0.0 and v3.1.0 to confirm. + features: [Release notes provided do not enumerate changes; v3.1.0 points to + the CHANGELOG-3.x.md for details.] + breaking_changes: [No breaking changes are listed in the provided release notes; + must review CHANGELOG-3.x.md between v3.0.0 and v3.1.0 to confirm.] chart_version: 4.1.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4 - - public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3 - - public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.1.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.4', + 'public.ecr.aws/csi-components/csi-provisioner:v6.2.0-eksbuild.3', 'public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.4', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.1.0'] - version: 3.0.0 kube: [] requirements: [] @@ -1891,20 +1041,16 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided only link to external CHANGELOG files for v3.x and - v2.x; no specific feature items were included in the supplied text, so features - cannot be enumerated from the given data. - breaking_changes: - - Upgrade to major version v3.0.0 likely implies breaking changes, but none - are specified in the provided release-note excerpts; consult CHANGELOG-3.x.md - for explicit breaking changes before upgrading. + features: ['Release notes provided only link to external CHANGELOG files for + v3.x and v2.x; no specific feature items were included in the supplied text, + so features cannot be enumerated from the given data.'] + breaking_changes: ['Upgrade to major version v3.0.0 likely implies breaking + changes, but none are specified in the provided release-note excerpts; consult + CHANGELOG-3.x.md for explicit breaking changes before upgrading.'] chart_version: 4.0.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.0.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v3.0.0'] - version: 2.3.0 kube: [] requirements: [] @@ -1912,274 +1058,130 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided don\u2019t include itemized changes for v2.3.0; they\ - \ only point to the upstream CHANGELOG-2.x.md. No specific new features were\ - \ listed in the notes you shared." - breaking_changes: - - No breaking changes were listed in the provided release notes; need to consult - CHANGELOG-2.x.md between v2.2.0 and v2.3.0 to confirm. + features: ["Release notes provided don\u2019t include itemized changes for v2.3.0;\ + \ they only point to the upstream CHANGELOG-2.x.md. No specific new features\ + \ were listed in the notes you shared."] + breaking_changes: [No breaking changes were listed in the provided release notes; + need to consult CHANGELOG-2.x.md between v2.2.0 and v2.3.0 to confirm.] chart_version: 3.4.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3 - - public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.3.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.3', + 'public.ecr.aws/csi-components/csi-provisioner:v6.1.0-eksbuild.2', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.3', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.3.0'] - version: 2.2.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include the actual v2.2.0 changelog items;\ - \ only a pointer to CHANGELOG-2.x.md. No concrete new features can be derived\ - \ from the pasted text." - breaking_changes: - - No breaking changes are listed in the provided notes; need the actual entries - from CHANGELOG-2.x.md (between v2.1.2 and v2.2.0) or the Helm chart changelog - to confirm. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', + '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include the actual v2.2.0 changelog\ + \ items; only a pointer to CHANGELOG-2.x.md. No concrete new features can\ + \ be derived from the pasted text."] + breaking_changes: [No breaking changes are listed in the provided notes; need + the actual entries from CHANGELOG-2.x.md (between v2.1.2 and v2.2.0) or + the Helm chart changelog to confirm.] chart_version: 3.3.0 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5 - - public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.2.0 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.15.0-eksbuild.2', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.5', 'public.ecr.aws/csi-components/livenessprobe:v2.17.0-eksbuild.2', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.2.0'] - version: 2.1.12 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include any concrete changes; they only\ - \ reference the upstream CHANGELOG-2.x.md for details." - breaking_changes: - - Unknown from the provided notes; the release text contains no breaking-change - information and points to the full changelog for specifics. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', + '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include any concrete changes;\ + \ they only reference the upstream CHANGELOG-2.x.md for details."] + breaking_changes: [Unknown from the provided notes; the release text contains + no breaking-change information and points to the full changelog for specifics.] chart_version: 3.2.3 - images: - - public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5 - - public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4 - - public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5 - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.12 + images: ['public.ecr.aws/csi-components/csi-node-driver-registrar:v2.14.0-eksbuild.5', + 'public.ecr.aws/csi-components/csi-provisioner:v5.3.0-eksbuild.4', 'public.ecr.aws/csi-components/livenessprobe:v2.16.0-eksbuild.5', + 'public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.12'] - version: 2.1.2 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes for v2.1.2 do not enumerate changes; they only point to the - upstream CHANGELOG-2.x.md for details. - breaking_changes: - - None stated in the provided notes; treat as unknown until you review the linked - CHANGELOG-2.x.md. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes for v2.1.2 do not enumerate changes; they only point + to the upstream CHANGELOG-2.x.md for details.] + breaking_changes: [None stated in the provided notes; treat as unknown until + you review the linked CHANGELOG-2.x.md.] chart_version: 3.1.3 - images: - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 + images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.2', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5'] - version: 2.1.1 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include change details; both versions defer\ - \ to the upstream CHANGELOG-2.x.md. No concrete features can be confirmed\ - \ from the supplied text." - breaking_changes: - - No breaking changes are listed in the provided release notes; both versions - only link to the full changelog. Treat breaking-change status as unknown until - reviewing CHANGELOG-2.x.md between v2.0.2 and v2.1.1. + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include change details; both versions\ + \ defer to the upstream CHANGELOG-2.x.md. No concrete features can be confirmed\ + \ from the supplied text."] + breaking_changes: [No breaking changes are listed in the provided release notes; + both versions only link to the full changelog. Treat breaking-change status + as unknown until reviewing CHANGELOG-2.x.md between v2.0.2 and v2.1.1.] chart_version: 3.1.2 - images: - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.1 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5 + images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.1', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-31-5', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-31-5'] - version: 2.0.2 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Release notes provided don\u2019t include detailed changes between 2.0.0\ - \ and 2.0.2; v2.0.2 points to the 2.x changelog for the actual list of fixes/features." - breaking_changes: - - No breaking changes are stated in the provided notes; you must review CHANGELOG-2.x.md - and the Helm chart changelog/values for any breaking changes before upgrading. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Release notes provided don\u2019t include detailed changes between\ + \ 2.0.0 and 2.0.2; v2.0.2 points to the 2.x changelog for the actual list\ + \ of fixes/features."] + breaking_changes: [No breaking changes are stated in the provided notes; you + must review CHANGELOG-2.x.md and the Helm chart changelog/values for any + breaking changes before upgrading.] chart_version: 3.0.3 - images: - - public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.0.2 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 + images: ['public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.0.2', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] - version: 2.0.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Release notes provided do not include any detailed change items; both versions - only link to the 1.x changelog. - breaking_changes: - - Potential breaking changes may exist between 1.7.4 and 2.0.0, but none are - listed in the provided notes; you must consult the v2.0.0 changelog/release - documentation before upgrading. + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Release notes provided do not include any detailed change items; + both versions only link to the 1.x changelog.] + breaking_changes: ['Potential breaking changes may exist between 1.7.4 and 2.0.0, + but none are listed in the provided notes; you must consult the v2.0.0 changelog/release + documentation before upgrading.'] chart_version: 3.0.0 - images: - - amazon/aws-efs-csi-driver:v2.0.0 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7 + images: ['amazon/aws-efs-csi-driver:v2.0.0', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v4.0.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.12.0-eks-1-29-7', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.10.0-eks-1-29-7'] - version: 1.7.4 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null chart_version: 2.5.4 - images: - - amazon/aws-efs-csi-driver:v1.7.4 - - public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2 - - public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2 - name: aws-efs-csi-driver + images: ['amazon/aws-efs-csi-driver:v1.7.4', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2', + 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2'] - icon: https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/e5d625f96415fd44e6399e9c75e2bd985f5a2288/docs/assets/images/aws_load_balancer_icon.svg git_url: https://github.com/kubernetes-sigs/aws-load-balancer-controller release_url: https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v{vsn} @@ -2188,25 +1190,8 @@ addons: chart_name: aws-load-balancer-controller versions: - version: 3.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2224,108 +1209,63 @@ addons: \ set explicitly if you rely on certificate automation behavior).\n- Comment-only:\ \ Helm values comment corrected for `enableEndpointSlices` default (no functional\ \ change implied)." - chart_updates: - - Gateway API support and conformance aligned to **Gateway API v1.6.0**; L4 - routes (TCPRoute/UDPRoute) now use stable `gateway.networking.k8s.io/v1`. - - LBC-specific Gateway CRDs now use `gateway.k8s.aws/v1` as **storage version**; - `v1beta1` is deprecated but transparently converted by the apiserver for now. - - 'Networking improvements: EndpointSlice registration filtered by IP family; - hosted zone lookup matches longest suffix; dualstack subnet autodiscovery - fix; ICMP constants fix; feature gates rendered as parseable key=value pairs.' - - 'Route precedence refactor: unified precedence across HTTPRoute/GRPCRoute; - fixes non-transitive precedence issues.' - - Certificate management fix for wildcard-host ACM cert creation; adds certificate - list support for ECDSA/RSA (per notes). - - Go module path changed to `sigs.k8s.io/aws-load-balancer-controller/v3` (relevant - only if you import the controller as a library). - features: - - Gateway API L4 routes graduate to stable `gateway.networking.k8s.io/v1` with - conformance against Gateway API v1.6.0. - - 'Certificate management enhancements: wildcard-host ingress ACM issuance fix - and support for ECDSA/RSA certificate list handling.' - - Ingress-to-Gateway migration tooling introduced in 3.4.0 (lbc-migrate CLI - + in-cluster migration console) to enable non-disruptive parallel ALB stacks - during migration. - breaking_changes: - - '**Gateway API CRD requirement:** controller v3.5.0 requires **Gateway API - CRDs v1.6.0**; upgrading controller first will disable NLB Gateway L4 routing - until CRDs are updated, and any `v1alpha2` route manifests must move to `v1`.' - - '**LBC Gateway CRDs:** storage version is now `gateway.k8s.aws/v1`; `v1beta1` - is deprecated and will stop being served in a future release (plan to update - manifests).' - - "(From 3.4.0) **NLB Gateway behavior change:** only one L4 route per listener\ - \ serves traffic; when multiple attach to the same listener, only the oldest\ - \ continues after upgrade\u2014consolidate routes to avoid traffic loss." + chart_updates: [Gateway API support and conformance aligned to **Gateway API + v1.6.0**; L4 routes (TCPRoute/UDPRoute) now use stable `gateway.networking.k8s.io/v1`., + LBC-specific Gateway CRDs now use `gateway.k8s.aws/v1` as **storage version**; + `v1beta1` is deprecated but transparently converted by the apiserver for + now., 'Networking improvements: EndpointSlice registration filtered by IP + family; hosted zone lookup matches longest suffix; dualstack subnet autodiscovery + fix; ICMP constants fix; feature gates rendered as parseable key=value pairs.', + 'Route precedence refactor: unified precedence across HTTPRoute/GRPCRoute; + fixes non-transitive precedence issues.', Certificate management fix for + wildcard-host ACM cert creation; adds certificate list support for ECDSA/RSA + (per notes)., Go module path changed to `sigs.k8s.io/aws-load-balancer-controller/v3` + (relevant only if you import the controller as a library).] + features: [Gateway API L4 routes graduate to stable `gateway.networking.k8s.io/v1` + with conformance against Gateway API v1.6.0., 'Certificate management enhancements: + wildcard-host ingress ACM issuance fix and support for ECDSA/RSA certificate + list handling.', Ingress-to-Gateway migration tooling introduced in 3.4.0 + (lbc-migrate CLI + in-cluster migration console) to enable non-disruptive + parallel ALB stacks during migration.] + breaking_changes: ['**Gateway API CRD requirement:** controller v3.5.0 requires + **Gateway API CRDs v1.6.0**; upgrading controller first will disable NLB + Gateway L4 routing until CRDs are updated, and any `v1alpha2` route manifests + must move to `v1`.', '**LBC Gateway CRDs:** storage version is now `gateway.k8s.aws/v1`; + `v1beta1` is deprecated and will stop being served in a future release (plan + to update manifests).', "(From 3.4.0) **NLB Gateway behavior change:** only\ + \ one L4 route per listener serves traffic; when multiple attach to the\ + \ same listener, only the oldest continues after upgrade\u2014consolidate\ + \ routes to avoid traffic loss."] chart_version: 3.5.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.5.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.5.0'] - version: 3.4.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No Helm chart-specific change notes were provided in the supplied release\ - \ notes for v3.4.0; treat this as an application/controller upgrade (image\ - \ tag bump) unless the chart changelog you\u2019re using says otherwise." - - v3.3.0 noted CRD update steps via the eks-charts CRD kustomize path and additional - Gateway API CRDs; for 3.4.0, assume those prerequisites still apply if you - use those features and re-apply CRDs as part of the upgrade runbook. - features: - - "Ingress\u2192Gateway Migration Tooling: new `lbc-migrate` CLI to translate\ - \ Ingress manifests (including annotations and IngressGroups) into equivalent\ - \ Gateway API YAML, with cluster/file/dir inputs and optional per-namespace\ - \ output splitting." - - 'Migration Console: an in-cluster web UI to compare AWS resources produced - by Ingress vs Gateway controllers field-by-field to validate parity before - cutover.' - breaking_changes: - - "Gateway API (NLB Gateway) behavior change: only one L4 route (TCP/UDP/TLS)\ - \ per listener will receive traffic; if multiple routes attach to the same\ - \ listener, only the oldest route will be served after upgrade\u2014consolidate\ - \ to a single route per listener." + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No Helm chart-specific change notes were provided in the supplied\ + \ release notes for v3.4.0; treat this as an application/controller upgrade\ + \ (image tag bump) unless the chart changelog you\u2019re using says otherwise.", + 'v3.3.0 noted CRD update steps via the eks-charts CRD kustomize path and additional + Gateway API CRDs; for 3.4.0, assume those prerequisites still apply if you + use those features and re-apply CRDs as part of the upgrade runbook.'] + features: ["Ingress\u2192Gateway Migration Tooling: new `lbc-migrate` CLI to\ + \ translate Ingress manifests (including annotations and IngressGroups)\ + \ into equivalent Gateway API YAML, with cluster/file/dir inputs and optional\ + \ per-namespace output splitting.", 'Migration Console: an in-cluster web + UI to compare AWS resources produced by Ingress vs Gateway controllers field-by-field + to validate parity before cutover.'] + breaking_changes: ["Gateway API (NLB Gateway) behavior change: only one L4 route\ + \ (TCP/UDP/TLS) per listener will receive traffic; if multiple routes attach\ + \ to the same listener, only the oldest route will be served after upgrade\u2014\ + consolidate to a single route per listener."] chart_version: 3.4.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0'] - version: 3.3.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2347,47 +1287,25 @@ addons: - **Feature gates / flags**:\n - To use the new cert feature: `--feature-gates=EnableCertificateManagement=true`\ \ plus ingress annotation `create-acm-cert: \"true\"`.\n - Gateway API auto-detection\ \ continues; feature flags still exist to disable if needed.\n" - chart_updates: - - Gateway API auto-detection improvements and **LBC-specific CRD handling in - Helm** (behavioral improvements around detecting/handling CRDs). - - Helm **ClusterRole RBAC sync** is automated from kubebuilder (RBAC manifest - generation change). - features: - - 'ACM Certificate Management (feature-gated): controller can create/manage - ACM certificates from Ingress hostnames, supporting Amazon-issued DNS validation - via Route53 and private certs via AWS Private CA.' - - 'Gateway API: improved auto-detection behavior and Helm handling around LBC-specific - Gateway CRDs.' - breaking_changes: - - No explicit breaking changes called out for v3.3.0 vs v3.2.x, but enabling - `EnableCertificateManagement` without updating IAM will cause reconciliation - failures for certificate creation/validation. - - "Gateway API CRD install instructions include a potential **version mismatch**\ - \ for experimental CRDs; applying incompatible CRDs could break NLB Gateway/TLSRoute\ - \ behavior\u2014validate CRD versions before upgrading." + chart_updates: [Gateway API auto-detection improvements and **LBC-specific CRD + handling in Helm** (behavioral improvements around detecting/handling CRDs)., + Helm **ClusterRole RBAC sync** is automated from kubebuilder (RBAC manifest + generation change).] + features: ['ACM Certificate Management (feature-gated): controller can create/manage + ACM certificates from Ingress hostnames, supporting Amazon-issued DNS validation + via Route53 and private certs via AWS Private CA.', 'Gateway API: improved + auto-detection behavior and Helm handling around LBC-specific Gateway CRDs.'] + breaking_changes: ['No explicit breaking changes called out for v3.3.0 vs v3.2.x, + but enabling `EnableCertificateManagement` without updating IAM will cause + reconciliation failures for certificate creation/validation.', "Gateway\ + \ API CRD install instructions include a potential **version mismatch**\ + \ for experimental CRDs; applying incompatible CRDs could break NLB Gateway/TLSRoute\ + \ behavior\u2014validate CRD versions before upgrading."] chart_version: 3.3.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0'] - version: 3.2.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2410,51 +1328,28 @@ addons: \ Ensure your Helm `extraArgs` no longer depends on it. Also, VPC lookup behavior\ \ changed: **all** tags in `--aws-vpc-tags` are now used as filters (can be\ \ breaking if your VPC only matches a subset)." - chart_updates: - - Exposes additional controller concurrency/max-concurrency flags through the - Helm chart (previously not all were configurable). - - Adds Helm values to configure namespace selectors for the Service and Ingress - validating/mutating webhooks. - - "Carries forward improved webhook cert handling introduced in v3.1.0 (notably\ - \ `keepTLSSecret`)\u2014ensure your chart values align with your certificate\ - \ management approach." - features: - - Gateway API upgraded to v1.5.0, including new resources like ListenerSet and - improved Gateway functionality. - - Gateway API resources are now auto-detected (feature flags no longer required - to enable; flags remain to disable). - - Ingress adds a new annotation for Frontend NLB attributes to tune NLB behavior - via Ingress. - breaking_changes: - - Gateway API moves from v1.3 to v1.5; for NLB Gateway users, TLSRoute is now - served in v1 (not alpha). To avoid downtime, install the experimental TLSRoute - CRD during upgrade as recommended. - - VPC tag lookup now requires *all* tags in `--aws-vpc-tags` to match; previously - a partial match might have worked. `--aws-vpc-tag-key` is deprecated/ignored, - so update flags/tags accordingly. + chart_updates: [Exposes additional controller concurrency/max-concurrency flags + through the Helm chart (previously not all were configurable)., Adds Helm + values to configure namespace selectors for the Service and Ingress validating/mutating + webhooks., "Carries forward improved webhook cert handling introduced in\ + \ v3.1.0 (notably `keepTLSSecret`)\u2014ensure your chart values align with\ + \ your certificate management approach."] + features: ['Gateway API upgraded to v1.5.0, including new resources like ListenerSet + and improved Gateway functionality.', Gateway API resources are now auto-detected + (feature flags no longer required to enable; flags remain to disable)., + Ingress adds a new annotation for Frontend NLB attributes to tune NLB behavior + via Ingress.] + breaking_changes: ['Gateway API moves from v1.3 to v1.5; for NLB Gateway users, + TLSRoute is now served in v1 (not alpha). To avoid downtime, install the + experimental TLSRoute CRD during upgrade as recommended.', 'VPC tag lookup + now requires *all* tags in `--aws-vpc-tags` to match; previously a partial + match might have worked. `--aws-vpc-tag-key` is deprecated/ignored, so update + flags/tags accordingly.'] chart_version: 3.2.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.2.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.2.0'] - version: 3.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2470,87 +1365,34 @@ addons: \ Expect different behavior around webhook TLS secret/certificate regeneration\ \ on upgrade; validate that the webhook comes up with a valid cert and that\ \ `aws-load-balancer-tls` is managed as intended in your environment.\n" - chart_updates: - - Helm chart and controller versions remain aligned in v3.x (introduced in v3.0.0). - - v3.1.0 updates Helm chart information/documentation and changes webhook cert - upgrade logic (fixes cert regeneration and brings back `keepTLSSecret`). - features: - - 'Gateway API: Redirect port defaulting now follows spec (defaults to 80/443 - based on scheme when port is omitted).' - - 'Gateway API: Improved regex handling for route matching.' - - 'Gateway API: Gateway status hostname is normalized to lowercase for consistency.' - - 'AWS Global Accelerator (AGA): Cross-namespace reference support for more - flexible multi-namespace setups.' + chart_updates: [Helm chart and controller versions remain aligned in v3.x (introduced + in v3.0.0)., v3.1.0 updates Helm chart information/documentation and changes + webhook cert upgrade logic (fixes cert regeneration and brings back `keepTLSSecret`).] + features: ['Gateway API: Redirect port defaulting now follows spec (defaults + to 80/443 based on scheme when port is omitted).', 'Gateway API: Improved + regex handling for route matching.', 'Gateway API: Gateway status hostname + is normalized to lowercase for consistency.', 'AWS Global Accelerator (AGA): + Cross-namespace reference support for more flexible multi-namespace setups.'] breaking_changes: [] chart_version: 3.1.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.1.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.1.0'] - version: 3.0.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 3.0.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v3.0.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v3.0.0'] - version: 2.9.9 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 2.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2569,67 +1411,40 @@ addons: \ `region`, `vpcId`.\n - `runtimeClassName` support.\n - `--load-balancer-class`\ \ support in chart.\n - More customization options for the service mutator\ \ webhook." - chart_updates: - - 'Chart: allow disabling ingress validation via Helm flag (2.9.0).' - - 'Chart: HPA template uses `.Capabilities.KubeVersion.Version` (compat/templating - change).' - - (From 2.8.0 line) Additional ServiceMonitor functionality. - - (From 2.8.0 line) Allow templating for `clusterName`, `region`, `vpcId` values. - - (From 2.8.0 line) Add `runtimeClassName` support. - - (From 2.8.0 line) Support `--load-balancer-class` in Helm chart. - - (From 2.8.0 line) More customization options for the service mutator webhook. - features: - - Controller migrates to **AWS SDK for Go v2**, improving API efficiency and - retry/backoff behavior (2.9.0). - - Adds `listenerAttributes` plumbing (via `IngressClassParams`) to support listener - attributes on load balancers; ALB has none yet (2.9.0). - - NLB now supports configurable **TCP idle timeout** (2.9.0). - - 'Fix/feature: allow resolving/attaching **multiple security groups with the - same Name tag** (2.9.0).' - - New runtime option to **identify VPC by tags** when metadata is blocked / - VPC ID unknown at deploy time (2.9.0). - - (From 2.8.0 line) IngressClass-level `certificateArn` defaults for ingresses. - - (From 2.8.0 line) New IP address type `dualstack-without-public-ipv4` to disable - public IPv4 on dualstack LBs. - - (From 2.8.0 line) Optional enforcement of NLB security groups on PrivateLink - traffic via annotation. - - (From 2.8.0 line) TargetGroupBinding can target resources outside cluster - VPC via `vpcID`. - - (From 2.8.0 line) Managed Prefix List annotations for SG-based access control. - breaking_changes: - - '**Do not deploy v2.9.0 if AWS Shield Advanced is enabled**: it can crash - the controller; use **v2.9.2+** if Shield Advanced is subscribed and Shield - is enabled on the controller (action-required note).' - - CRD schema changes require **manual CRD apply** during Helm upgrade; skipping - can break reconciliation or future compatibility (2.8.0 and 2.9.0 action-required - notes). - - 'IAM policy updates may be required depending on features used: China mTLS - needs `elasticloadbalancing:DescribeTrustStores` (2.8.0); NLB TCP idle timeout/listener - attribute management needs `DescribeListenerAttributes`/`ModifyListenerAttributes` - (2.9.0).' + chart_updates: ['Chart: allow disabling ingress validation via Helm flag (2.9.0).', + 'Chart: HPA template uses `.Capabilities.KubeVersion.Version` (compat/templating + change).', (From 2.8.0 line) Additional ServiceMonitor functionality., '(From + 2.8.0 line) Allow templating for `clusterName`, `region`, `vpcId` values.', + (From 2.8.0 line) Add `runtimeClassName` support., (From 2.8.0 line) Support + `--load-balancer-class` in Helm chart., (From 2.8.0 line) More customization + options for the service mutator webhook.] + features: ['Controller migrates to **AWS SDK for Go v2**, improving API efficiency + and retry/backoff behavior (2.9.0).', Adds `listenerAttributes` plumbing + (via `IngressClassParams`) to support listener attributes on load balancers; + ALB has none yet (2.9.0)., NLB now supports configurable **TCP idle timeout** + (2.9.0)., 'Fix/feature: allow resolving/attaching **multiple security groups + with the same Name tag** (2.9.0).', New runtime option to **identify VPC + by tags** when metadata is blocked / VPC ID unknown at deploy time (2.9.0)., + (From 2.8.0 line) IngressClass-level `certificateArn` defaults for ingresses., + (From 2.8.0 line) New IP address type `dualstack-without-public-ipv4` to disable + public IPv4 on dualstack LBs., (From 2.8.0 line) Optional enforcement of + NLB security groups on PrivateLink traffic via annotation., (From 2.8.0 + line) TargetGroupBinding can target resources outside cluster VPC via `vpcID`., + (From 2.8.0 line) Managed Prefix List annotations for SG-based access control.] + breaking_changes: ['**Do not deploy v2.9.0 if AWS Shield Advanced is enabled**: + it can crash the controller; use **v2.9.2+** if Shield Advanced is subscribed + and Shield is enabled on the controller (action-required note).', CRD schema + changes require **manual CRD apply** during Helm upgrade; skipping can break + reconciliation or future compatibility (2.8.0 and 2.9.0 action-required + notes)., 'IAM policy updates may be required depending on features used: + China mTLS needs `elasticloadbalancing:DescribeTrustStores` (2.8.0); NLB + TCP idle timeout/listener attribute management needs `DescribeListenerAttributes`/`ModifyListenerAttributes` + (2.9.0).'] chart_version: 1.9.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0'] - version: 2.8.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2650,59 +1465,35 @@ addons: \ support**: chart supports `--load-balancer-class`.\n- **Service mutator\ \ webhook customization**: more knobs to tune webhook behavior (review webhook-related\ \ values if you previously customized it).\n" - chart_updates: - - 'CRDs changed in v2.8.0: IngressClassParams adds `certificateArn` and updates - `ipAddressType`; TargetGroupBinding adds `vpcID` (manual CRD apply required - when upgrading via Helm).' - - 'Chart enhancements: additional ServiceMonitor functionality.' - - 'Chart enhancements: allow templated values for `clusterName`, `region`, `vpcId`.' - - 'Chart enhancements: add `runtimeClassName` support.' - - 'Chart enhancements: add support for `--load-balancer-class`.' - - 'Controller/webhook: more customization options for the service mutator webhook.' - - 'Controller behavior: preserve `loadBalancerClass` on Service updates.' - features: - - 'IngressClass-level default certificate configuration: `certificateArn` can - be set in IngressClassParams to apply certificates across ingresses in that - class.' - - New ALB `ipAddressType` option `dualstack-without-public-ipv4` to create dualstack - LBs without public IPv4 addresses (IPv6-only public clients). Can be set via - ingress annotation or at IngressClassParams. - - Optional enforcement of NLB security groups on AWS PrivateLink traffic via - annotation `aws-load-balancer-inbound-sg-rules-on-private-link-traffic`. - - TargetGroupBinding can register targets in a different VPC by setting `spec.vpcID` - (defaults to the cluster VPC if omitted). - - Allow access control via AWS Managed Prefix Lists using new annotations for - ALB ingresses and NLB services; ignored if explicit security groups are set. - breaking_changes: - - CRD schema changes in v2.8.0 mean you must update CRDs before/alongside the - Helm upgrade; otherwise the controller may fail to reconcile resources or - validation may reject new fields. - - (Regional/IAM) Using ALB mTLS in China now requires IAM policy permission - `elasticloadbalancing:DescribeTrustStores`; without it, mTLS-related reconciliation - will fail. + chart_updates: ['CRDs changed in v2.8.0: IngressClassParams adds `certificateArn` + and updates `ipAddressType`; TargetGroupBinding adds `vpcID` (manual CRD + apply required when upgrading via Helm).', 'Chart enhancements: additional + ServiceMonitor functionality.', 'Chart enhancements: allow templated values + for `clusterName`, `region`, `vpcId`.', 'Chart enhancements: add `runtimeClassName` + support.', 'Chart enhancements: add support for `--load-balancer-class`.', + 'Controller/webhook: more customization options for the service mutator webhook.', + 'Controller behavior: preserve `loadBalancerClass` on Service updates.'] + features: ['IngressClass-level default certificate configuration: `certificateArn` + can be set in IngressClassParams to apply certificates across ingresses + in that class.', New ALB `ipAddressType` option `dualstack-without-public-ipv4` + to create dualstack LBs without public IPv4 addresses (IPv6-only public + clients). Can be set via ingress annotation or at IngressClassParams., Optional + enforcement of NLB security groups on AWS PrivateLink traffic via annotation + `aws-load-balancer-inbound-sg-rules-on-private-link-traffic`., TargetGroupBinding + can register targets in a different VPC by setting `spec.vpcID` (defaults + to the cluster VPC if omitted)., Allow access control via AWS Managed Prefix + Lists using new annotations for ALB ingresses and NLB services; ignored + if explicit security groups are set.] + breaking_changes: [CRD schema changes in v2.8.0 mean you must update CRDs before/alongside + the Helm upgrade; otherwise the controller may fail to reconcile resources + or validation may reject new fields., '(Regional/IAM) Using ALB mTLS in + China now requires IAM policy permission `elasticloadbalancing:DescribeTrustStores`; + without it, mTLS-related reconciliation will fail.'] chart_version: 1.8.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0'] - version: 2.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2717,86 +1508,44 @@ addons: - **Chart knobs added:**\n - Webhook readiness check enabled in the chart.\n\ \ - `revisionHistoryLimit` override.\n - Field to **enable HPA** for the\ \ controller (intended to help during load spikes on `aws-load-balancer-webhook-service`)." - chart_updates: - - Introduced chart-level webhook readiness check and default controller readiness - probe wiring. - - Added `revisionHistoryLimit` configurability for controller Deployment. - - Added an option to enable HorizontalPodAutoscaler (HPA) for the controller. - - General Helm chart and documentation enhancements. - features: - - Ingress mTLS support via integration with ELBv2 trust stores; configure mTLS - mode and trust store name/ARN via new Ingress annotations (requires new IAM - permission). - - EKS Pod Identity support (enables using EKS Pod Identity for AWS auth instead - of/alongside IRSA depending on cluster setup). - - NLB target security-group discovery can now consider additional tags via `--service-target-eni-security-group-tags` - for more flexible environments. - breaking_changes: - - If you upgrade the Helm chart (>=1.7.0) but keep an older controller image, - installation may fail due to the newly added readiness probe expecting endpoints - not present in older images. - - IAM permissions must be updated to include `elasticloadbalancing:DescribeTrustStores` - if you want to use (or avoid errors when enabling) the new Ingress mTLS feature. + chart_updates: [Introduced chart-level webhook readiness check and default controller + readiness probe wiring., Added `revisionHistoryLimit` configurability for + controller Deployment., Added an option to enable HorizontalPodAutoscaler + (HPA) for the controller., General Helm chart and documentation enhancements.] + features: [Ingress mTLS support via integration with ELBv2 trust stores; configure + mTLS mode and trust store name/ARN via new Ingress annotations (requires + new IAM permission)., EKS Pod Identity support (enables using EKS Pod Identity + for AWS auth instead of/alongside IRSA depending on cluster setup)., NLB + target security-group discovery can now consider additional tags via `--service-target-eni-security-group-tags` + for more flexible environments.] + breaking_changes: ['If you upgrade the Helm chart (>=1.7.0) but keep an older + controller image, installation may fail due to the newly added readiness + probe expecting endpoints not present in older images.', 'IAM permissions + must be updated to include `elasticloadbalancing:DescribeTrustStores` if + you want to use (or avoid errors when enabling) the new Ingress mTLS feature.'] chart_version: 1.7.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v2.7.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.7.0'] - version: 2.6.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'NLB security group support: controller can now create/attach a frontend SG - to NLBs and manage a backend SG to control NLB->node/ENI traffic, enabling - tighter instance exposure controls. You can optionally attach existing frontend - SGs via annotation and optionally enable/disable backend rule management via - a new annotation.' - - Improved ACM certificate auto-discovery for Ingress to recognize more key - algorithms (RSA 1024/2048/3072/4096 and multiple EC curves). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['NLB security group support: controller can now create/attach a frontend + SG to NLBs and manage a backend SG to control NLB->node/ENI traffic, enabling + tighter instance exposure controls. You can optionally attach existing frontend + SGs via annotation and optionally enable/disable backend rule management + via a new annotation.', Improved ACM certificate auto-discovery for Ingress + to recognize more key algorithms (RSA 1024/2048/3072/4096 and multiple EC + curves).] breaking_changes: [] chart_version: 1.6.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v2.6.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.6.0'] - version: 2.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2811,60 +1560,35 @@ addons: \ (`subnets`, `InboundCIDRs`, `SSLPolicy`). You must **manually apply updated\ \ CRDs**:\n ```bash\n kubectl apply -k \"http://github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master\"\ \n ```\n" - chart_updates: - - Controller is now intended to be upgraded via updated manifests/helm because - of webhook/mutating webhook additions; old manifests are considered incompatible. - - Adds a mutating webhook so the controller can claim/own Service type LoadBalancer - by default (sets `spec.loadBalancerClass`). - - Helm chart supports setting default target type (`defaultTargetType`). - - IngressClassParams CRD schema expanded with `subnets`, `InboundCIDRs`, and - `SSLPolicy`. - - Leader election moved/migrated toward ConfigMap leases. - - Ingress/service annotation validation tightened (notably ssl-ports and ingress - condition annotations). - features: - - Controller provides a **Service mutator webhook** that sets `spec.loadBalancerClass` - on newly created Services of type `LoadBalancer`, making AWS LBC the default - controller for them (can be disabled via `enableServiceMutatorWebhook=false`). - - You can configure a **default target type** for target groups (via helm `defaultTargetType` - or controller flag). - - '`IngressClassParams` supports new configuration fields: **`subnets`**, **`InboundCIDRs`**, - and **`SSLPolicy`**.' - breaking_changes: - - '**Kubernetes 1.22+ required** in v2.5.0 due to reliance on `spec.loadBalancerClass` - support when making LBC the default Service controller.' - - 'Behavior change: controller now **creates an internal NLB by default** for - Service type `LoadBalancer`; to get internet-facing you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: - internet-facing`.' - - If you leave the Service mutator webhook enabled, you **cannot provision new - Classic Load Balancers (CLB)** from Kubernetes Services (existing CLBs continue - to work). - - 'Known issue/action required: v2.5.0 ingress validator has a bug handling - ingress rules without an HTTP path (issue #3158); **do not upgrade** if you - have such ingresses.' + chart_updates: [Controller is now intended to be upgraded via updated manifests/helm + because of webhook/mutating webhook additions; old manifests are considered + incompatible., Adds a mutating webhook so the controller can claim/own Service + type LoadBalancer by default (sets `spec.loadBalancerClass`)., Helm chart + supports setting default target type (`defaultTargetType`)., 'IngressClassParams + CRD schema expanded with `subnets`, `InboundCIDRs`, and `SSLPolicy`.', Leader + election moved/migrated toward ConfigMap leases., Ingress/service annotation + validation tightened (notably ssl-ports and ingress condition annotations).] + features: ['Controller provides a **Service mutator webhook** that sets `spec.loadBalancerClass` + on newly created Services of type `LoadBalancer`, making AWS LBC the default + controller for them (can be disabled via `enableServiceMutatorWebhook=false`).', + You can configure a **default target type** for target groups (via helm `defaultTargetType` + or controller flag)., '`IngressClassParams` supports new configuration fields: + **`subnets`**, **`InboundCIDRs`**, and **`SSLPolicy`**.'] + breaking_changes: ['**Kubernetes 1.22+ required** in v2.5.0 due to reliance + on `spec.loadBalancerClass` support when making LBC the default Service + controller.', 'Behavior change: controller now **creates an internal NLB + by default** for Service type `LoadBalancer`; to get internet-facing you + must set `service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing`.', + 'If you leave the Service mutator webhook enabled, you **cannot provision + new Classic Load Balancers (CLB)** from Kubernetes Services (existing CLBs + continue to work).', 'Known issue/action required: v2.5.0 ingress validator + has a bug handling ingress rules without an HTTP path (issue #3158); **do + not upgrade** if you have such ingresses.'] chart_version: 1.5.0 - images: - - public.ecr.aws/eks/aws-load-balancer-controller:v2.5.0 + images: ['public.ecr.aws/eks/aws-load-balancer-controller:v2.5.0'] - version: 2.4.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -2888,47 +1612,32 @@ addons: you may have relied on it being false to allow rotation/recreation). ' - chart_updates: - - Chart now creates `IngressClass` and `IngressClassParams` resources by default - (including default naming of `alb`). - - Chart adds optional `ServiceMonitor` resource for metrics scraping via Prometheus - Operator. - - Chart defaults `keepTLSSecret=true` (TLS secret reuse behavior changes). - - Chart removed use of `admissionregistration.k8s.io/v1beta1` (aligns with newer - Kubernetes APIs). - features: - - Ingress objects now use/support the stable `networking.k8s.io/v1` Ingress - API (Kubernetes 1.19+). - - Supports `Service.spec.loadBalancerClass` to bind Services to a specific load - balancer implementation. - - Adds an option to disable security group rule management for NLBs (useful - if rules are managed externally). - - Merges tags defined on Kubernetes Ingress/Service with controller-managed - AWS resource tags for more consistent tagging. - - Introduces feature gate `ServiceTypeLoadBalancerOnly` to optionally limit - reconciliation to `Service` objects of type `LoadBalancer`. - - Helm chart can create `IngressClass`/`IngressClassParams` and a `ServiceMonitor` - out of the box. - breaking_changes: - - '**Kubernetes 1.18 and older are no longer supported** starting with v2.4.0 - due to the move to `networking.k8s.io/v1` Ingress.' - - '**Webhook resources changed**; upgrades require applying the complete updated - manifest or performing the upgrade via Helm to ensure webhook configuration/CA - bundles are correct.' - - Helm now creates `IngressClass`/`IngressClassParams` by default, which can - conflict with pre-existing resources or other controllers if you were managing - these manually. + chart_updates: [Chart now creates `IngressClass` and `IngressClassParams` resources + by default (including default naming of `alb`)., Chart adds optional `ServiceMonitor` + resource for metrics scraping via Prometheus Operator., Chart defaults `keepTLSSecret=true` + (TLS secret reuse behavior changes)., Chart removed use of `admissionregistration.k8s.io/v1beta1` + (aligns with newer Kubernetes APIs).] + features: [Ingress objects now use/support the stable `networking.k8s.io/v1` + Ingress API (Kubernetes 1.19+)., Supports `Service.spec.loadBalancerClass` + to bind Services to a specific load balancer implementation., Adds an option + to disable security group rule management for NLBs (useful if rules are + managed externally)., Merges tags defined on Kubernetes Ingress/Service + with controller-managed AWS resource tags for more consistent tagging., + Introduces feature gate `ServiceTypeLoadBalancerOnly` to optionally limit + reconciliation to `Service` objects of type `LoadBalancer`., Helm chart + can create `IngressClass`/`IngressClassParams` and a `ServiceMonitor` out + of the box.] + breaking_changes: ['**Kubernetes 1.18 and older are no longer supported** starting + with v2.4.0 due to the move to `networking.k8s.io/v1` Ingress.', '**Webhook + resources changed**; upgrades require applying the complete updated manifest + or performing the upgrade via Helm to ensure webhook configuration/CA bundles + are correct.', 'Helm now creates `IngressClass`/`IngressClassParams` by + default, which can conflict with pre-existing resources or other controllers + if you were managing these manually.'] chart_version: 1.4.0 - images: - - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.4.0 + images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.4.0'] - version: 2.3.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -2947,48 +1656,32 @@ addons: - **IngressClass creation parameter**: chart adds an option/parameter to create\ \ the `IngressClass` resource (verify and set if you rely on chart-managed\ \ IngressClass)." - chart_updates: - - Helm chart moved to **Helm v3** packaging/structure. - - Manifests/chart updated to use `admissionregistration.k8s.io/v1` (webhooks) - and cert-manager `v1` resources. - - Chart now prefers `policy/v1` PodDisruptionBudget when the cluster supports - it. - - Chart supports reusing existing webhook TLS secrets and optionally providing - custom TLS cert/key. - - Chart adds optional `serviceAnnotations` and a parameter to create an `IngressClass` - resource. - features: - - Optimized/improved security group management for ALBs (shared backend SG model, - with port-range restriction options). - - Support for **ALB IPv6 target groups** (notably for IPv6 clusters, plus new - IAM perms). - - Support for **EndpointSlice** as a backend discovery source for IP target - groups. - - Ability to specify NLB attributes via annotations, including **NLB deletion - protection**. - - Improved subnet discovery behavior (only on new LB creation; can consider - available IP addresses) and additional filtering (e.g., by VPC ID). - breaking_changes: - - "Controller upgrade can **reconfigure existing ALBs' security groups** due\ - \ to the new shared backend SG behavior; there may be a brief traffic impact\ - \ window during reconciliation\u2014plan a maintenance window or pin behavior\ - \ via `enableBackendSecurityGroup=false` / `--enable-backend-security-group=false`\ - \ or set an explicit backend SG." - - If you use cert-manager integration/manifests, you must be on **cert-manager - v1.5.3+** because resources now use the `cert-manager.io/v1` API. - - New IAM permissions are required for **IPv6 clusters**; failing to update - policy may break reconciliation for IPv6-related features. + chart_updates: [Helm chart moved to **Helm v3** packaging/structure., Manifests/chart + updated to use `admissionregistration.k8s.io/v1` (webhooks) and cert-manager + `v1` resources., Chart now prefers `policy/v1` PodDisruptionBudget when + the cluster supports it., Chart supports reusing existing webhook TLS secrets + and optionally providing custom TLS cert/key., Chart adds optional `serviceAnnotations` + and a parameter to create an `IngressClass` resource.] + features: ['Optimized/improved security group management for ALBs (shared backend + SG model, with port-range restriction options).', 'Support for **ALB IPv6 + target groups** (notably for IPv6 clusters, plus new IAM perms).', Support + for **EndpointSlice** as a backend discovery source for IP target groups., + 'Ability to specify NLB attributes via annotations, including **NLB deletion + protection**.', 'Improved subnet discovery behavior (only on new LB creation; + can consider available IP addresses) and additional filtering (e.g., by + VPC ID).'] + breaking_changes: ["Controller upgrade can **reconfigure existing ALBs' security\ + \ groups** due to the new shared backend SG behavior; there may be a brief\ + \ traffic impact window during reconciliation\u2014plan a maintenance window\ + \ or pin behavior via `enableBackendSecurityGroup=false` / `--enable-backend-security-group=false`\ + \ or set an explicit backend SG.", 'If you use cert-manager integration/manifests, + you must be on **cert-manager v1.5.3+** because resources now use the `cert-manager.io/v1` + API.', New IAM permissions are required for **IPv6 clusters**; failing to + update policy may break reconciliation for IPv6-related features.] chart_version: 1.3.2 - images: - - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.3.0 + images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.3.0'] - version: 2.2.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -3007,67 +1700,39 @@ addons: \ certificate locations** and **default SSL policy**.\n\n> No specific Helm\ \ values keys were provided in the notes you pasted; treat the above as **behavioral/manifest\ \ requirements** rather than guaranteed `values.yaml` key changes." - chart_updates: - - Controller image moves to `docker.io/amazon/aws-alb-ingress-controller:v2.2.0` - (and corresponding ECR mirrors). - - 'Manifests updated to newer Kubernetes APIs: webhook + CRDs upgraded to `v1` - APIs; deprecated apiVersions removed.' - - 'Admission webhooks improved: pod mutator webhook now uses `objectSelector`; - webhook cert/key locations are configurable via flags.' - - 'New CRD introduced: **IngressClassParams** (plus validating webhook) and - RBAC added to read it.' - features: - - Adds **NLB instance mode** support. - - 'Adds annotation to set **private static IPv4 addresses** for internal NLBs: - `service.beta.kubernetes.io/aws-load-balancer-private-ipv4-addresses`.' - - Introduces **IngressClassParams** to constrain/standardize LB settings across - multiple Ingresses. - - "Adds `alb.ingress.kubernetes.io/ssl-redirect` to simplify HTTP\u2192HTTPS\ - \ redirects." - - Supports Ingress **PathType**. - - Supports resource tagging for **ALB listeners and listener rules**. - - Allows specifying a **custom load balancer name** for ALB/NLB. - - Allows selecting backend nodes by **node labels** for Ingress/Service/TargetGroupBinding. - - Supports provisioning ALB on **Local Zones**. - - Adds ability to opt out management for certain tags via controller flags. - - Adds ability to customize webhook certificate locations via controller flags. - - Adds ability to specify a default **SSL policy** via controller flags. - breaking_changes: - - '**NLB scheme default changed**: new NLBs are **internal by default**. To - create an internet-facing NLB you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: - internet-facing` on the Service (existing NLBs are not affected).' - - Ingress rules that reference a **non-existent Service/Action** no longer block - reconcile; they will be replaced with **fixed 503 responses** (changes failure - mode/traffic behavior). - - 'Tag precedence change: tags specified via the controller flag `--default-tags` - now take **highest priority**, which can override tags set elsewhere.' + chart_updates: ['Controller image moves to `docker.io/amazon/aws-alb-ingress-controller:v2.2.0` + (and corresponding ECR mirrors).', 'Manifests updated to newer Kubernetes + APIs: webhook + CRDs upgraded to `v1` APIs; deprecated apiVersions removed.', + 'Admission webhooks improved: pod mutator webhook now uses `objectSelector`; + webhook cert/key locations are configurable via flags.', 'New CRD introduced: + **IngressClassParams** (plus validating webhook) and RBAC added to read + it.'] + features: [Adds **NLB instance mode** support., 'Adds annotation to set **private + static IPv4 addresses** for internal NLBs: `service.beta.kubernetes.io/aws-load-balancer-private-ipv4-addresses`.', + Introduces **IngressClassParams** to constrain/standardize LB settings across + multiple Ingresses., "Adds `alb.ingress.kubernetes.io/ssl-redirect` to simplify\ + \ HTTP\u2192HTTPS redirects.", Supports Ingress **PathType**., Supports + resource tagging for **ALB listeners and listener rules**., Allows specifying + a **custom load balancer name** for ALB/NLB., Allows selecting backend nodes + by **node labels** for Ingress/Service/TargetGroupBinding., Supports provisioning + ALB on **Local Zones**., Adds ability to opt out management for certain + tags via controller flags., Adds ability to customize webhook certificate + locations via controller flags., Adds ability to specify a default **SSL + policy** via controller flags.] + breaking_changes: ['**NLB scheme default changed**: new NLBs are **internal + by default**. To create an internet-facing NLB you must set `service.beta.kubernetes.io/aws-load-balancer-scheme: + internet-facing` on the Service (existing NLBs are not affected).', Ingress + rules that reference a **non-existent Service/Action** no longer block reconcile; + they will be replaced with **fixed 503 responses** (changes failure mode/traffic + behavior)., 'Tag precedence change: tags specified via the controller flag + `--default-tags` now take **highest priority**, which can override tags + set elsewhere.'] chart_version: 1.2.2 - images: - - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.2.0 + images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.2.0'] - version: 2.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', + '1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: @@ -3079,69 +1744,39 @@ addons: - No other helm values changes were called out in the provided notes. (You may still want to diff your chart values between versions to catch defaults changes, but nothing is explicitly mentioned here.)' - chart_updates: - - RBAC roles/manifests updated to include permissions for `IngressClass` (required - when using `IngressClass`). - features: - - IngressClass support (Kubernetes 1.18+) so the controller can select/manage - ingresses via `IngressClass` instead of only the legacy `kubernetes.io/ingress.class` - annotation. - - gRPC end-to-end HTTP/2 support for ALB workloads, improving compatibility - for gRPC services behind ALB. - - Customer Owned IP (COIP) pool configuration support for ALB on AWS Outposts. - - NLB IPv6 support for dual-stack/IPv6-facing services. - - NLB ALPN policy configuration support (useful for TLS negotiation behavior). - - NLB target group attributes can be configured via annotations, allowing tuning - of target group behavior. - - Ability to explicitly configure subnets for NLB, rather than relying solely - on discovery. - - Default AWS tags support so all AWS resources created/managed by the controller - can receive a standard tag set. - breaking_changes: - - If you use `IngressClass`, the controller will fail to watch/operate correctly - until RBAC is updated to allow reading `IngressClass` resources. + chart_updates: [RBAC roles/manifests updated to include permissions for `IngressClass` + (required when using `IngressClass`).] + features: [IngressClass support (Kubernetes 1.18+) so the controller can select/manage + ingresses via `IngressClass` instead of only the legacy `kubernetes.io/ingress.class` + annotation., 'gRPC end-to-end HTTP/2 support for ALB workloads, improving + compatibility for gRPC services behind ALB.', Customer Owned IP (COIP) pool + configuration support for ALB on AWS Outposts., NLB IPv6 support for dual-stack/IPv6-facing + services., NLB ALPN policy configuration support (useful for TLS negotiation + behavior)., 'NLB target group attributes can be configured via annotations, + allowing tuning of target group behavior.', 'Ability to explicitly configure + subnets for NLB, rather than relying solely on discovery.', Default AWS + tags support so all AWS resources created/managed by the controller can + receive a standard tag set.] + breaking_changes: ['If you use `IngressClass`, the controller will fail to watch/operate + correctly until RBAC is updated to allow reading `IngressClass` resources.'] chart_version: 1.1.1 - images: - - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.1.0 + images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.1.0'] - version: 2.0.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', + '1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null chart_version: 1.0.6 - images: - - 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.0.0 - name: aws-load-balancer-controller + images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.0.0'] - name: bigbang icon: https://artifacthub.io/image/0ca7dd5c-47ec-4d6a-87b7-2f2b74a3cca5 git_url: https://repo1.dso.mil/big-bang/bigbang release_url: https://repo1.dso.mil/big-bang/bigbang/-/releases/{vsn} versions: - version: 3.32.0 - kube: - - '1.36' + kube: ['1.36'] requirements: - name: Alloy version: 4.3.2-bb.0 @@ -3236,30 +1871,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - BigBang 3.32.0 adds Cert Manager (v1.20.3-bb.2) and removes bbctl from the - stack. - - Most other components receive patch/minor bumps; expect chart/package version - alignment but review per-package changelogs for values changes. - features: - - Cert Manager is now included, enabling in-cluster certificate issuance/renewal - workflows without separate installation. - - Various components updated for bugfixes/security patches (e.g., Authservice, - ESO, Keycloak, Kyverno, Thanos, Twistlock). - breaking_changes: - - bbctl is removed; any CI/CD or operational workflows depending on bbctl need - migration. - - Introducing Cert Manager may overlap with an existing cert-manager installation/CRDs; - reconcile ownership to avoid CRD/namespace conflicts. + chart_updates: [BigBang 3.32.0 adds Cert Manager (v1.20.3-bb.2) and removes + bbctl from the stack., Most other components receive patch/minor bumps; + expect chart/package version alignment but review per-package changelogs + for values changes.] + features: ['Cert Manager is now included, enabling in-cluster certificate issuance/renewal + workflows without separate installation.', 'Various components updated for + bugfixes/security patches (e.g., Authservice, ESO, Keycloak, Kyverno, Thanos, + Twistlock).'] + breaking_changes: [bbctl is removed; any CI/CD or operational workflows depending + on bbctl need migration., Introducing Cert Manager may overlap with an existing + cert-manager installation/CRDs; reconcile ownership to avoid CRD/namespace + conflicts.] chart_version: 3.32.0 - images: - - registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner:v18.11.3 - - registry1.dso.mil/gitlab/gitlab-org/gitlab-runner:ubi-fips-v19.2.2 - - registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner-helper:v18.11.3 - - registry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper:ubi-fips-x86_64-v19.2.2 + images: ['registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner:v18.11.3', + 'registry1.dso.mil/gitlab/gitlab-org/gitlab-runner:ubi-fips-v19.2.2', 'registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner-helper:v18.11.3', + 'registry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper:ubi-fips-x86_64-v19.2.2'] - version: 3.31.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.3.2-bb.0 @@ -3354,29 +1983,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang umbrella upgrade 3.30.0 \u2192 3.31.0 with multiple subchart bumps\ - \ across platform services (GitLab, Argo CD, Monitoring, Gatekeeper, ESO,\ - \ Vault, etc.)." - - "Largest dependency jumps include GitLab 9.11.8-bb.0 \u2192 10.2.4-bb.0, Argo\ - \ CD 10.1.4-bb.1 \u2192 10.2.1-bb.0, Monitoring 87.10.1-bb.3 \u2192 88.3.0-bb.0,\ - \ and Renovate 46.31.6-bb.5 \u2192 46.251.0-bb.0." - - "CRD bundle bump: prometheus-operator-crds 30.0.1-bb.0 \u2192 31.0.1-bb.0\ - \ (implies CRD updates during upgrade)." - features: - - Updated component versions across the Big Bang stack, bringing in upstream - fixes and minor feature updates for GitOps (Argo CD), policy (Gatekeeper/Kyverno), - secrets (External Secrets), observability (Monitoring), and core services - (GitLab, Vault). - breaking_changes: - - "Potential breaking changes may exist in major/minor bumps (notably GitLab\ - \ 9.x \u2192 10.x chart and Monitoring/Prometheus CRDs). Review each component\u2019\ - s release notes and upgrade guides before applying in production." + chart_updates: ["Big Bang umbrella upgrade 3.30.0 \u2192 3.31.0 with multiple\ + \ subchart bumps across platform services (GitLab, Argo CD, Monitoring,\ + \ Gatekeeper, ESO, Vault, etc.).", "Largest dependency jumps include GitLab\ + \ 9.11.8-bb.0 \u2192 10.2.4-bb.0, Argo CD 10.1.4-bb.1 \u2192 10.2.1-bb.0,\ + \ Monitoring 87.10.1-bb.3 \u2192 88.3.0-bb.0, and Renovate 46.31.6-bb.5\ + \ \u2192 46.251.0-bb.0.", "CRD bundle bump: prometheus-operator-crds 30.0.1-bb.0\ + \ \u2192 31.0.1-bb.0 (implies CRD updates during upgrade)."] + features: ['Updated component versions across the Big Bang stack, bringing in + upstream fixes and minor feature updates for GitOps (Argo CD), policy (Gatekeeper/Kyverno), + secrets (External Secrets), observability (Monitoring), and core services + (GitLab, Vault).'] + breaking_changes: ["Potential breaking changes may exist in major/minor bumps\ + \ (notably GitLab 9.x \u2192 10.x chart and Monitoring/Prometheus CRDs).\ + \ Review each component\u2019s release notes and upgrade guides before applying\ + \ in production."] chart_version: 3.31.0 images: [] - version: 3.30.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.3.1-bb.1 @@ -3471,23 +2096,19 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - BigBang 3.30.0 primarily updates bundled component chart versions (patch/minor - bumps across most packages). - - "Notable minor bumps include: Mimir 6.0.6\u21926.1.0, Kyverno 3.8.1\u2192\ - 3.8.2, Kyverno Reporter 3.7.4\u21923.9.0, NeuVector 2.10.3\u21922.11.0, Elastic/Kibana\ - \ 1.39\u21921.40, Alloy 4.2.2\u21924.3.1, and Istio 1.30.2\u21921.30.3." - features: - - 'General dependency refresh: newer upstream component versions with bugfixes - and security patches.' - - Observability stack refresh via Alloy and Mimir bumps; policy/reporting refresh - via Kyverno and Kyverno Reporter bumps. + chart_updates: [BigBang 3.30.0 primarily updates bundled component chart versions + (patch/minor bumps across most packages)., "Notable minor bumps include:\ + \ Mimir 6.0.6\u21926.1.0, Kyverno 3.8.1\u21923.8.2, Kyverno Reporter 3.7.4\u2192\ + 3.9.0, NeuVector 2.10.3\u21922.11.0, Elastic/Kibana 1.39\u21921.40, Alloy\ + \ 4.2.2\u21924.3.1, and Istio 1.30.2\u21921.30.3."] + features: ['General dependency refresh: newer upstream component versions with + bugfixes and security patches.', Observability stack refresh via Alloy and + Mimir bumps; policy/reporting refresh via Kyverno and Kyverno Reporter bumps.] breaking_changes: [] chart_version: 3.30.0 images: [] - version: 3.29.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.2.2-bb.0 @@ -3582,24 +2203,20 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang upgraded from 3.28.0 to 3.29.0 (now the currently supported version - per release notes). - - Multiple component chart version bumps across the stack (ArgoCD, External - Secrets Operator, Monitoring stack, Prometheus Operator CRDs, etc.). - features: - - Support baseline moved to Big Bang 3.29.0 (3.28.0 no longer the currently - supported version). - breaking_changes: - - "Potential breaking changes likely in major/minor jumps for ArgoCD (9.x \u2192\ - \ 10.x), External Secrets Operator (1.x \u2192 2.x), Monitoring (85.x \u2192\ - \ 87.x), and Prometheus Operator CRDs (28 \u2192 30); review those components\u2019\ - \ upstream/bb chart notes before upgrading." + chart_updates: [Big Bang upgraded from 3.28.0 to 3.29.0 (now the currently supported + version per release notes)., 'Multiple component chart version bumps across + the stack (ArgoCD, External Secrets Operator, Monitoring stack, Prometheus + Operator CRDs, etc.).'] + features: [Support baseline moved to Big Bang 3.29.0 (3.28.0 no longer the currently + supported version).] + breaking_changes: ["Potential breaking changes likely in major/minor jumps for\ + \ ArgoCD (9.x \u2192 10.x), External Secrets Operator (1.x \u2192 2.x),\ + \ Monitoring (85.x \u2192 87.x), and Prometheus Operator CRDs (28 \u2192\ + \ 30); review those components\u2019 upstream/bb chart notes before upgrading."] chart_version: 3.29.0 images: [] - version: 3.28.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.1.7-bb.0 @@ -3694,33 +2311,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "BigBang 3.28.0 bumps a wide set of packaged components; use this as an upgrade\ - \ checklist and validate each component\u2019s own release notes for additional\ - \ required value changes or migrations." - - Backstage is removed in 3.28.0; you must remove/disable any Backstage-related - values, namespaces, and dependent integrations before or during the upgrade. - - Most changes are patch-level bumps, but some are minor releases (e.g., Argo - CD, Kiali, Vault, Velero, Fortify, Twistlock) and may include behavior changes; - run in a staging cluster and verify RBAC, CRDs, and webhook behavior. - features: - - Updated platform component bundle with newer versions of Argo CD, Istio 1.30.2, - Vault 0.33.x, Velero 12.1.x, and other supporting services. - - Security and bugfix updates across multiple components (Kyverno, Harbor, NeuVector, - monitoring stack, etc.) via chart bumps. - - Backstage is no longer included in the default BigBang package set. - breaking_changes: - - 'Backstage component removed: existing Backstage deployments managed by BigBang - will no longer be upgraded/maintained; you must migrate or manage it separately - if still needed.' - - Potential minor-version behavior changes in Argo CD, Vault, Velero, Fortify, - and Twistlock may require config validation and post-upgrade testing (SSO/OIDC, - policies, CRDs, backups/restores, scanners). + chart_updates: ["BigBang 3.28.0 bumps a wide set of packaged components; use\ + \ this as an upgrade checklist and validate each component\u2019s own release\ + \ notes for additional required value changes or migrations.", 'Backstage + is removed in 3.28.0; you must remove/disable any Backstage-related values, + namespaces, and dependent integrations before or during the upgrade.', 'Most + changes are patch-level bumps, but some are minor releases (e.g., Argo CD, + Kiali, Vault, Velero, Fortify, Twistlock) and may include behavior changes; + run in a staging cluster and verify RBAC, CRDs, and webhook behavior.'] + features: ['Updated platform component bundle with newer versions of Argo CD, + Istio 1.30.2, Vault 0.33.x, Velero 12.1.x, and other supporting services.', + 'Security and bugfix updates across multiple components (Kyverno, Harbor, + NeuVector, monitoring stack, etc.) via chart bumps.', Backstage is no longer + included in the default BigBang package set.] + breaking_changes: ['Backstage component removed: existing Backstage deployments + managed by BigBang will no longer be upgraded/maintained; you must migrate + or manage it separately if still needed.', 'Potential minor-version behavior + changes in Argo CD, Vault, Velero, Fortify, and Twistlock may require config + validation and post-upgrade testing (SSO/OIDC, policies, CRDs, backups/restores, + scanners).'] chart_version: 3.28.0 images: [] - version: 3.27.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.0.1-bb.0 @@ -3817,33 +2430,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "BigBang 3.26.0 \u2192 3.27.0 is primarily a dependency bump release across\ - \ multiple components (Argo CD, Authservice, Backstage, Istio stack including\ - \ ztunnel, Keycloak, Kyverno Reporter, Mattermost + operator, Mimir, SonarQube,\ - \ Velero)." - - "Istio stack moves from 1.29.2 to 1.30.1 (and ztunnel 1.29.1 \u2192 1.30.1),\ - \ which is the most operationally significant change and may require special\ - \ upgrade sequencing/validation." - features: - - "Argo CD receives patch updates (9.5.15-bb.0 \u2192 9.5.21-bb.0) likely including\ - \ bugfixes and security fixes." - - "Backstage receives a minor version bump (2.6.3-bb.3 \u2192 2.8.1-bb.0) adding\ - \ upstream features/bugfixes." - - Istio moves to 1.30.1 which likely includes performance and security fixes - plus behavior changes relative to 1.29.x. - - "Velero patch bump (12.0.1 \u2192 12.0.2-bb.1) likely includes backup/restore\ - \ fixes." - breaking_changes: - - "No explicit breaking changes were provided in the notes you shared; assume\ - \ none are known from this input, but treat the Istio 1.29 \u2192 1.30 upgrade\ - \ as potentially introducing behavioral changes and re-validate traffic management,\ - \ mTLS, and ambient/ztunnel behavior." + chart_updates: ["BigBang 3.26.0 \u2192 3.27.0 is primarily a dependency bump\ + \ release across multiple components (Argo CD, Authservice, Backstage, Istio\ + \ stack including ztunnel, Keycloak, Kyverno Reporter, Mattermost + operator,\ + \ Mimir, SonarQube, Velero).", "Istio stack moves from 1.29.2 to 1.30.1\ + \ (and ztunnel 1.29.1 \u2192 1.30.1), which is the most operationally significant\ + \ change and may require special upgrade sequencing/validation."] + features: ["Argo CD receives patch updates (9.5.15-bb.0 \u2192 9.5.21-bb.0)\ + \ likely including bugfixes and security fixes.", "Backstage receives a\ + \ minor version bump (2.6.3-bb.3 \u2192 2.8.1-bb.0) adding upstream features/bugfixes.", + Istio moves to 1.30.1 which likely includes performance and security fixes + plus behavior changes relative to 1.29.x., "Velero patch bump (12.0.1 \u2192\ + \ 12.0.2-bb.1) likely includes backup/restore fixes."] + breaking_changes: ["No explicit breaking changes were provided in the notes\ + \ you shared; assume none are known from this input, but treat the Istio\ + \ 1.29 \u2192 1.30 upgrade as potentially introducing behavioral changes\ + \ and re-validate traffic management, mTLS, and ambient/ztunnel behavior."] chart_version: 3.27.0 images: [] - version: 3.26.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.0.1-bb.0 @@ -3941,17 +2547,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Component bundle updates in this release (Anchore Enterprise, Argo CD, Elastic/Kibana, - GitLab, Harbor, Keycloak, Kiali, Kyverno, Kyverno Reporter, Loki, Mattermost, - Monitoring, NeuVector, Thanos, Twistlock, Velero) to the versions listed in - the notes. + features: ['Component bundle updates in this release (Anchore Enterprise, Argo + CD, Elastic/Kibana, GitLab, Harbor, Keycloak, Kiali, Kyverno, Kyverno Reporter, + Loki, Mattermost, Monitoring, NeuVector, Thanos, Twistlock, Velero) to the + versions listed in the notes.'] breaking_changes: [] chart_version: 3.26.0 images: [] - version: 3.25.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 4.0.1-bb.0 @@ -4049,17 +2653,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No new features were provided in the pasted release notes; both entries only - state that the currently supported Big Bang version is 3.25.0. - breaking_changes: - - No breaking changes were provided in the pasted release notes; the content - shown does not include upgrade-impacting changes. + features: [No new features were provided in the pasted release notes; both entries + only state that the currently supported Big Bang version is 3.25.0.] + breaking_changes: [No breaking changes were provided in the pasted release notes; + the content shown does not include upgrade-impacting changes.] chart_version: 3.25.0 images: [] - version: 3.24.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 3.8.4-bb.1 @@ -4156,31 +2757,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart version bump from 3.23.0 to 3.24.0 with multiple component - chart version updates (see below). - - Adds Renovate as a new packaged component (Renovate chart introduced at 46.31.6-bb.5). - - "Several components receive patch/minor updates; a few have notable minor/major\ - \ jumps (Tempo 1.26.5 \u2192 2.1.0, Mimir 5.8.0 \u2192 6.0.6, Loki 6.46.0\ - \ \u2192 6.55.0)." - features: - - Renovate is now included as a managed component (enables automated dependency/Helm - update PRs when configured). - - 'Observability stack updates: Tempo 2.1.0, Mimir 6.0.6, Loki 6.55.0 bring - improvements and fixes from upstream releases (review component-specific changelogs - if you rely on advanced features).' - breaking_changes: - - "Potential breaking changes due to major/minor jumps: Tempo 1.x \u2192 2.x\ - \ and Mimir 5.x \u2192 6.x may include config or API behavior changes; verify\ - \ values and migration notes before upgrade." - - Big Bang 3.24.0 is not the currently supported release per the admin message - (supported is 3.25.0); confirm your upgrade path/support policy before proceeding. + chart_updates: [Big Bang umbrella chart version bump from 3.23.0 to 3.24.0 with + multiple component chart version updates (see below)., Adds Renovate as + a new packaged component (Renovate chart introduced at 46.31.6-bb.5)., "Several\ + \ components receive patch/minor updates; a few have notable minor/major\ + \ jumps (Tempo 1.26.5 \u2192 2.1.0, Mimir 5.8.0 \u2192 6.0.6, Loki 6.46.0\ + \ \u2192 6.55.0)."] + features: [Renovate is now included as a managed component (enables automated + dependency/Helm update PRs when configured)., 'Observability stack updates: + Tempo 2.1.0, Mimir 6.0.6, Loki 6.55.0 bring improvements and fixes from + upstream releases (review component-specific changelogs if you rely on advanced + features).'] + breaking_changes: ["Potential breaking changes due to major/minor jumps: Tempo\ + \ 1.x \u2192 2.x and Mimir 5.x \u2192 6.x may include config or API behavior\ + \ changes; verify values and migration notes before upgrade.", Big Bang + 3.24.0 is not the currently supported release per the admin message (supported + is 3.25.0); confirm your upgrade path/support policy before proceeding.] chart_version: 3.24.0 - images: - - registry1.dso.mil/ironbank/opensource/apache/kafka-native:4.2.0 + images: ['registry1.dso.mil/ironbank/opensource/apache/kafka-native:4.2.0'] - version: 3.23.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 3.8.4-bb.1 @@ -4276,19 +2872,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No actionable application release notes were provided beyond an admin message - indicating the currently supported Big Bang version is 3.25.0. - breaking_changes: - - "Release note details for 3.23.0 (and 3.22.0) were not included, so breaking\ - \ changes between 3.22.0 \u2192 3.23.0 cannot be determined from the provided\ - \ text." + features: [No actionable application release notes were provided beyond an admin + message indicating the currently supported Big Bang version is 3.25.0.] + breaking_changes: ["Release note details for 3.23.0 (and 3.22.0) were not included,\ + \ so breaking changes between 3.22.0 \u2192 3.23.0 cannot be determined\ + \ from the provided text."] chart_version: 3.23.0 - images: - - registry1.dso.mil/ironbank/big-bang/base:2.1.0 + images: ['registry1.dso.mil/ironbank/big-bang/base:2.1.0'] - version: 3.22.0 - kube: - - '1.35' + kube: ['1.35'] requirements: - name: Alloy version: 3.8.4-bb.1 @@ -4384,17 +2976,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No actionable feature details were provided in the pasted notes; only an admin - notice about currently supported Big Bang versions. - breaking_changes: - - No breaking change details were provided in the pasted notes; only an admin - notice about supported versions. + features: [No actionable feature details were provided in the pasted notes; + only an admin notice about currently supported Big Bang versions.] + breaking_changes: [No breaking change details were provided in the pasted notes; + only an admin notice about supported versions.] chart_version: 3.22.0 images: [] - version: 3.21.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.8.4-bb.1 @@ -4488,17 +3077,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No application-level changes were provided in the notes you shared; only an - 'Admin message' indicating the currently supported Big Bang version for each - release. - breaking_changes: - - No breaking changes were listed in the notes you provided. + features: [No application-level changes were provided in the notes you shared; + only an 'Admin message' indicating the currently supported Big Bang version + for each release.] + breaking_changes: [No breaking changes were listed in the notes you provided.] chart_version: 3.21.0 images: [] - version: 3.20.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.8.4-bb.0 @@ -4590,21 +3176,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - 'Component bundle update for Big Bang 3.20.0: upgrades across observability - (Alloy, Fluent Bit, Grafana, Monitoring/Prometheus stack, Tempo, Thanos), - security/policy (Gatekeeper), service mesh (Istio), CI/dev platforms (GitLab), - and various supporting apps (Anchore, ECK, Keycloak, Mattermost, MinIO, Kyverno - Reporter).' - breaking_changes: - - Nexus Repository Manager is removed in 3.20.0; any deployments depending on - the Big Bang-managed Nexus component must be migrated or managed separately - before/at upgrade. + features: ['Component bundle update for Big Bang 3.20.0: upgrades across observability + (Alloy, Fluent Bit, Grafana, Monitoring/Prometheus stack, Tempo, Thanos), + security/policy (Gatekeeper), service mesh (Istio), CI/dev platforms (GitLab), + and various supporting apps (Anchore, ECK, Keycloak, Mattermost, MinIO, + Kyverno Reporter).'] + breaking_changes: [Nexus Repository Manager is removed in 3.20.0; any deployments + depending on the Big Bang-managed Nexus component must be migrated or managed + separately before/at upgrade.] chart_version: 3.20.0 images: [] - version: 3.19.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.7.2-bb.4 @@ -4697,30 +3280,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart upgraded from 3.18.0 to 3.19.0, primarily by bumping - pinned versions of multiple sub-charts/components (see lists below). - features: - - Istio stack updated to 1.29.0/1.29.0-bb.1, bringing upstream Istio improvements - and fixes. - - Anchore Enterprise updated to 3.21.0-bb.0, bringing new security scanning - features/fixes from Anchore 3.21 line. - - Argo CD updated to 9.4.2-bb.0, bringing UI/UX and sync/health fixes from the - upstream chart/app. - - Headlamp updated to 0.40.0-bb.0 with general UI and integration improvements. - - Kiali updated to 2.22.0-bb.0 with updated Istio observability features/compatibility. - breaking_changes: - - "Prometheus Operator CRDs bumped 26.0.0-bb.0 \u2192 27.0.0-bb.0; CRD changes\ - \ can be breaking and may require applying updated CRDs before/with the upgrade\ - \ and verifying any custom PrometheusRule/ServiceMonitor/PodMonitor resources\ - \ against the new schemas." - - "Istio upgrade 1.28.x \u2192 1.29.0 can introduce behavioral changes; validate\ - \ sidecar injection, gateways, and CNI compatibility during a staged rollout." + chart_updates: ['Big Bang umbrella chart upgraded from 3.18.0 to 3.19.0, primarily + by bumping pinned versions of multiple sub-charts/components (see lists + below).'] + features: ['Istio stack updated to 1.29.0/1.29.0-bb.1, bringing upstream Istio + improvements and fixes.', 'Anchore Enterprise updated to 3.21.0-bb.0, bringing + new security scanning features/fixes from Anchore 3.21 line.', 'Argo CD + updated to 9.4.2-bb.0, bringing UI/UX and sync/health fixes from the upstream + chart/app.', Headlamp updated to 0.40.0-bb.0 with general UI and integration + improvements., Kiali updated to 2.22.0-bb.0 with updated Istio observability + features/compatibility.] + breaking_changes: ["Prometheus Operator CRDs bumped 26.0.0-bb.0 \u2192 27.0.0-bb.0;\ + \ CRD changes can be breaking and may require applying updated CRDs before/with\ + \ the upgrade and verifying any custom PrometheusRule/ServiceMonitor/PodMonitor\ + \ resources against the new schemas.", "Istio upgrade 1.28.x \u2192 1.29.0\ + \ can introduce behavioral changes; validate sidecar injection, gateways,\ + \ and CNI compatibility during a staged rollout."] chart_version: 3.19.0 images: [] - version: 3.18.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.7.2-bb.3 @@ -4813,31 +3392,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang version bump from 3.17.0 to 3.18.0. - - 'Large stack expansion: many optional/managed components are introduced as - new packages (e.g., Argo CD, GitLab, Harbor, Grafana, Loki/Tempo/Mimir updates, - Vault update, etc.).' - - 'Minor version bumps for existing packages: Backstage, Gatekeeper, Keycloak, - Loki, Mattermost Operator, Mimir, Nexus, Tempo, Vault.' - features: - - Introduces numerous additional integrated packages (Alloy, Anchore Enterprise, - Argo CD, GitLab, GitLab Runner, Harbor, Grafana, Kyverno suite, Velero, and - more) available for enablement under Big Bang 3.18.0. - - Adds broader observability/logging options via new packages like Fluent Bit, - Grafana, Elasticsearch/Kibana, Thanos, and Alloy. - breaking_changes: - - 'Potential operational change: many new packages are now available/templated; - enabling them may require additional cluster resources, new namespaces, credentials, - and network policies.' - - "One component entry indicates a version was removed (\"updated: 11.3.2-bb.1\ - \ \u2192 removed\"), suggesting a previously-present package or chart reference\ - \ is no longer included and may require cleanup if it was in use." + chart_updates: [Big Bang version bump from 3.17.0 to 3.18.0., 'Large stack expansion: + many optional/managed components are introduced as new packages (e.g., Argo + CD, GitLab, Harbor, Grafana, Loki/Tempo/Mimir updates, Vault update, etc.).', + 'Minor version bumps for existing packages: Backstage, Gatekeeper, Keycloak, + Loki, Mattermost Operator, Mimir, Nexus, Tempo, Vault.'] + features: ['Introduces numerous additional integrated packages (Alloy, Anchore + Enterprise, Argo CD, GitLab, GitLab Runner, Harbor, Grafana, Kyverno suite, + Velero, and more) available for enablement under Big Bang 3.18.0.', 'Adds + broader observability/logging options via new packages like Fluent Bit, + Grafana, Elasticsearch/Kibana, Thanos, and Alloy.'] + breaking_changes: ['Potential operational change: many new packages are now + available/templated; enabling them may require additional cluster resources, + new namespaces, credentials, and network policies.', "One component entry\ + \ indicates a version was removed (\"updated: 11.3.2-bb.1 \u2192 removed\"\ + ), suggesting a previously-present package or chart reference is no longer\ + \ included and may require cleanup if it was in use."] chart_version: 3.18.0 images: [] - version: 3.17.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: updated version: 3.7.2-bb.3 @@ -4924,29 +3498,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 3.17.0 release notes indicate a major packaging change where nearly - all previously included components (Istio, ArgoCD, GitLab, Harbor, Grafana, - etc.) are listed as removed. - - "A new component entry appears: `new` at version `11.3.2-bb.1` (the notes\ - \ you provided don\u2019t identify what this maps to\u2014treat as an unknown/placeholder\ - \ component name)." - features: - - No explicit new features were included in the text you provided beyond a new/added - component at `11.3.2-bb.1` (identity unclear). - breaking_changes: - - 'Large breaking change: many Big Bang-managed components are removed in 3.17.0 - according to the provided notes. Upgrading without planning will uninstall/stop - managing those components unless they are now installed/managed differently - (e.g., separate charts, different repos, or different package structure).' - - Expect values schema and GitOps workflows to change because component toggles/values - for removed charts may no longer exist; Helm upgrade may fail or prune resources - if those subcharts are no longer rendered. + chart_updates: ['Big Bang 3.17.0 release notes indicate a major packaging change + where nearly all previously included components (Istio, ArgoCD, GitLab, + Harbor, Grafana, etc.) are listed as removed.', "A new component entry appears:\ + \ `new` at version `11.3.2-bb.1` (the notes you provided don\u2019t identify\ + \ what this maps to\u2014treat as an unknown/placeholder component name)."] + features: [No explicit new features were included in the text you provided beyond + a new/added component at `11.3.2-bb.1` (identity unclear).] + breaking_changes: ['Large breaking change: many Big Bang-managed components + are removed in 3.17.0 according to the provided notes. Upgrading without + planning will uninstall/stop managing those components unless they are now + installed/managed differently (e.g., separate charts, different repos, or + different package structure).', Expect values schema and GitOps workflows + to change because component toggles/values for removed charts may no longer + exist; Helm upgrade may fail or prune resources if those subcharts are no + longer rendered.] chart_version: 3.17.0 images: [] - version: 3.16.0 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.7.2-bb.2 @@ -5039,34 +3609,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart version bump from 3.15.0 to 3.16.0 with a large set - of component chart version updates. - - Adds several new optional packages/components to the stack (Backstage, bbctl, - Gatekeeper, GitLab, Grafana, Headlamp, Istio CNI/CRDs, Keycloak, Loki, Mimir, - Monitoring, Prometheus Operator CRDs, Sonarqube). - - Removes the `updated` component/package (2025.6.1-bb.0). - features: - - Introduces multiple new packages that can now be enabled in Big Bang 3.16.0 - (e.g., Backstage, GitLab, Grafana, Keycloak, Loki/Mimir/Monitoring, Gatekeeper, - Sonarqube). - - Updates core platform components (Istio, Argo CD, Authservice, Harbor, Kiali, - Mattermost, Tempo, Velero, Vault, etc.) to newer patch/minor versions. - breaking_changes: - - 'Potential operational impact: enabling newly-added components may introduce - new CRDs, namespaces, resource requirements, and RBAC/Policy constraints; - plan for cluster capacity and access changes.' - - 'Istio packaging changes: new Istio CNI and Istio CRDs charts are introduced - alongside Istio upgrades; this may require validating CNI behavior and CRD - installation/ownership in your cluster.' + chart_updates: [Big Bang umbrella chart version bump from 3.15.0 to 3.16.0 with + a large set of component chart version updates., 'Adds several new optional + packages/components to the stack (Backstage, bbctl, Gatekeeper, GitLab, + Grafana, Headlamp, Istio CNI/CRDs, Keycloak, Loki, Mimir, Monitoring, Prometheus + Operator CRDs, Sonarqube).', Removes the `updated` component/package (2025.6.1-bb.0).] + features: ['Introduces multiple new packages that can now be enabled in Big + Bang 3.16.0 (e.g., Backstage, GitLab, Grafana, Keycloak, Loki/Mimir/Monitoring, + Gatekeeper, Sonarqube).', 'Updates core platform components (Istio, Argo + CD, Authservice, Harbor, Kiali, Mattermost, Tempo, Velero, Vault, etc.) + to newer patch/minor versions.'] + breaking_changes: ['Potential operational impact: enabling newly-added components + may introduce new CRDs, namespaces, resource requirements, and RBAC/Policy + constraints; plan for cluster capacity and access changes.', 'Istio packaging + changes: new Istio CNI and Istio CRDs charts are introduced alongside Istio + upgrades; this may require validating CNI behavior and CRD installation/ownership + in your cluster.'] chart_version: 3.16.0 - images: - - registry1.dso.mil/ironbank/opensource/redis/redis8-slim:8.4.0 - - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 - - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 + images: ['registry1.dso.mil/ironbank/opensource/redis/redis8-slim:8.4.0', 'registry1.dso.mil/bigbang-ci/devops-tester:1.1.2', + 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] - version: 3.15.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.6 @@ -5159,21 +3722,18 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: - - Most bundled components (Backstage, bbctl, Gatekeeper, GitLab, Grafana, Headlamp, - Istio CNI/CRDs, Loki, Mimir, Monitoring, Prometheus Operator CRDs, SonarQube, - etc.) are removed in 3.15.0 compared to 3.14.1; any deployments relying on - Big Bang to install/manage these must be migrated to standalone charts/operators - or removed before/with the upgrade. - - Big Bang core version jumps from 7.1.5-bb.0 to 2025.6.1-bb.0, indicating a - major packaging/versioning change; expect potential breaking changes in defaults, - values, and component enablement paths, and validate all custom values against - the new chart schema. + breaking_changes: ['Most bundled components (Backstage, bbctl, Gatekeeper, GitLab, + Grafana, Headlamp, Istio CNI/CRDs, Loki, Mimir, Monitoring, Prometheus Operator + CRDs, SonarQube, etc.) are removed in 3.15.0 compared to 3.14.1; any deployments + relying on Big Bang to install/manage these must be migrated to standalone + charts/operators or removed before/with the upgrade.', 'Big Bang core version + jumps from 7.1.5-bb.0 to 2025.6.1-bb.0, indicating a major packaging/versioning + change; expect potential breaking changes in defaults, values, and component + enablement paths, and validate all custom values against the new chart schema.'] chart_version: 3.15.0 images: [] - version: 3.14.1 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.2.1-bb.6 @@ -5266,19 +3826,16 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Keycloak removed from the Big Bang release composition. - - 'A new component/version was introduced: `new` at `7.1.5-bb.0` (added).' - features: - - Introduces a new component (named `new`) pinned at version `7.1.5-bb.0`. - breaking_changes: - - Keycloak is removed (previously `7.1.4-bb.5`); any workloads relying on the - Keycloak package must migrate/disable related configuration before upgrading. + chart_updates: [Keycloak removed from the Big Bang release composition., 'A + new component/version was introduced: `new` at `7.1.5-bb.0` (added).'] + features: [Introduces a new component (named `new`) pinned at version `7.1.5-bb.0`.] + breaking_changes: [Keycloak is removed (previously `7.1.4-bb.5`); any workloads + relying on the Keycloak package must migrate/disable related configuration + before upgrading.] chart_version: 3.14.1 images: [] - version: 3.14.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.6 @@ -5371,30 +3928,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Bump/introduce multiple packaged components for Big Bang 3.14.0; see component - version list for exact chart version deltas. - - Add **Keycloak** as a new packaged component (introduced at `7.1.4-bb.5`). - - 'Update/refresh Big Bang-managed components: Gatekeeper, GitLab, GitLab Runner, - Kyverno, Loki, Monitoring stack, Nexus Repository Manager, Prometheus Operator - CRDs, Tempo, Thanos, Twistlock, and others.' - - "Remove package/version labeled `updated: 7.1.5-bb.0` (component name not\ - \ provided in notes\u2014confirm what was removed in upstream release notes\ - \ before upgrading)." - features: - - Keycloak is now available as a first-class Big Bang component, enabling bundled - identity/auth capabilities out of the box. - breaking_changes: - - "Potential breaking changes may come from the Monitoring stack upgrade (79.11.0\ - \ \u2192 80.4.1) and Prometheus Operator CRDs bump (24.0.0 \u2192 25.0.0);\ - \ verify CRD/application compatibility and perform CRD upgrade steps as recommended." - - "A component labeled `updated: 7.1.5-bb.0` was removed\u2014identify which\ - \ package this refers to and ensure you are not depending on it before upgrading." + chart_updates: [Bump/introduce multiple packaged components for Big Bang 3.14.0; + see component version list for exact chart version deltas., Add **Keycloak** + as a new packaged component (introduced at `7.1.4-bb.5`)., 'Update/refresh + Big Bang-managed components: Gatekeeper, GitLab, GitLab Runner, Kyverno, + Loki, Monitoring stack, Nexus Repository Manager, Prometheus Operator CRDs, + Tempo, Thanos, Twistlock, and others.', "Remove package/version labeled\ + \ `updated: 7.1.5-bb.0` (component name not provided in notes\u2014confirm\ + \ what was removed in upstream release notes before upgrading)."] + features: ['Keycloak is now available as a first-class Big Bang component, enabling + bundled identity/auth capabilities out of the box.'] + breaking_changes: ["Potential breaking changes may come from the Monitoring\ + \ stack upgrade (79.11.0 \u2192 80.4.1) and Prometheus Operator CRDs bump\ + \ (24.0.0 \u2192 25.0.0); verify CRD/application compatibility and perform\ + \ CRD upgrade steps as recommended.", "A component labeled `updated: 7.1.5-bb.0`\ + \ was removed\u2014identify which package this refers to and ensure you\ + \ are not depending on it before upgrading."] chart_version: 3.14.0 images: [] - version: 3.13.1 - kube: - - '1.34' + kube: ['1.34'] requirements: - name: Alloy version: 3.2.1-bb.5 @@ -5487,38 +4040,33 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "This Big Bang patch release (3.13.0 \u2192 3.13.1) introduces a large set\ - \ of components as newly managed by Big Bang (e.g., Argo CD, GitLab, Istio,\ - \ monitoring/logging stack, security tools)." - - "One component entry is listed as an update from `0.31.0-bb.6` to `7.1.5-bb.0`,\ - \ but the component name is missing in the provided notes\u2014verify in the\ - \ upstream Big Bang 3.13.1 release notes/changelog." - features: - - Adds Argo CD as a managed component (9.1.4-bb.0). - - Adds GitLab and GitLab Runner as managed components (9.6.1-bb.0 and 0.82.0-bb.4). - - Adds Istio (base CRDs, gateway, CNI, istiod) managed components (1.28.0-bb.0). - - 'Adds an observability stack: Monitoring (79.11.0-bb.0), Grafana (10.2.0-bb.1), - Loki (6.46.0-bb.0), Thanos (17.3.3-bb.0), Fluent Bit (0.54.0-bb.1).' - - 'Adds security/policy components: Kyverno Reporter (3.7.0-bb.0) and Twistlock - (0.23.0-bb.4).' - - 'Adds Elastic stack operators/charts: ECK Operator (3.2.0-bb.0) and Elasticsearch/Kibana - (1.34.0-bb.0).' - - Adds Authservice (1.1.1-bb.5), Kiali (2.19.0-bb.0), Mattermost (11.1.1-bb.1), - and Vault (0.31.0-bb.6) as managed components. - breaking_changes: - - "This upgrade effectively changes scope: many components become newly installed/managed\ - \ by Big Bang, which can create new namespaces, CRDs, webhooks, and controllers\u2014\ - treat as a substantial platform change even though it is a patch release." - - "Potential conflicts if you already run any of these components independently\ - \ (Argo CD, Istio, GitLab, monitoring/logging, Elastic, Vault, etc.); you\ - \ may need to disable Big Bang\u2019s versions or plan migrations to avoid\ - \ duplicate CRDs/controllers/services." + chart_updates: ["This Big Bang patch release (3.13.0 \u2192 3.13.1) introduces\ + \ a large set of components as newly managed by Big Bang (e.g., Argo CD,\ + \ GitLab, Istio, monitoring/logging stack, security tools).", "One component\ + \ entry is listed as an update from `0.31.0-bb.6` to `7.1.5-bb.0`, but the\ + \ component name is missing in the provided notes\u2014verify in the upstream\ + \ Big Bang 3.13.1 release notes/changelog."] + features: [Adds Argo CD as a managed component (9.1.4-bb.0)., Adds GitLab and + GitLab Runner as managed components (9.6.1-bb.0 and 0.82.0-bb.4)., 'Adds + Istio (base CRDs, gateway, CNI, istiod) managed components (1.28.0-bb.0).', + 'Adds an observability stack: Monitoring (79.11.0-bb.0), Grafana (10.2.0-bb.1), + Loki (6.46.0-bb.0), Thanos (17.3.3-bb.0), Fluent Bit (0.54.0-bb.1).', 'Adds + security/policy components: Kyverno Reporter (3.7.0-bb.0) and Twistlock + (0.23.0-bb.4).', 'Adds Elastic stack operators/charts: ECK Operator (3.2.0-bb.0) + and Elasticsearch/Kibana (1.34.0-bb.0).', 'Adds Authservice (1.1.1-bb.5), + Kiali (2.19.0-bb.0), Mattermost (11.1.1-bb.1), and Vault (0.31.0-bb.6) as + managed components.'] + breaking_changes: ["This upgrade effectively changes scope: many components\ + \ become newly installed/managed by Big Bang, which can create new namespaces,\ + \ CRDs, webhooks, and controllers\u2014treat as a substantial platform change\ + \ even though it is a patch release.", "Potential conflicts if you already\ + \ run any of these components independently (Argo CD, Istio, GitLab, monitoring/logging,\ + \ Elastic, Vault, etc.); you may need to disable Big Bang\u2019s versions\ + \ or plan migrations to avoid duplicate CRDs/controllers/services."] chart_version: 3.13.1 images: [] - version: 3.13.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.5 @@ -5605,33 +4153,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 3.13.0 release notes indicate a major packaging change where nearly - all previously bundled components are now listed as removed compared to 3.12.0. - - "A new/updated component entry is shown as \u201Cupdated: new (added at 0.31.0-bb.6)\u201D\ - , but the component name is not provided in the supplied notes (needs verification\ - \ from the upstream changelog)." - features: - - Possible introduction of a new component (added at version 0.31.0-bb.6), but - the name and function are not included in the provided notes and must be confirmed. - breaking_changes: - - Big Bang 3.13.0 appears to remove a large set of previously included/managed - components (Argo CD, Istio, GitLab, Monitoring stack, Loki, Vault, etc.). - This is a major breaking change for upgrade plans because ownership/installation - of these components would shift away from Big Bang or require separate installation/management. + chart_updates: [Big Bang 3.13.0 release notes indicate a major packaging change + where nearly all previously bundled components are now listed as removed + compared to 3.12.0., "A new/updated component entry is shown as \u201Cupdated:\ + \ new (added at 0.31.0-bb.6)\u201D, but the component name is not provided\ + \ in the supplied notes (needs verification from the upstream changelog)."] + features: ['Possible introduction of a new component (added at version 0.31.0-bb.6), + but the name and function are not included in the provided notes and must + be confirmed.'] + breaking_changes: ['Big Bang 3.13.0 appears to remove a large set of previously + included/managed components (Argo CD, Istio, GitLab, Monitoring stack, Loki, + Vault, etc.). This is a major breaking change for upgrade plans because + ownership/installation of these components would shift away from Big Bang + or require separate installation/management.'] chart_version: 3.13.0 - images: - - registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.1 - - registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.7 - - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.32.6 - - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5 - - registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.1 - - registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.4 - - registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.1 - - registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.5 + images: ['registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.1', 'registry1.dso.mil/ironbank/opensource/grafana/loki:3.5.7', + 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.32.6', 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5', + 'registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.1', + 'registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner:3.5.4', + 'registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.1', 'registry1.dso.mil/ironbank/bigbang/grafana/loki-canary:3.5.5'] - version: 3.12.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.5 @@ -5726,27 +4268,22 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart release from 3.11.0 to 3.12.0 primarily bumps component - (subchart) versions; no explicit chart template changes were provided in the - notes you shared. - features: - - Backstage bumped to 2.6.3-bb.0 (may include new Backstage features/fixes vs - 2.5.3). - - Kyverno bumped to 3.6.0-bb.1 (new policy engine features/fixes vs 3.5.2). - - Mattermost bumped to 11.1.0-bb.0 (new Mattermost features/fixes vs 11.0.4). - breaking_changes: - - "No explicit breaking changes were included in the release notes excerpt you\ - \ provided; treat component minor bumps (e.g., Kyverno 3.5\u21923.6, Mattermost\ - \ 11.0\u219211.1, Headlamp 0.36\u21920.37) as potential behavior changes and\ - \ review each component\u2019s upstream/bb release notes before upgrading." + chart_updates: [Big Bang umbrella chart release from 3.11.0 to 3.12.0 primarily + bumps component (subchart) versions; no explicit chart template changes + were provided in the notes you shared.] + features: [Backstage bumped to 2.6.3-bb.0 (may include new Backstage features/fixes + vs 2.5.3)., Kyverno bumped to 3.6.0-bb.1 (new policy engine features/fixes + vs 3.5.2)., Mattermost bumped to 11.1.0-bb.0 (new Mattermost features/fixes + vs 11.0.4).] + breaking_changes: ["No explicit breaking changes were included in the release\ + \ notes excerpt you provided; treat component minor bumps (e.g., Kyverno\ + \ 3.5\u21923.6, Mattermost 11.0\u219211.1, Headlamp 0.36\u21920.37) as potential\ + \ behavior changes and review each component\u2019s upstream/bb release\ + \ notes before upgrading."] chart_version: 3.12.0 - images: - - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 - - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 + images: ['registry1.dso.mil/bigbang-ci/devops-tester:1.1.2', 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] - version: 3.11.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.5 @@ -5842,20 +4379,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No concrete feature details were provided in the pasted release notes; only - an admin message about currently supported Big Bang versions appears for 3.10.0 - and 3.11.0. - breaking_changes: - - No breaking-change information was provided in the pasted release notes. + features: [No concrete feature details were provided in the pasted release notes; + only an admin message about currently supported Big Bang versions appears + for 3.10.0 and 3.11.0.] + breaking_changes: [No breaking-change information was provided in the pasted + release notes.] chart_version: 3.11.0 - images: - - registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-09-07T16-13-09Z - - registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-10-15T17-29-55Z - - registry1.dso.mil/ironbank/big-bang/devops-tester:1.0 + images: ['registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-09-07T16-13-09Z', + 'registry1.dso.mil/ironbank/opensource/minio/minio:RELEASE.2025-10-15T17-29-55Z', + 'registry1.dso.mil/ironbank/big-bang/devops-tester:1.0'] - version: 3.10.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.4 @@ -5950,32 +4484,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang platform release bump from **3.9.0 \u2192 3.10.0** with multiple\ - \ packaged component chart version updates." - - "Notable chart version jumps include **Argo CD 8.5.8-bb.2 \u2192 9.0.3-bb.0**\ - \ (major chart upgrade) and **Mattermost 10.12.0-bb.1 \u2192 11.0.2-bb.0**\ - \ (major app/chart upgrade)." - - "Istio stack patched **1.27.1 \u2192 1.27.3** across CNI/CRDs/Gateway/Istiod." - - Various bb patch bumps across components (e.g., Alloy, Anchore, GitLab, Harbor, - Velero) indicating Big Bang-specific fixes rather than upstream major changes. - features: - - No explicit new features were provided in the notes excerpt; this release - primarily appears to be a roll-up of component version updates and Big Bang - packaging fixes. - breaking_changes: - - "Potential breaking change risk due to **Argo CD chart major version upgrade\ - \ (8.x \u2192 9.x)**; verify Argo CD values compatibility and CRD/app-of-apps\ - \ behavior before upgrade." - - "Potential breaking change risk due to **Mattermost major upgrade (10.x \u2192\ - \ 11.x)**; confirm database/schema upgrade requirements and any config deprecations." + chart_updates: ["Big Bang platform release bump from **3.9.0 \u2192 3.10.0**\ + \ with multiple packaged component chart version updates.", "Notable chart\ + \ version jumps include **Argo CD 8.5.8-bb.2 \u2192 9.0.3-bb.0** (major\ + \ chart upgrade) and **Mattermost 10.12.0-bb.1 \u2192 11.0.2-bb.0** (major\ + \ app/chart upgrade).", "Istio stack patched **1.27.1 \u2192 1.27.3** across\ + \ CNI/CRDs/Gateway/Istiod.", 'Various bb patch bumps across components (e.g., + Alloy, Anchore, GitLab, Harbor, Velero) indicating Big Bang-specific fixes + rather than upstream major changes.'] + features: [No explicit new features were provided in the notes excerpt; this + release primarily appears to be a roll-up of component version updates and + Big Bang packaging fixes.] + breaking_changes: ["Potential breaking change risk due to **Argo CD chart major\ + \ version upgrade (8.x \u2192 9.x)**; verify Argo CD values compatibility\ + \ and CRD/app-of-apps behavior before upgrade.", "Potential breaking change\ + \ risk due to **Mattermost major upgrade (10.x \u2192 11.x)**; confirm database/schema\ + \ upgrade requirements and any config deprecations."] chart_version: 3.10.0 - images: - - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5 - - registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33 + images: ['registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33.5', 'registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.33'] - version: 3.9.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.3 @@ -6070,29 +4598,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang minor release from 3.8.0 to 3.9.0 with component chart version bumps - across multiple packages (Argo CD, Authservice, ESO, Gatekeeper, Grafana, - Harbor, Keycloak, Vault, etc.). - - "No explicit helm values migrations or chart structure changes were provided\ - \ in the supplied notes; treat as a dependency refresh and review each package\u2019\ - s own CHANGELOG for required values updates." - features: - - Various component updates bring incremental fixes and improvements (e.g., - Argo CD, External Secrets Operator, Gatekeeper, Grafana, Harbor, Keycloak, - Vault), but no specific new Big Bang-level features were listed in the provided - excerpt. - breaking_changes: - - "Potential breaking changes may come from major/minor bumps in included components\ - \ (notably Grafana 9.x \u2192 10.0, Authservice 1.0 \u2192 1.1, ESO 0.19 \u2192\ - \ 0.20, Gatekeeper 3.19 \u2192 3.20, Vault 0.30 \u2192 0.31, Keycloak chart\ - \ 7.0 \u2192 7.1). Verify each component\u2019s release notes for deprecations\ - \ and value changes before upgrading." + chart_updates: ['Big Bang minor release from 3.8.0 to 3.9.0 with component chart + version bumps across multiple packages (Argo CD, Authservice, ESO, Gatekeeper, + Grafana, Harbor, Keycloak, Vault, etc.).', "No explicit helm values migrations\ + \ or chart structure changes were provided in the supplied notes; treat\ + \ as a dependency refresh and review each package\u2019s own CHANGELOG for\ + \ required values updates."] + features: ['Various component updates bring incremental fixes and improvements + (e.g., Argo CD, External Secrets Operator, Gatekeeper, Grafana, Harbor, + Keycloak, Vault), but no specific new Big Bang-level features were listed + in the provided excerpt.'] + breaking_changes: ["Potential breaking changes may come from major/minor bumps\ + \ in included components (notably Grafana 9.x \u2192 10.0, Authservice 1.0\ + \ \u2192 1.1, ESO 0.19 \u2192 0.20, Gatekeeper 3.19 \u2192 3.20, Vault 0.30\ + \ \u2192 0.31, Keycloak chart 7.0 \u2192 7.1). Verify each component\u2019\ + s release notes for deprecations and value changes before upgrading."] chart_version: 3.9.0 images: [] - version: 3.8.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.2 @@ -6188,18 +4712,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No actionable application release notes were provided beyond the header and - an admin message stating the currently supported Big Bang version is 3.25.0. - breaking_changes: - - Release notes content for 3.7.0 and 3.8.0 was not included, so breaking changes - (if any) cannot be determined from the provided text. + features: [No actionable application release notes were provided beyond the + header and an admin message stating the currently supported Big Bang version + is 3.25.0.] + breaking_changes: ['Release notes content for 3.7.0 and 3.8.0 was not included, + so breaking changes (if any) cannot be determined from the provided text.'] chart_version: 3.8.0 - images: - - registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6 + images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6'] - version: 3.7.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.1 @@ -6295,15 +4816,13 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang 3.7.0 indicates the supported Big Bang Version in the admin message - is 3.25.0 (up from 3.23.0 in 3.6.0). + features: [Big Bang 3.7.0 indicates the supported Big Bang Version in the admin + message is 3.25.0 (up from 3.23.0 in 3.6.0).] breaking_changes: [] chart_version: 3.7.0 images: [] - version: 3.6.0 - kube: - - '1.33' + kube: ['1.33'] requirements: - name: Alloy version: 3.2.1-bb.1 @@ -6399,17 +4918,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided only show an 'Admin message' about the currently supported - Big Bang version; no feature details were included in the excerpts. - breaking_changes: - - Cannot determine breaking changes from the provided excerpts; only the supported-version - notice is shown. + features: [Release notes provided only show an 'Admin message' about the currently + supported Big Bang version; no feature details were included in the excerpts.] + breaking_changes: [Cannot determine breaking changes from the provided excerpts; + only the supported-version notice is shown.] chart_version: 3.6.0 images: [] - version: 3.5.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 3.2.1-bb.1 @@ -6502,28 +5018,23 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Component version bumps across multiple packages (Anchore, GitLab, Grafana, - Harbor, Headlamp, Istiod, Keycloak, Kiali, Loki, Mattermost, Minio, Monitoring, - NeuVector, Velero, External Secrets Operator). - - Added `prometheus-operator-crds` package (22.0.1-bb.0). - - Removed `promtail` package. - - Removed package labeled `New` (22.0.1-bb.0) that existed in 3.4.0 context. - features: - - Introduces Prometheus Operator CRDs as a dedicated package, which can simplify - CRD lifecycle management and reduce CRD-related upgrade issues. - breaking_changes: - - Removal of Promtail means any log shipping previously handled by Promtail - must be replaced/disabled in values and validated (e.g., ensure Loki ingestion - still has an agent such as Grafana Agent/Alloy/Fluent Bit if required). - - If `New` package was deployed/relied upon, it is no longer available; confirm - no values reference it and migrate any functionality accordingly. + chart_updates: ['Component version bumps across multiple packages (Anchore, + GitLab, Grafana, Harbor, Headlamp, Istiod, Keycloak, Kiali, Loki, Mattermost, + Minio, Monitoring, NeuVector, Velero, External Secrets Operator).', Added + `prometheus-operator-crds` package (22.0.1-bb.0)., Removed `promtail` package., + Removed package labeled `New` (22.0.1-bb.0) that existed in 3.4.0 context.] + features: ['Introduces Prometheus Operator CRDs as a dedicated package, which + can simplify CRD lifecycle management and reduce CRD-related upgrade issues.'] + breaking_changes: ['Removal of Promtail means any log shipping previously handled + by Promtail must be replaced/disabled in values and validated (e.g., ensure + Loki ingestion still has an agent such as Grafana Agent/Alloy/Fluent Bit + if required).', 'If `New` package was deployed/relied upon, it is no longer + available; confirm no values reference it and migrate any functionality + accordingly.'] chart_version: 3.5.0 - images: - - registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.12.1 + images: ['registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.12.1'] - version: 3.4.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 3.2.1-bb.1 @@ -6618,34 +5129,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart upgraded from 3.3.0 to 3.4.0, pulling newer versions - of many packaged components (Argo CD, GitLab, Istio, Kiali, Thanos, etc.). - - "Component bumps include several patch-level bb revisions (e.g., Anchore,\ - \ ESO, Harbor, Monitoring, Vault) and some minor/feature bumps (e.g., Argo\ - \ CD 8.0.10\u21928.2.5, GitLab 9.1.2\u21929.2.1, Kiali 2.10\u21922.12, Thanos\ - \ 16.0.2\u219217.2.2, Nexus 81.1.0\u219282.0.0)." - - A new component (listed as "New" version 22.0.1-bb.0) is introduced in 3.4.0; - validate what it is and whether it is enabled by default in your values. - features: - - Introduces a new packaged component ("New" at 22.0.1-bb.0); confirm its purpose, - defaults, and required configuration before enabling. - - Updates observability stack components (Alloy, Fluentbit, Thanos) which may - bring new metrics/logging behavior and configuration options. - - Upgrades delivery and platform tooling (Argo CD, GitLab, GitLab Runner, Headlamp, - Kiali) bringing incremental features and fixes from upstream charts. - breaking_changes: - - "No explicit breaking changes were provided in the notes you shared; treat\ - \ major/minor bumps (Thanos 16\u219217, Nexus 81\u219282, Kiali 2.10\u2192\ - 2.12, Argo CD 8.0\u21928.2) as potential sources of behavioral changes and\ - \ review each component\u2019s upstream upgrade notes before production rollout." + chart_updates: ['Big Bang umbrella chart upgraded from 3.3.0 to 3.4.0, pulling + newer versions of many packaged components (Argo CD, GitLab, Istio, Kiali, + Thanos, etc.).', "Component bumps include several patch-level bb revisions\ + \ (e.g., Anchore, ESO, Harbor, Monitoring, Vault) and some minor/feature\ + \ bumps (e.g., Argo CD 8.0.10\u21928.2.5, GitLab 9.1.2\u21929.2.1, Kiali\ + \ 2.10\u21922.12, Thanos 16.0.2\u219217.2.2, Nexus 81.1.0\u219282.0.0).", + A new component (listed as "New" version 22.0.1-bb.0) is introduced in 3.4.0; + validate what it is and whether it is enabled by default in your values.] + features: ['Introduces a new packaged component ("New" at 22.0.1-bb.0); confirm + its purpose, defaults, and required configuration before enabling.', 'Updates + observability stack components (Alloy, Fluentbit, Thanos) which may bring + new metrics/logging behavior and configuration options.', 'Upgrades delivery + and platform tooling (Argo CD, GitLab, GitLab Runner, Headlamp, Kiali) bringing + incremental features and fixes from upstream charts.'] + breaking_changes: ["No explicit breaking changes were provided in the notes\ + \ you shared; treat major/minor bumps (Thanos 16\u219217, Nexus 81\u2192\ + 82, Kiali 2.10\u21922.12, Argo CD 8.0\u21928.2) as potential sources of\ + \ behavioral changes and review each component\u2019s upstream upgrade notes\ + \ before production rollout."] chart_version: 3.4.0 - images: - - registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.10 - - registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6 + images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.10', 'registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.6'] - version: 3.3.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 3.0.2-bb.0 @@ -6738,33 +5244,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang umbrella chart upgraded from 3.2.0 to 3.3.0, updating and adding - multiple packaged components (see version list below). - - 'New optional packages introduced in this release include: GitLab, Harbor, - Grafana, Loki, Vault, Mattermost, Nexus Repository Manager, SonarQube, External - Secrets Operator, Headlamp, Kiali, Kyverno Reporter, Istio Gateway, Elasticsearch - Kibana, and bbctl.' - features: - - "Introduces several new built-in packages (e.g., GitLab, Harbor, Grafana/Loki\ - \ stack, Vault, Mattermost, Nexus, SonarQube) that can be enabled to expand\ - \ the platform\u2019s CI/CD, artifact, observability, and secrets capabilities." - - Adds External Secrets Operator as an available integration for syncing secrets - from external backends. - - Adds bbctl as a new component to assist with Big Bang operations (packaged - starting 2.0.0-bb.3). - breaking_changes: - - "No explicit breaking changes were provided in the notes you supplied; however,\ - \ multiple major version bumps (e.g., Alloy 2\u21923, Anchore 3.7\u21923.10,\ - \ Kyverno 3.3\u21923.4, Monitoring 73\u219275, Istio 1.26.1\u21921.26.2) may\ - \ include behavior changes and should be treated as potential breaking changes\ - \ pending upstream component release notes." + chart_updates: ['Big Bang umbrella chart upgraded from 3.2.0 to 3.3.0, updating + and adding multiple packaged components (see version list below).', 'New + optional packages introduced in this release include: GitLab, Harbor, Grafana, + Loki, Vault, Mattermost, Nexus Repository Manager, SonarQube, External Secrets + Operator, Headlamp, Kiali, Kyverno Reporter, Istio Gateway, Elasticsearch + Kibana, and bbctl.'] + features: ["Introduces several new built-in packages (e.g., GitLab, Harbor,\ + \ Grafana/Loki stack, Vault, Mattermost, Nexus, SonarQube) that can be enabled\ + \ to expand the platform\u2019s CI/CD, artifact, observability, and secrets\ + \ capabilities.", Adds External Secrets Operator as an available integration + for syncing secrets from external backends., Adds bbctl as a new component + to assist with Big Bang operations (packaged starting 2.0.0-bb.3).] + breaking_changes: ["No explicit breaking changes were provided in the notes\ + \ you supplied; however, multiple major version bumps (e.g., Alloy 2\u2192\ + 3, Anchore 3.7\u21923.10, Kyverno 3.3\u21923.4, Monitoring 73\u219275, Istio\ + \ 1.26.1\u21921.26.2) may include behavior changes and should be treated\ + \ as potential breaking changes pending upstream component release notes."] chart_version: 3.3.0 - images: - - registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-mailroom:18.1.0 + images: ['registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-mailroom:18.1.0'] - version: 3.2.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 2.0.27-bb.3 @@ -6857,27 +5357,22 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 3.2.0 release removes a large set of previously bundled components - from the umbrella chart. - - A new component entry appears as `new` at version `0.30.0-bb.7` (exact identity - unclear from provided notes). - features: - - 'Slimmer Big Bang bundle: many optional add-ons are no longer included by - default and must be deployed separately if needed.' - breaking_changes: - - 'Removal of bundled components (bbctl, GitLab, Harbor, Grafana, Loki, Vault, - Istio Gateway, Kiali, etc.) is a breaking change: existing installations relying - on these being managed by Big Bang will no longer be upgraded/managed and - may be removed depending on your Helm values and existing releases.' - - Any values previously set under removed components in `values.yaml` will become - unused/invalid; you must migrate those components to separate charts/operators - or alternative deployment methods. + chart_updates: [Big Bang 3.2.0 release removes a large set of previously bundled + components from the umbrella chart., A new component entry appears as `new` + at version `0.30.0-bb.7` (exact identity unclear from provided notes).] + features: ['Slimmer Big Bang bundle: many optional add-ons are no longer included + by default and must be deployed separately if needed.'] + breaking_changes: ['Removal of bundled components (bbctl, GitLab, Harbor, Grafana, + Loki, Vault, Istio Gateway, Kiali, etc.) is a breaking change: existing + installations relying on these being managed by Big Bang will no longer + be upgraded/managed and may be removed depending on your Helm values and + existing releases.', Any values previously set under removed components + in `values.yaml` will become unused/invalid; you must migrate those components + to separate charts/operators or alternative deployment methods.] chart_version: 3.2.0 images: [] - version: 3.1.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 2.0.27-bb.3 @@ -6970,29 +5465,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang meta-chart updated from 3.0.0 to 3.1.0, updating bundled component\ - \ charts to the listed versions (notable jumps: ArgoCD 7.9.0-bb.0\u21928.0.10-bb.0,\ - \ Istio 1.25.3\u21921.26.1, Monitoring 72.2.0\u219273.2.0, Velero 8.7.1\u2192\ - 10.0.1, External Secrets 0.16.2\u21920.17.0, Twistlock 0.20.1\u21920.21.0,\ - \ Headlamp 0.30.1\u21920.31.1)." - features: - - Component refresh across the distribution, including newer ArgoCD (major chart - bump), Istio 1.26, and Monitoring chart update. - - Velero upgraded to the 10.x chart series, bringing in upstream changes and - potentially new CRDs/backup flow behavior. - breaking_changes: - - "Potential breaking changes due to major version bumps in ArgoCD chart (7.x\u2192\ - 8.x) and Velero chart (8.x\u219210.x); review each component\u2019s upgrade\ - \ notes for required CRD/application changes and value deprecations." - - "Istio upgrade 1.25\u21921.26 may require API/CRD and mesh behavior validation;\ - \ ensure CRDs and gateways are upgraded in correct order (CRDs before control\ - \ plane/gateways)." + chart_updates: ["Big Bang meta-chart updated from 3.0.0 to 3.1.0, updating bundled\ + \ component charts to the listed versions (notable jumps: ArgoCD 7.9.0-bb.0\u2192\ + 8.0.10-bb.0, Istio 1.25.3\u21921.26.1, Monitoring 72.2.0\u219273.2.0, Velero\ + \ 8.7.1\u219210.0.1, External Secrets 0.16.2\u21920.17.0, Twistlock 0.20.1\u2192\ + 0.21.0, Headlamp 0.30.1\u21920.31.1)."] + features: ['Component refresh across the distribution, including newer ArgoCD + (major chart bump), Istio 1.26, and Monitoring chart update.', 'Velero upgraded + to the 10.x chart series, bringing in upstream changes and potentially new + CRDs/backup flow behavior.'] + breaking_changes: ["Potential breaking changes due to major version bumps in\ + \ ArgoCD chart (7.x\u21928.x) and Velero chart (8.x\u219210.x); review each\ + \ component\u2019s upgrade notes for required CRD/application changes and\ + \ value deprecations.", "Istio upgrade 1.25\u21921.26 may require API/CRD\ + \ and mesh behavior validation; ensure CRDs and gateways are upgraded in\ + \ correct order (CRDs before control plane/gateways)."] chart_version: 3.1.0 images: [] - version: 3.0.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 2.0.27-bb.0 @@ -7086,18 +5577,16 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No detailed Big Bang 3.0.0 release notes were provided in the excerpt beyond - the admin message indicating the currently supported Big Bang version (3.22.1). - breaking_changes: - - "Upgrade crosses a major version boundary (2.x \u2192 3.x), so assume breaking\ - \ changes exist; review the full 3.0.0 release notes and Big Bang upgrade\ - \ guides before proceeding." + features: [No detailed Big Bang 3.0.0 release notes were provided in the excerpt + beyond the admin message indicating the currently supported Big Bang version + (3.22.1).] + breaking_changes: ["Upgrade crosses a major version boundary (2.x \u2192 3.x),\ + \ so assume breaking changes exist; review the full 3.0.0 release notes\ + \ and Big Bang upgrade guides before proceeding."] chart_version: 3.0.0 images: [] - version: 2.54.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Alloy version: 2.0.27-bb.0 @@ -7199,20 +5688,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided only include the \u201CAdmin message\u201D about the\ - \ currently supported Big Bang version; no other feature details were included." - breaking_changes: - - "Potential compatibility/support break: the \u201Ccurrently supported Big\ - \ Bang version\u201D differs between 2.53.0 (3.23.0) and 2.54.0 (3.20.0) per\ - \ the provided notes; verify intended support matrix and whether this indicates\ - \ a documentation/error or a change in supported upstream dependencies." + features: ["Release notes provided only include the \u201CAdmin message\u201D\ + \ about the currently supported Big Bang version; no other feature details\ + \ were included."] + breaking_changes: ["Potential compatibility/support break: the \u201Ccurrently\ + \ supported Big Bang version\u201D differs between 2.53.0 (3.23.0) and 2.54.0\ + \ (3.20.0) per the provided notes; verify intended support matrix and whether\ + \ this indicates a documentation/error or a change in supported upstream\ + \ dependencies."] chart_version: 2.54.0 - images: - - registry1.dso.mil/bigbang/istio-gateway:1.25.2-bb.1 + images: ['registry1.dso.mil/bigbang/istio-gateway:1.25.2-bb.1'] - version: 2.53.0 - kube: - - '1.32' + kube: ['1.32'] requirements: - name: Updated version: 2.0.27-bb.0 @@ -7313,30 +5800,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang core version updated from 2.52.0 to 2.53.0. - - 'Large component set reshuffle: multiple components newly added and many removed - (see breaking changes).' - features: - - 'Adds/introduces several components to the Big Bang bundle: bbctl, ECK Operator, - Elasticsearch/Kibana, Istio CRDs and Gateway, Jaeger, Kyverno Policies, MinIO - and MinIO Operator, Nexus, Thanos, Twistlock.' - - Updates some existing component versions (notably one component from 0.30.0-bb.1 - to 0.4.15 and another from 2.5.1-bb.0 to 0.30.1-bb.1). - breaking_changes: - - Removes many previously-included components (Alloy, Anchore Enterprise, Authservice, - External Secrets, Fluentbit, Gitlab Runner, Istio Controlplane, Kiali, Mattermost - Operator, Neuvector, Promtail, Tempo, Wrapper). This can break deployments - relying on those charts/CRDs/values or related integrations. - - 'Istio packaging changes: Istio Controlplane is removed and replaced by separate - Istio CRDs and Istio Gateway components, requiring review of Istio-related - values and manifests.' + chart_updates: [Big Bang core version updated from 2.52.0 to 2.53.0., 'Large + component set reshuffle: multiple components newly added and many removed + (see breaking changes).'] + features: ['Adds/introduces several components to the Big Bang bundle: bbctl, + ECK Operator, Elasticsearch/Kibana, Istio CRDs and Gateway, Jaeger, Kyverno + Policies, MinIO and MinIO Operator, Nexus, Thanos, Twistlock.', Updates + some existing component versions (notably one component from 0.30.0-bb.1 + to 0.4.15 and another from 2.5.1-bb.0 to 0.30.1-bb.1).] + breaking_changes: ['Removes many previously-included components (Alloy, Anchore + Enterprise, Authservice, External Secrets, Fluentbit, Gitlab Runner, Istio + Controlplane, Kiali, Mattermost Operator, Neuvector, Promtail, Tempo, Wrapper). + This can break deployments relying on those charts/CRDs/values or related + integrations.', 'Istio packaging changes: Istio Controlplane is removed + and replaced by separate Istio CRDs and Istio Gateway components, requiring + review of Istio-related values and manifests.'] chart_version: 2.53.0 - images: - - docker.io/grafana/grafana-image-renderer:latest + images: ['docker.io/grafana/grafana-image-renderer:latest'] - version: 2.52.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Alloy version: 2.0.23-bb.0 @@ -7437,15 +5919,13 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: - - "Release notes provided only include an admin message about the currently\ - \ supported Big Bang version; no functional changes, features, or breaking\ - \ changes were listed for 2.51.0 \u2192 2.52.0." + breaking_changes: ["Release notes provided only include an admin message about\ + \ the currently supported Big Bang version; no functional changes, features,\ + \ or breaking changes were listed for 2.51.0 \u2192 2.52.0."] chart_version: 2.52.0 images: [] - version: 2.51.0 - kube: - - '1.31' + kube: ['1.31'] requirements: - name: Updated version: 2.0.23-bb.0 @@ -7539,19 +6019,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Admin message indicates the 'Currently supported Big Bang Version' increased - from 3.20.0 (in 2.50.0 notes) to 3.25.0 (in 2.51.0 notes). + features: [Admin message indicates the 'Currently supported Big Bang Version' + increased from 3.20.0 (in 2.50.0 notes) to 3.25.0 (in 2.51.0 notes).] breaking_changes: [] chart_version: 2.51.0 - images: - - registry-1.docker.io/bitnamicharts/postgresql:16.6.0 - - registry1.dso.mil/ironbank/big-bang/base:2.1.0 - - registry1.dso.mil/ironbank/stedolan/jq:1.7.1 - - registry1.dso.mil/bigbang-ci/devops-tester:1.1.2 + images: ['registry-1.docker.io/bitnamicharts/postgresql:16.6.0', 'registry1.dso.mil/ironbank/big-bang/base:2.1.0', + 'registry1.dso.mil/ironbank/stedolan/jq:1.7.1', 'registry1.dso.mil/bigbang-ci/devops-tester:1.1.2'] - version: 2.50.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 2.0.16-bb.2 @@ -7643,19 +6118,16 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No functional changes identified from the provided notes; only an 'Admin message' - about the currently supported Big Bang version is shown. - breaking_changes: - - 'Potential support/policy change: the ''Currently supported Big Bang Version'' - message changes between 2.49.0 (3.22.1) and 2.50.0 (3.20.0). This may indicate - a documentation/support statement change rather than a breaking runtime change, - but verify before upgrading.' + features: [No functional changes identified from the provided notes; only an + 'Admin message' about the currently supported Big Bang version is shown.] + breaking_changes: ['Potential support/policy change: the ''Currently supported + Big Bang Version'' message changes between 2.49.0 (3.22.1) and 2.50.0 (3.20.0). + This may indicate a documentation/support statement change rather than a + breaking runtime change, but verify before upgrading.'] chart_version: 2.50.0 images: [] - version: 2.49.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 2.0.16-bb.0 @@ -7746,28 +6218,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang chart version updated from `0.29.1-bb.8` to `0.29.1-bb.9`. - - 'Large component set change: multiple packages removed and multiple new packages - added (see features/breaking changes).' - features: - - Adds several new optional/managed packages to the Big Bang release (Elasticsearch - Kibana, Fluentbit, Grafana, Holocron, Istio Controlplane/Operator, Kyverno, - Kyverno Reporter, Minio, Promtail, Tempo). - - Introduces an updated Big Bang chart build (`0.29.1-bb.9`). - breaking_changes: - - Removes multiple previously-included packages from the distribution (Anchore - Enterprise, Gatekeeper, Gitlab Runner, Jaeger, Kiali, Kyverno Policies, Metrics - Server, Monitoring, Twistlock). Upgrade may require disabling/migrating these - workloads and adjusting values, CRDs, and dependencies accordingly. - - If you relied on removed observability/security components (Monitoring stack, - Jaeger, Kiali, Twistlock, Anchore), you must plan replacements (e.g., Grafana/Tempo/Promtail/Fluentbit) - and ensure data/alerting/tracing continuity. + chart_updates: [Big Bang chart version updated from `0.29.1-bb.8` to `0.29.1-bb.9`., + 'Large component set change: multiple packages removed and multiple new packages + added (see features/breaking changes).'] + features: ['Adds several new optional/managed packages to the Big Bang release + (Elasticsearch Kibana, Fluentbit, Grafana, Holocron, Istio Controlplane/Operator, + Kyverno, Kyverno Reporter, Minio, Promtail, Tempo).', Introduces an updated + Big Bang chart build (`0.29.1-bb.9`).] + breaking_changes: ['Removes multiple previously-included packages from the distribution + (Anchore Enterprise, Gatekeeper, Gitlab Runner, Jaeger, Kiali, Kyverno Policies, + Metrics Server, Monitoring, Twistlock). Upgrade may require disabling/migrating + these workloads and adjusting values, CRDs, and dependencies accordingly.', + 'If you relied on removed observability/security components (Monitoring stack, + Jaeger, Kiali, Twistlock, Anchore), you must plan replacements (e.g., Grafana/Tempo/Promtail/Fluentbit) + and ensure data/alerting/tracing continuity.'] chart_version: 2.49.0 images: [] - version: 2.48.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 2.0.4-bb.0 @@ -7857,17 +6325,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Admin message updates the \u201CCurrently supported Big Bang Version\u201D\ - \ from 3.23.0 (in 2.47.0 notes) to 3.22.1 (in 2.48.0 notes)." + features: ["Admin message updates the \u201CCurrently supported Big Bang Version\u201D\ + \ from 3.23.0 (in 2.47.0 notes) to 3.22.1 (in 2.48.0 notes)."] breaking_changes: [] chart_version: 2.48.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:3.0.0 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:3.0.0'] - version: 2.47.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Alloy version: 1.6.18-bb.0 @@ -7956,23 +6421,19 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang version bump: 2.46.0 \u2192 2.47.0." - - 'Large component set change: multiple packages added and multiple packages - removed (see lists).' - features: - - Adds several new optional packages to the Big Bang bundle (Anchore Enterprise, - ECK Operator, Elasticsearch/Kibana, GitLab Runner, Kyverno, Mimir, Nexus, - Sonarqube, Twistlock, Velero). - breaking_changes: - - Removes multiple previously-included packages (Authservice, HAProxy, Keycloak, - Neuvector, Promtail and others listed), which can break clusters relying on - those components for auth, ingress, security scanning, or logging. + chart_updates: ["Big Bang version bump: 2.46.0 \u2192 2.47.0.", 'Large component + set change: multiple packages added and multiple packages removed (see lists).'] + features: ['Adds several new optional packages to the Big Bang bundle (Anchore + Enterprise, ECK Operator, Elasticsearch/Kibana, GitLab Runner, Kyverno, + Mimir, Nexus, Sonarqube, Twistlock, Velero).'] + breaking_changes: ['Removes multiple previously-included packages (Authservice, + HAProxy, Keycloak, Neuvector, Promtail and others listed), which can break + clusters relying on those components for auth, ingress, security scanning, + or logging.'] chart_version: 2.47.0 images: [] - version: 2.46.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Alloy version: 1.6.18-bb.0 @@ -8061,37 +6522,32 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.46.0 is a large platform composition change: many components are - newly introduced while several previously bundled components are removed.' - - GitLab is upgraded from 8.6.2-bb.0 to 8.8.1-bb.0. - - "A major version jump is indicated for one component (0.4.12 \u2192 8.3.0-bb.0),\ - \ suggesting significant underlying changes; confirm which subchart this refers\ - \ to in the official release notes/values docs before upgrading." - features: - - Adds Alloy (1.6.18-bb.0) as a new component. - - Adds policy/security/controls components Gatekeeper (3.18.2-bb.0), Kyverno - Policies (3.3.4-bb.1), and Kyverno Reporter (2.24.2-bb.2). - - Adds developer and platform services Harbor (1.16.1-bb.0), Keycloak (2.5.1-bb.5), - Mattermost (10.4.2-bb.0), Thanos (15.9.1-bb.0), Promtail (6.16.6-bb.0), Istio - Operator and Controlplane (1.23.4-bb.0). - - Adds Fortify (1.1.2320154-bb.22) as a new component. - breaking_changes: - - Multiple previously deployed components are removed from the Big Bang bundle - (ECK Operator, Elasticsearch/Kibana, Fluentbit, Gitlab Runner, Jaeger, Kyverno, - Minio, Monitoring, Nexus, Twistlock). If you relied on any of these, you must - plan replacements/migrations and ensure dependent apps are reconfigured. - - Logging/monitoring stack changes (e.g., removal of Fluentbit/Monitoring and - addition of Promtail/Alloy/Thanos) can break log and metric pipelines; expect - config and data-path changes. - - Kyverno is removed while Kyverno Policies/Reporter are added; if you used - Kyverno admission controls, verify the intended replacement/architecture and - update policy deployment approach. + chart_updates: ['Big Bang 2.46.0 is a large platform composition change: many + components are newly introduced while several previously bundled components + are removed.', GitLab is upgraded from 8.6.2-bb.0 to 8.8.1-bb.0., "A major\ + \ version jump is indicated for one component (0.4.12 \u2192 8.3.0-bb.0),\ + \ suggesting significant underlying changes; confirm which subchart this\ + \ refers to in the official release notes/values docs before upgrading."] + features: [Adds Alloy (1.6.18-bb.0) as a new component., 'Adds policy/security/controls + components Gatekeeper (3.18.2-bb.0), Kyverno Policies (3.3.4-bb.1), and + Kyverno Reporter (2.24.2-bb.2).', 'Adds developer and platform services + Harbor (1.16.1-bb.0), Keycloak (2.5.1-bb.5), Mattermost (10.4.2-bb.0), Thanos + (15.9.1-bb.0), Promtail (6.16.6-bb.0), Istio Operator and Controlplane (1.23.4-bb.0).', + Adds Fortify (1.1.2320154-bb.22) as a new component.] + breaking_changes: ['Multiple previously deployed components are removed from + the Big Bang bundle (ECK Operator, Elasticsearch/Kibana, Fluentbit, Gitlab + Runner, Jaeger, Kyverno, Minio, Monitoring, Nexus, Twistlock). If you relied + on any of these, you must plan replacements/migrations and ensure dependent + apps are reconfigured.', 'Logging/monitoring stack changes (e.g., removal + of Fluentbit/Monitoring and addition of Promtail/Alloy/Thanos) can break + log and metric pipelines; expect config and data-path changes.', 'Kyverno + is removed while Kyverno Policies/Reporter are added; if you used Kyverno + admission controls, verify the intended replacement/architecture and update + policy deployment approach.'] chart_version: 2.46.0 images: [] - version: 2.45.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.6.18-bb.0 @@ -8178,34 +6634,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang release 2.45.0 updates the umbrella chart to version 0.4.12 (from - 0.4.11). - - A large number of previously bundled/managed packages are removed from the - Big Bang bundle in 2.45.0. - - 'Several packages are introduced as new managed components: ECK Operator, - Elasticsearch/Kibana, Fluent Bit, and GitLab Runner.' - features: - - Adds first-class support for ECK Operator as a managed package (enabling Elastic - stack operator-based deployments). - - Adds managed Elasticsearch/Kibana package to provide an Elastic stack option - within the Big Bang bundle. - - Adds Fluent Bit as a managed log forwarder/collector option within the bundle. - - Adds GitLab Runner as a managed component for executing CI jobs within the - cluster. - breaking_changes: - - Removes many previously included packages (e.g., Istio controlplane/operator, - Argo CD, Gatekeeper, Harbor, Vault, Kyverno, External Secrets, etc.); any - deployments relying on Big Bang to install/upgrade these will no longer be - managed and may be removed during upgrade depending on your configuration. - - Logging and observability stack expectations may change due to removal of - Promtail/Thanos and addition of Fluent Bit/Elastic components; dashboards, - outputs, and pipelines may need rework. + chart_updates: [Big Bang release 2.45.0 updates the umbrella chart to version + 0.4.12 (from 0.4.11)., A large number of previously bundled/managed packages + are removed from the Big Bang bundle in 2.45.0., 'Several packages are introduced + as new managed components: ECK Operator, Elasticsearch/Kibana, Fluent Bit, + and GitLab Runner.'] + features: [Adds first-class support for ECK Operator as a managed package (enabling + Elastic stack operator-based deployments)., Adds managed Elasticsearch/Kibana + package to provide an Elastic stack option within the Big Bang bundle., + Adds Fluent Bit as a managed log forwarder/collector option within the bundle., + Adds GitLab Runner as a managed component for executing CI jobs within the + cluster.] + breaking_changes: ['Removes many previously included packages (e.g., Istio controlplane/operator, + Argo CD, Gatekeeper, Harbor, Vault, Kyverno, External Secrets, etc.); any + deployments relying on Big Bang to install/upgrade these will no longer + be managed and may be removed during upgrade depending on your configuration.', + 'Logging and observability stack expectations may change due to removal of + Promtail/Thanos and addition of Fluent Bit/Elastic components; dashboards, + outputs, and pipelines may need rework.'] chart_version: 2.45.0 images: [] - version: 2.44.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.6.16-bb.0 @@ -8295,17 +6745,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes content not provided beyond admin message; need the full 2.44.0 - notes diff vs 2.43.0 to extract features. - breaking_changes: - - Release notes content not provided beyond admin message; need the full 2.44.0 - notes diff vs 2.43.0 to identify breaking changes. + features: [Release notes content not provided beyond admin message; need the + full 2.44.0 notes diff vs 2.43.0 to extract features.] + breaking_changes: [Release notes content not provided beyond admin message; + need the full 2.44.0 notes diff vs 2.43.0 to identify breaking changes.] chart_version: 2.44.0 images: [] - version: 2.43.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Alloy version: 1.6.13-bb.0 @@ -8395,17 +6842,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No concrete release-note content for 2.43.0 was provided beyond headings; - cannot extract features from the text shared. - breaking_changes: - - No concrete breaking-change information for 2.43.0 was provided; treat as - unknown until the actual 2.43.0 notes are reviewed. + features: [No concrete release-note content for 2.43.0 was provided beyond headings; + cannot extract features from the text shared.] + breaking_changes: [No concrete breaking-change information for 2.43.0 was provided; + treat as unknown until the actual 2.43.0 notes are reviewed.] chart_version: 2.43.0 images: [] - version: 2.42.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.6.13-bb.0 @@ -8493,17 +6937,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No application-level changes were provided in the notes you shared beyond - an admin message indicating the currently supported Big Bang version is 3.23.0 - (appears unchanged between 2.41.0 and 2.42.0). - breaking_changes: - - No breaking changes were included in the release notes you provided. + features: [No application-level changes were provided in the notes you shared + beyond an admin message indicating the currently supported Big Bang version + is 3.23.0 (appears unchanged between 2.41.0 and 2.42.0).] + breaking_changes: [No breaking changes were included in the release notes you + provided.] chart_version: 2.42.0 images: [] - version: 2.41.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Alloy version: 1.6.4-bb.0 @@ -8592,33 +7034,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.41.0 changes appear to be primarily a component set reshuffle: - several components were removed from the default bundle and several new components - were added.' - - "One component listed as \"Updated: 7.2.2-bb.0 \u2192 7.2.2-bb.3\" (component\ - \ name not provided in notes you pasted) received a patch-level bump." - features: - - Adds Alloy (1.6.4-bb.0) as a new component in the Big Bang bundle. - - Adds Gatekeeper (3.17.1-bb.2) as a new component in the Big Bang bundle. - - Adds Holocron (1.0.12) as a new component in the Big Bang bundle. - - Adds Minio (6.0.4-bb.2) as a new component in the Big Bang bundle. - - Adds Monitoring (62.4.0-bb.1) as a new component in the Big Bang bundle. - breaking_changes: - - Removes Argo CD from the Big Bang bundle; existing Argo CD installs must be - managed separately or migrated to an alternative deployment approach. - - Removes External Secrets from the bundle; any workloads depending on it will - need a replacement (e.g., ESO installed independently) before/after upgrade. - - Removes Fluent Bit from the bundle; log collection/forwarding will need an - alternative (e.g., Alloy, another agent) to avoid losing logs. - - Removes Fortify, Grafana, Harbor, Istio Operator, Keycloak, Kiali, Kyverno - Policies, and Mattermost from the bundle; clusters using these must pin to - 2.40.0, install them independently, or plan migrations prior to upgrading. + chart_updates: ['Big Bang 2.41.0 changes appear to be primarily a component + set reshuffle: several components were removed from the default bundle and + several new components were added.', "One component listed as \"Updated:\ + \ 7.2.2-bb.0 \u2192 7.2.2-bb.3\" (component name not provided in notes you\ + \ pasted) received a patch-level bump."] + features: [Adds Alloy (1.6.4-bb.0) as a new component in the Big Bang bundle., + Adds Gatekeeper (3.17.1-bb.2) as a new component in the Big Bang bundle., + Adds Holocron (1.0.12) as a new component in the Big Bang bundle., Adds Minio + (6.0.4-bb.2) as a new component in the Big Bang bundle., Adds Monitoring + (62.4.0-bb.1) as a new component in the Big Bang bundle.] + breaking_changes: [Removes Argo CD from the Big Bang bundle; existing Argo CD + installs must be managed separately or migrated to an alternative deployment + approach., 'Removes External Secrets from the bundle; any workloads depending + on it will need a replacement (e.g., ESO installed independently) before/after + upgrade.', 'Removes Fluent Bit from the bundle; log collection/forwarding + will need an alternative (e.g., Alloy, another agent) to avoid losing logs.', + 'Removes Fortify, Grafana, Harbor, Istio Operator, Keycloak, Kiali, Kyverno + Policies, and Mattermost from the bundle; clusters using these must pin + to 2.40.0, install them independently, or plan migrations prior to upgrading.'] chart_version: 2.41.0 images: [] - version: 2.40.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.6.4-bb.0 @@ -8707,32 +7145,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.40.0 introduces several new optional components (Fluentbit, Grafana, - Istio Operator, Kyverno Policies, Mattermost, Metrics Server, Minio Operator). - - Big Bang 2.40.0 removes multiple previously available components (Anchore - Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, Neuvector, Tempo, - Thanos, Twistlock, Vault). - - Core component bumped from 7.2.1-bb.3 to 7.2.2-bb.0 (component name not specified - in notes provided). - features: - - Adds support for deploying Fluentbit as a managed package (0.47.10-bb.1). - - Adds support for deploying Grafana as a managed package (8.5.5-bb.0). - - Adds support for deploying Istio Operator as a managed package (1.23.2-bb.0). - - Adds Kyverno Policies package (3.2.6-bb.0) for cluster policy management. - - Adds Mattermost package (10.1.2-bb.0). - - Adds Metrics Server package (3.12.2-bb.1). - - Adds Minio Operator package (6.0.4-bb.0). - breaking_changes: - - Removes multiple packages that were previously available/managed by Big Bang - (Anchore Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, Neuvector, - Tempo, Thanos, Twistlock, Vault). Any existing deployments of these must be - migrated off Big Bang management or decommissioned prior to/with the upgrade. + chart_updates: ['Big Bang 2.40.0 introduces several new optional components + (Fluentbit, Grafana, Istio Operator, Kyverno Policies, Mattermost, Metrics + Server, Minio Operator).', 'Big Bang 2.40.0 removes multiple previously + available components (Anchore Enterprise, Authservice, Gatekeeper, Holocron, + Monitoring, Neuvector, Tempo, Thanos, Twistlock, Vault).', Core component + bumped from 7.2.1-bb.3 to 7.2.2-bb.0 (component name not specified in notes + provided).] + features: [Adds support for deploying Fluentbit as a managed package (0.47.10-bb.1)., + Adds support for deploying Grafana as a managed package (8.5.5-bb.0)., Adds + support for deploying Istio Operator as a managed package (1.23.2-bb.0)., + Adds Kyverno Policies package (3.2.6-bb.0) for cluster policy management., + Adds Mattermost package (10.1.2-bb.0)., Adds Metrics Server package (3.12.2-bb.1)., + Adds Minio Operator package (6.0.4-bb.0).] + breaking_changes: ['Removes multiple packages that were previously available/managed + by Big Bang (Anchore Enterprise, Authservice, Gatekeeper, Holocron, Monitoring, + Neuvector, Tempo, Thanos, Twistlock, Vault). Any existing deployments of + these must be migrated off Big Bang management or decommissioned prior to/with + the upgrade.'] chart_version: 2.40.0 images: [] - version: 2.39.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.5.4-bb.1 @@ -8817,28 +7251,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang version bump: 2.38.0 \u2192 2.39.0 (release notes not fully provided\ - \ in the prompt)." - - 'Major component set reshuffle: several packages are newly added to the default - Big Bang bundle and several previously-included packages are removed.' - features: - - 'Adds/introduces support for multiple security/ops/observability and platform - components as part of the Big Bang bundle: Anchore Enterprise, ArgoCD, Gatekeeper, - Harbor, Jaeger, Keycloak, Kiali, Kyverno, Kyverno Reporter, Mattermost Operator, - Sonarqube, Twistlock.' - breaking_changes: - - 'Removes several previously-delivered components from the bundle: Istio Controlplane, - Istio Operator, Metrics Server, Nexus, Velero, and a component shown as ''New: - 1.5.4-bb.0'' (name not provided).' - - "Large component version jump (0.16.0-bb.2 \u2192 7.2.1-bb.3) indicates a\ - \ potentially breaking major upgrade for that specific component (component\ - \ name not provided in the notes)." + chart_updates: ["Big Bang version bump: 2.38.0 \u2192 2.39.0 (release notes\ + \ not fully provided in the prompt).", 'Major component set reshuffle: several + packages are newly added to the default Big Bang bundle and several previously-included + packages are removed.'] + features: ['Adds/introduces support for multiple security/ops/observability + and platform components as part of the Big Bang bundle: Anchore Enterprise, + ArgoCD, Gatekeeper, Harbor, Jaeger, Keycloak, Kiali, Kyverno, Kyverno Reporter, + Mattermost Operator, Sonarqube, Twistlock.'] + breaking_changes: ['Removes several previously-delivered components from the + bundle: Istio Controlplane, Istio Operator, Metrics Server, Nexus, Velero, + and a component shown as ''New: 1.5.4-bb.0'' (name not provided).', "Large\ + \ component version jump (0.16.0-bb.2 \u2192 7.2.1-bb.3) indicates a potentially\ + \ breaking major upgrade for that specific component (component name not\ + \ provided in the notes)."] chart_version: 2.39.0 images: [] - version: 2.38.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: New version: 1.5.4-bb.0 @@ -8927,29 +7357,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang release 2.38.0 introduces a large component set change: many components - are newly added, and several previously-included components are removed.' - - "Velero appears to move from being listed as an update (7.2.1-bb.1 \u2192\ - \ 0.16.0-bb.2) to being included as a new component at 7.2.1-bb.1; verify\ - \ actual component mapping and versions in the official Big Bang 2.38.0 release\ - \ notes/changelog to avoid confusion." - features: - - Adds several platform components by default (or makes them available) including - Istio control plane/operator, External Secrets, Metrics Server, Neuvector, - Nexus, Promtail, Vault, Velero, Authservice, and Cluster Auditor. - breaking_changes: - - Removes multiple previously-shipped components (Anchore Enterprise, Grafana, - Harbor, Mattermost Operator, Sonarqube, Twistlock). This can break existing - workflows and dependencies if you were relying on Big Bang to deploy/upgrade/manage - them. + chart_updates: ['Big Bang release 2.38.0 introduces a large component set change: + many components are newly added, and several previously-included components + are removed.', "Velero appears to move from being listed as an update (7.2.1-bb.1\ + \ \u2192 0.16.0-bb.2) to being included as a new component at 7.2.1-bb.1;\ + \ verify actual component mapping and versions in the official Big Bang\ + \ 2.38.0 release notes/changelog to avoid confusion."] + features: ['Adds several platform components by default (or makes them available) + including Istio control plane/operator, External Secrets, Metrics Server, + Neuvector, Nexus, Promtail, Vault, Velero, Authservice, and Cluster Auditor.'] + breaking_changes: ['Removes multiple previously-shipped components (Anchore + Enterprise, Grafana, Harbor, Mattermost Operator, Sonarqube, Twistlock). + This can break existing workflows and dependencies if you were relying on + Big Bang to deploy/upgrade/manage them.'] chart_version: 2.38.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.2'] - version: 2.37.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Anchore Enterprise version: 2.10.0-bb.0 @@ -9034,32 +7459,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.37.0 is primarily a composition change: many previously bundled - components are removed, and several new components are added.' - - One component shows a major version jump from `0.28.1-bb.6` to `7.2.1-bb.1` - (component name not provided in the notes); treat this as potentially breaking - and review its upstream release notes. - - Support notice in the release notes indicates the currently supported Big - Bang version is 3.25.0, meaning 2.37.0 is outside the current supported line. - features: - - Adds multiple optional/platform components (Anchore Enterprise, Fortify, Gitlab - Runner, Grafana, Monitoring, Sonarqube, Tempo, Thanos) as part of the Big - Bang bundle in 2.37.0. - breaking_changes: - - Removes many previously included components (ArgoCD, Authservice, Cluster - Auditor, Istio control plane/operator, Jaeger, Keycloak, Kyverno + reporter, - Metrics Server, Minio + operator, NeuVector, Nexus, Promtail, Velero). If - your deployment relied on any of these, you must keep them deployed separately - or migrate to replacements before/at upgrade time. - - The unspecified component jump from `0.28.1-bb.6` to `7.2.1-bb.1` suggests - significant behavior/config changes; validate values/schema compatibility - and plan a staged upgrade/rollback. + chart_updates: ['Big Bang 2.37.0 is primarily a composition change: many previously + bundled components are removed, and several new components are added.', + One component shows a major version jump from `0.28.1-bb.6` to `7.2.1-bb.1` + (component name not provided in the notes); treat this as potentially breaking + and review its upstream release notes., 'Support notice in the release notes + indicates the currently supported Big Bang version is 3.25.0, meaning 2.37.0 + is outside the current supported line.'] + features: ['Adds multiple optional/platform components (Anchore Enterprise, + Fortify, Gitlab Runner, Grafana, Monitoring, Sonarqube, Tempo, Thanos) as + part of the Big Bang bundle in 2.37.0.'] + breaking_changes: ['Removes many previously included components (ArgoCD, Authservice, + Cluster Auditor, Istio control plane/operator, Jaeger, Keycloak, Kyverno + + reporter, Metrics Server, Minio + operator, NeuVector, Nexus, Promtail, + Velero). If your deployment relied on any of these, you must keep them deployed + separately or migrate to replacements before/at upgrade time.', The unspecified + component jump from `0.28.1-bb.6` to `7.2.1-bb.1` suggests significant behavior/config + changes; validate values/schema compatibility and plan a staged upgrade/rollback.] chart_version: 2.37.0 images: [] - version: 2.36.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 2.10.0-bb.0 @@ -9146,27 +7566,23 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang version bump from 2.35.0 to 2.36.0. - - 'Major component lineup change: multiple new components added and several - previously-included components removed.' - features: - - Introduces several new packaged components (Argo CD, Authservice, ECK Operator, - HAProxy, Istio controlplane/operator, Jaeger, Keycloak, MinIO + MinIO Operator, - NeuVector, Velero) as part of the default Big Bang distribution. - breaking_changes: - - Removal of previously-included components (Gatekeeper, Kyverno Policies, Elasticsearch - Kibana, Loki, Sonarqube, External Secrets) will break installs that relied - on Big Bang to deploy/upgrade/manage them; you must provide replacements or - manage them separately. - - "Component version jump noted as \u201C15.7.20-bb.0 \u2192 0.28.1-bb.6\u201D\ - \ suggests a renaming/mapping or major chart refactor; validate which component\ - \ this refers to in your environment before upgrading." + chart_updates: [Big Bang version bump from 2.35.0 to 2.36.0., 'Major component + lineup change: multiple new components added and several previously-included + components removed.'] + features: ['Introduces several new packaged components (Argo CD, Authservice, + ECK Operator, HAProxy, Istio controlplane/operator, Jaeger, Keycloak, MinIO + + MinIO Operator, NeuVector, Velero) as part of the default Big Bang distribution.'] + breaking_changes: ['Removal of previously-included components (Gatekeeper, Kyverno + Policies, Elasticsearch Kibana, Loki, Sonarqube, External Secrets) will + break installs that relied on Big Bang to deploy/upgrade/manage them; you + must provide replacements or manage them separately.', "Component version\ + \ jump noted as \u201C15.7.20-bb.0 \u2192 0.28.1-bb.6\u201D suggests a renaming/mapping\ + \ or major chart refactor; validate which component this refers to in your\ + \ environment before upgrading."] chart_version: 2.36.0 images: [] - version: 2.35.0 - kube: - - '1.30' + kube: ['1.30'] requirements: - name: Updated version: 1.22.4-bb.1 @@ -9254,22 +7670,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang 2.35.0 updates the bundled platform components; notably the core - (15.7.x) version is bumped from 15.7.17-bb.0 to 15.7.20-bb.0. - - 'Several new optional/managed add-ons are introduced in the bundle: Kyverno - Policies, Kyverno Reporter, Elasticsearch Kibana, Promtail, Loki, Twistlock, - Nexus, Sonarqube, Mattermost Operator, Metrics Server, and Harbor.' - breaking_changes: - - 'Multiple components are removed from the bundle in 2.35.0: Istio Controlplane/Operator, - Tempo, ArgoCD, Authservice, Gitlab Runner, and Haproxy. If you were relying - on Big Bang to deploy/upgrade these, you must manage them separately or migrate - to the replacement pattern in 2.35.0.' + features: [Big Bang 2.35.0 updates the bundled platform components; notably + the core (15.7.x) version is bumped from 15.7.17-bb.0 to 15.7.20-bb.0., + 'Several new optional/managed add-ons are introduced in the bundle: Kyverno + Policies, Kyverno Reporter, Elasticsearch Kibana, Promtail, Loki, Twistlock, + Nexus, Sonarqube, Mattermost Operator, Metrics Server, and Harbor.'] + breaking_changes: ['Multiple components are removed from the bundle in 2.35.0: + Istio Controlplane/Operator, Tempo, ArgoCD, Authservice, Gitlab Runner, + and Haproxy. If you were relying on Big Bang to deploy/upgrade these, you + must manage them separately or migrate to the replacement pattern in 2.35.0.'] chart_version: 2.35.0 images: [] - version: 2.34.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Istio Controlplane version: 1.22.3-bb.1 @@ -9354,37 +7767,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang version bump from **2.33.0 \u2192 2.34.0**." - - "Core platform component update: **15.7.9-bb.6 \u2192 15.7.17-bb.0** (as listed\ - \ in notes)." - - 'Adds several new packaged components: Cluster Auditor, Gatekeeper, Kyverno, - Tempo, Argo CD.' - - 'Removes several previously packaged components: Jaeger, Kiali, ECK Operator, - Promtail, Loki, Minio, Sonarqube, Fortify, Vault, Metrics Server, Harbor.' - features: - - Introduces built-in support for Cluster Auditor (1.5.0-bb.21). - - Introduces policy enforcement components Gatekeeper (3.16.3-bb.1) and Kyverno - (3.2.6-bb.0). - - Adds distributed tracing/observability via Tempo (1.10.1-bb.0). - - Adds GitOps tooling via Argo CD (7.3.11-bb.0). - breaking_changes: - - Multiple components are removed from the bundle (Jaeger, Kiali, ECK Operator, - Promtail/Loki, Minio, Sonarqube, Fortify, Vault, Metrics Server, Harbor); - any workloads depending on them must be migrated or managed externally before/with - the upgrade. - - Observability stack changes (Tempo added while Jaeger/Loki/Promtail removed) - may require updating tracing/logging integrations and dashboards/agents. - - Security/policy changes from introducing Gatekeeper/Kyverno can block workloads - if default constraints/policies are enabled; review and stage enforcement - carefully. + chart_updates: ["Big Bang version bump from **2.33.0 \u2192 2.34.0**.", "Core\ + \ platform component update: **15.7.9-bb.6 \u2192 15.7.17-bb.0** (as listed\ + \ in notes).", 'Adds several new packaged components: Cluster Auditor, Gatekeeper, + Kyverno, Tempo, Argo CD.', 'Removes several previously packaged components: + Jaeger, Kiali, ECK Operator, Promtail, Loki, Minio, Sonarqube, Fortify, + Vault, Metrics Server, Harbor.'] + features: [Introduces built-in support for Cluster Auditor (1.5.0-bb.21)., Introduces + policy enforcement components Gatekeeper (3.16.3-bb.1) and Kyverno (3.2.6-bb.0)., + Adds distributed tracing/observability via Tempo (1.10.1-bb.0)., Adds GitOps + tooling via Argo CD (7.3.11-bb.0).] + breaking_changes: ['Multiple components are removed from the bundle (Jaeger, + Kiali, ECK Operator, Promtail/Loki, Minio, Sonarqube, Fortify, Vault, Metrics + Server, Harbor); any workloads depending on them must be migrated or managed + externally before/with the upgrade.', Observability stack changes (Tempo + added while Jaeger/Loki/Promtail removed) may require updating tracing/logging + integrations and dashboards/agents., Security/policy changes from introducing + Gatekeeper/Kyverno can block workloads if default constraints/policies are + enabled; review and stage enforcement carefully.] chart_version: 2.34.0 - images: - - registry1.dso.mil/ironbank/opensource/minio/operator-sidecar:v6.0.2 - - registry1.dso.mil/ironbank/hashicorp/vault/vault-k8s:v1.4.1 + images: ['registry1.dso.mil/ironbank/opensource/minio/operator-sidecar:v6.0.2', + 'registry1.dso.mil/ironbank/hashicorp/vault/vault-k8s:v1.4.1'] - version: 2.33.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Istio Controlplane version: 1.22.3-bb.1 @@ -9472,20 +7877,15 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided only include an admin message about the currently supported - Big Bang version. - breaking_changes: - - No breaking changes were included in the provided release notes; additional - changelog details are needed to assess upgrade impact. + features: [Release notes provided only include an admin message about the currently + supported Big Bang version.] + breaking_changes: [No breaking changes were included in the provided release + notes; additional changelog details are needed to assess upgrade impact.] chart_version: 2.33.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1 - - registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.2.1 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.1', 'registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.2.1'] - version: 2.32.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Updated version: 1.22.3-bb.1 @@ -9572,33 +7972,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Component set changed significantly between 2.31.0 and 2.32.0: several packages - were removed (Jaeger, Kyverno, Kyverno Reporter, Neuvector, Tempo, Wrapper, - Authservice, Haproxy, Mattermost Operator, Vault, Metrics Server, Harbor).' - - 'New packages introduced: Cluster Auditor, ECK Operator, Promtail, Fortify, - and a package labeled "New" (0.9.18-bb.7).' - - "One component was updated in place: 15.7.9-bb.2 \u2192 15.7.9-bb.4 (exact\ - \ component name not provided in notes)." - features: - - 'Adds new built-in packages: Cluster Auditor, ECK Operator, Promtail, Fortify, - and an additional new package (0.9.18-bb.7).' - breaking_changes: - - Multiple previously-installed components are removed in 2.32.0; upgrades will - uninstall these unless you manage them separately (Jaeger, Kyverno, Kyverno - Reporter, Neuvector, Tempo, Wrapper, Authservice, Haproxy, Mattermost Operator, - Vault, Metrics Server, Harbor). - - 'Operational impact: any workloads depending on the removed components (policy - enforcement via Kyverno, tracing via Jaeger/Tempo, registry via Harbor, secrets - via Vault, etc.) must be migrated or replaced before/with the upgrade.' + chart_updates: ['Component set changed significantly between 2.31.0 and 2.32.0: + several packages were removed (Jaeger, Kyverno, Kyverno Reporter, Neuvector, + Tempo, Wrapper, Authservice, Haproxy, Mattermost Operator, Vault, Metrics + Server, Harbor).', 'New packages introduced: Cluster Auditor, ECK Operator, + Promtail, Fortify, and a package labeled "New" (0.9.18-bb.7).', "One component\ + \ was updated in place: 15.7.9-bb.2 \u2192 15.7.9-bb.4 (exact component\ + \ name not provided in notes)."] + features: ['Adds new built-in packages: Cluster Auditor, ECK Operator, Promtail, + Fortify, and an additional new package (0.9.18-bb.7).'] + breaking_changes: ['Multiple previously-installed components are removed in + 2.32.0; upgrades will uninstall these unless you manage them separately + (Jaeger, Kyverno, Kyverno Reporter, Neuvector, Tempo, Wrapper, Authservice, + Haproxy, Mattermost Operator, Vault, Metrics Server, Harbor).', 'Operational + impact: any workloads depending on the removed components (policy enforcement + via Kyverno, tracing via Jaeger/Tempo, registry via Harbor, secrets via + Vault, etc.) must be migrated or replaced before/with the upgrade.'] chart_version: 2.32.0 - images: - - registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.5.0 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0 + images: ['registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.5.0', 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.20.0'] - version: 2.31.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Updated version: 1.22.2-bb.0 @@ -9681,36 +8075,31 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang version bump from **2.30.0** to **2.31.0**. - - "Only a minor update is listed for an existing component: **15.7.9-bb.1 \u2192\ - \ 15.7.9-bb.2** (component name not specified in the notes provided)." - - 'Adds several new packaged components/charts: **Jaeger, Kyverno Reporter, - Neuvector, Tempo, Wrapper, Authservice, Haproxy, Vault, Metrics Server**.' - - 'Removes multiple previously packaged components/charts: **Cluster Auditor, - Kyverno Policies, Elasticsearch Kibana, Promtail, Twistlock, Minio Operator, - Minio, Gitlab Runner, Sonarqube, Anchore Enterprise, Holocron**.' - features: - - Multiple observability and security components are newly included by default - in the Big Bang bundle (e.g., Jaeger/Tempo for tracing, Neuvector for container - security, Metrics Server for resource metrics). - - Additional platform plumbing components are introduced (e.g., Authservice, - Haproxy, Vault, Wrapper), which may expand optional capabilities but also - increase what can be installed/enabled. - breaking_changes: - - Several components are removed from the distribution (e.g., Elasticsearch/Kibana, - Promtail, Minio, Gitlab Runner, Sonarqube, Anchore Enterprise). If you relied - on Big Bang to deploy or manage these, you must migrate to alternative deployment - methods or supported replacements before/at upgrade. - - Policy/auditing components are removed (Kyverno Policies, Cluster Auditor); - any workloads depending on those policies/reports may change behavior post-upgrade - unless you replace them with your own policy management. + chart_updates: [Big Bang version bump from **2.30.0** to **2.31.0**., "Only\ + \ a minor update is listed for an existing component: **15.7.9-bb.1 \u2192\ + \ 15.7.9-bb.2** (component name not specified in the notes provided).", + 'Adds several new packaged components/charts: **Jaeger, Kyverno Reporter, + Neuvector, Tempo, Wrapper, Authservice, Haproxy, Vault, Metrics Server**.', + 'Removes multiple previously packaged components/charts: **Cluster Auditor, + Kyverno Policies, Elasticsearch Kibana, Promtail, Twistlock, Minio Operator, + Minio, Gitlab Runner, Sonarqube, Anchore Enterprise, Holocron**.'] + features: ['Multiple observability and security components are newly included + by default in the Big Bang bundle (e.g., Jaeger/Tempo for tracing, Neuvector + for container security, Metrics Server for resource metrics).', 'Additional + platform plumbing components are introduced (e.g., Authservice, Haproxy, + Vault, Wrapper), which may expand optional capabilities but also increase + what can be installed/enabled.'] + breaking_changes: ['Several components are removed from the distribution (e.g., + Elasticsearch/Kibana, Promtail, Minio, Gitlab Runner, Sonarqube, Anchore + Enterprise). If you relied on Big Bang to deploy or manage these, you must + migrate to alternative deployment methods or supported replacements before/at + upgrade.', 'Policy/auditing components are removed (Kyverno Policies, Cluster + Auditor); any workloads depending on those policies/reports may change behavior + post-upgrade unless you replace them with your own policy management.'] chart_version: 2.31.0 - images: - - registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.4.0 + images: ['registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.4.0'] - version: 2.30.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Updated version: 1.22.1-bb.0 @@ -9793,28 +8182,22 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.30.0 introduces significant component set changes relative to - 2.29.0: multiple new packages are added and several previously included packages - are removed.' - - A core component version is updated from 15.4.3-bb.0 to 15.7.9-bb.1 (exact - component name not provided in the notes). - features: - - 'Adds several new optional/included packages: Cluster Auditor, Gatekeeper, - Elasticsearch Kibana, Minio, GitLab Runner, Sonarqube, Anchore Enterprise, - and Holocron.' - - Refreshes at least one component from 15.4.3-bb.0 to 15.7.9-bb.1. - breaking_changes: - - 'Removes multiple previously available packages from the Big Bang bundle: - Istio Operator, Jaeger, Fluentbit, Neuvector, Grafana, Gitlab, Nexus, Haproxy, - and Metrics Server.' - - Upgrade may require migrating workloads/config that depended on removed packages - to alternatives or external deployments. + chart_updates: ['Big Bang 2.30.0 introduces significant component set changes + relative to 2.29.0: multiple new packages are added and several previously + included packages are removed.', A core component version is updated from + 15.4.3-bb.0 to 15.7.9-bb.1 (exact component name not provided in the notes).] + features: ['Adds several new optional/included packages: Cluster Auditor, Gatekeeper, + Elasticsearch Kibana, Minio, GitLab Runner, Sonarqube, Anchore Enterprise, + and Holocron.', Refreshes at least one component from 15.4.3-bb.0 to 15.7.9-bb.1.] + breaking_changes: ['Removes multiple previously available packages from the + Big Bang bundle: Istio Operator, Jaeger, Fluentbit, Neuvector, Grafana, + Gitlab, Nexus, Haproxy, and Metrics Server.', Upgrade may require migrating + workloads/config that depended on removed packages to alternatives or external + deployments.] chart_version: 2.30.0 images: [] - version: 2.29.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Updated version: 1.21.2-bb.2 @@ -9899,33 +8282,27 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.29.0 is a major composition change versus 2.28.0: multiple new - components are introduced (Istio Operator, Kyverno Policies, Fluent Bit, NeuVector, - Twistlock, MinIO Operator, GitLab, Nexus, Harbor) and multiple components - are removed (Kiali, Cluster Auditor, ECK Operator, Tempo, Wrapper, Authservice, - Fortify).' - - "One component received a large version bump: 13.2.2-bb.7 \u2192 15.4.3-bb.0\ - \ (component name not specified in the notes you provided)." - features: - - 'Adds several new optional/managed components in the Big Bang bundle: Istio - Operator, Kyverno Policies, Fluent Bit, NeuVector, Twistlock, MinIO Operator, - GitLab, Nexus, and Harbor.' - breaking_changes: - - Removes several previously-included components (Kiali, Cluster Auditor, ECK - Operator, Tempo, Wrapper, Authservice, Fortify), which may require you to - disable/migrate workloads and update dashboards/logging/auditing/integration - dependencies. - - Introduces new components that may require new namespaces, CRDs, cluster-wide - RBAC, and additional resources; plan for admission policies (Kyverno) and - service mesh operator changes (Istio Operator). + chart_updates: ['Big Bang 2.29.0 is a major composition change versus 2.28.0: + multiple new components are introduced (Istio Operator, Kyverno Policies, + Fluent Bit, NeuVector, Twistlock, MinIO Operator, GitLab, Nexus, Harbor) + and multiple components are removed (Kiali, Cluster Auditor, ECK Operator, + Tempo, Wrapper, Authservice, Fortify).', "One component received a large\ + \ version bump: 13.2.2-bb.7 \u2192 15.4.3-bb.0 (component name not specified\ + \ in the notes you provided)."] + features: ['Adds several new optional/managed components in the Big Bang bundle: + Istio Operator, Kyverno Policies, Fluent Bit, NeuVector, Twistlock, MinIO + Operator, GitLab, Nexus, and Harbor.'] + breaking_changes: ['Removes several previously-included components (Kiali, Cluster + Auditor, ECK Operator, Tempo, Wrapper, Authservice, Fortify), which may + require you to disable/migrate workloads and update dashboards/logging/auditing/integration + dependencies.', 'Introduces new components that may require new namespaces, + CRDs, cluster-wide RBAC, and additional resources; plan for admission policies + (Kyverno) and service mesh operator changes (Istio Operator).'] chart_version: 2.29.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.19.0'] - version: 2.28.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Updated version: 1.21.2-bb.0 @@ -10007,22 +8384,19 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - 'Large component set change: adds Kiali, Cluster Auditor, ECK Operator, Promtail, - Tempo, Grafana, Authservice, HAProxy, and Mattermost Operator as new managed - components in 2.28.0.' - breaking_changes: - - 'Multiple components are removed in 2.28.0: Gatekeeper, Kyverno Reporter, - Twistlock, Minio Operator, Mattermost, Velero, and Thanos; workloads/config - depending on these will need migration or replacement.' - - "A component version jump is indicated (1.0.6 \u2192 13.2.2-bb.7); validate\ - \ what component this refers to in your environment because it may introduce\ - \ significant config or CRD changes." + features: ['Large component set change: adds Kiali, Cluster Auditor, ECK Operator, + Promtail, Tempo, Grafana, Authservice, HAProxy, and Mattermost Operator + as new managed components in 2.28.0.'] + breaking_changes: ['Multiple components are removed in 2.28.0: Gatekeeper, Kyverno + Reporter, Twistlock, Minio Operator, Mattermost, Velero, and Thanos; workloads/config + depending on these will need migration or replacement.', "A component version\ + \ jump is indicated (1.0.6 \u2192 13.2.2-bb.7); validate what component\ + \ this refers to in your environment because it may introduce significant\ + \ config or CRD changes."] chart_version: 2.28.0 images: [] - version: 2.27.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.21.1-bb.1 @@ -10107,34 +8481,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang upgraded from 2.26.0 to 2.27.0; component inventory changed significantly - with multiple additions and removals. - - 'Added charts/components: Jaeger, Gatekeeper, Kyverno, Kyverno Reporter, Twistlock, - Fortify, Mattermost, Velero, Metrics Server.' - - 'Removed charts/components: Istio Controlplane, Kiali, Cluster Auditor, ECK - Operator, Loki, Authservice, Gitlab, Haproxy, Mattermost Operator.' - - "One component version bumped: 1.0.5 \u2192 1.0.6 (component name not provided\ - \ in notes)." - features: - - 'Introduces multiple new optional platform capabilities: distributed tracing - (Jaeger), policy enforcement (Gatekeeper, Kyverno), compliance reporting (Kyverno - Reporter), backup/restore (Velero), and cluster metrics (Metrics Server).' - - Adds integrations for additional security/compliance tooling (Twistlock, Fortify) - and collaboration tooling (Mattermost). - breaking_changes: - - Several previously-included components are removed (Istio control plane, Kiali, - Loki, GitLab, Authservice, HAProxy, ECK operator, Mattermost operator, Cluster - Auditor). Any deployments relying on these must migrate to alternative installations - or disable corresponding Big Bang configuration. - - If you previously configured values for removed components, those values will - become invalid/no-ops and may cause Helm value schema/templating issues depending - on how your values are structured. + chart_updates: [Big Bang upgraded from 2.26.0 to 2.27.0; component inventory + changed significantly with multiple additions and removals., 'Added charts/components: + Jaeger, Gatekeeper, Kyverno, Kyverno Reporter, Twistlock, Fortify, Mattermost, + Velero, Metrics Server.', 'Removed charts/components: Istio Controlplane, + Kiali, Cluster Auditor, ECK Operator, Loki, Authservice, Gitlab, Haproxy, + Mattermost Operator.', "One component version bumped: 1.0.5 \u2192 1.0.6\ + \ (component name not provided in notes)."] + features: ['Introduces multiple new optional platform capabilities: distributed + tracing (Jaeger), policy enforcement (Gatekeeper, Kyverno), compliance reporting + (Kyverno Reporter), backup/restore (Velero), and cluster metrics (Metrics + Server).', 'Adds integrations for additional security/compliance tooling + (Twistlock, Fortify) and collaboration tooling (Mattermost).'] + breaking_changes: ['Several previously-included components are removed (Istio + control plane, Kiali, Loki, GitLab, Authservice, HAProxy, ECK operator, + Mattermost operator, Cluster Auditor). Any deployments relying on these + must migrate to alternative installations or disable corresponding Big Bang + configuration.', 'If you previously configured values for removed components, + those values will become invalid/no-ops and may cause Helm value schema/templating + issues depending on how your values are structured.'] chart_version: 2.27.0 images: [] - version: 2.26.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Istio Controlplane version: 1.20.4-bb.1 @@ -10219,33 +8588,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang meta-release 2.26.0 includes a large set of component add/remove - actions and version bumps as listed (several components newly added; several - previously bundled components removed). - features: - - Introduces Kiali as a bundled component (1.82.0-bb.3). - - Introduces Cluster Auditor as a bundled component (1.5.0-bb.15). - - Adds Loki (5.47.2-bb.2) and Thanos (13.2.2-bb.4) to expand observability options. - - Adds MinIO Operator (5.0.14-bb.2) and GitLab (7.10.2-bb.0) as new packaged - capabilities. - - Adds a 'Wrapper' component (0.4.7), likely to standardize or orchestrate deployments - across packages. - breaking_changes: - - Removal of Istio Operator (was 1.20.4-bb.0) may require changing how Istio - is installed/managed during/after upgrade. - - Removal of Kyverno Policies package means policy enforcement must be migrated/managed - separately if you relied on Big Bang-provided policies. - - Removal of Promtail, Grafana, and Metrics Server indicates a monitoring/logging - stack change; ensure alternative components (e.g., Loki/Thanos) are configured - and any dashboards/agents are replaced. - - Removal of Argo CD, Fortify, and Vault from the bundle can break GitOps, SAST, - and secrets workflows unless you deploy/maintain them independently. + chart_updates: [Big Bang meta-release 2.26.0 includes a large set of component + add/remove actions and version bumps as listed (several components newly + added; several previously bundled components removed).] + features: [Introduces Kiali as a bundled component (1.82.0-bb.3)., Introduces + Cluster Auditor as a bundled component (1.5.0-bb.15)., Adds Loki (5.47.2-bb.2) + and Thanos (13.2.2-bb.4) to expand observability options., Adds MinIO Operator + (5.0.14-bb.2) and GitLab (7.10.2-bb.0) as new packaged capabilities., 'Adds + a ''Wrapper'' component (0.4.7), likely to standardize or orchestrate deployments + across packages.'] + breaking_changes: [Removal of Istio Operator (was 1.20.4-bb.0) may require changing + how Istio is installed/managed during/after upgrade., Removal of Kyverno + Policies package means policy enforcement must be migrated/managed separately + if you relied on Big Bang-provided policies., 'Removal of Promtail, Grafana, + and Metrics Server indicates a monitoring/logging stack change; ensure alternative + components (e.g., Loki/Thanos) are configured and any dashboards/agents + are replaced.', 'Removal of Argo CD, Fortify, and Vault from the bundle + can break GitOps, SAST, and secrets workflows unless you deploy/maintain + them independently.'] chart_version: 2.26.0 images: [] - version: 2.25.0 - kube: - - '1.29' + kube: ['1.29'] requirements: - name: Istio Controlplane version: 1.20.4-bb.1 @@ -10330,46 +8694,36 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.25.0 introduces several new packaged components (Istio control - plane/operator, Kyverno Policies, ECK Operator, Promtail, Grafana, Authservice, - Fortify, Mattermost Operator, Vault). - - Big Bang 2.25.0 removes multiple previously packaged components (Jaeger, Cluster - Auditor, Gatekeeper, Kyverno, Tempo, Wrapper, Sonarqube, Anchore Enterprise, - Keycloak, Harbor, Holocron). - - One existing component was updated from 13.2.2-bb.2 to 13.2.2-bb.4 (component - name not provided in notes). - features: - - Adds first-class support for Istio via new Istio Operator and Istio Controlplane - packages (1.20.4-bb.*). - - Introduces Kyverno Policies as a standalone package (3.0.4-bb.28), separating - policy content from the Kyverno engine. - - Adds Elastic Cloud on Kubernetes (ECK) Operator (2.12.1-bb.0) to manage Elasticsearch/Kibana - via CRDs. - - Adds logging/observability and UI components (Promtail 6.15.5-bb.3 and Grafana - 7.3.7-bb.1). - - Adds Authservice (1.0.0-bb.0) and Vault (0.25.0-bb.20) packages for auth and - secrets management options. - - Adds additional optional integrations/tools (Fortify 1.1.2320154-bb.3 and - Mattermost Operator 1.21.0-bb.0). - breaking_changes: - - Multiple components are removed in 2.25.0 (Jaeger, Tempo, Kyverno, Gatekeeper, - Keycloak, Harbor, Anchore Enterprise, Sonarqube, etc.); any clusters relying - on these must migrate off them or pin/retain them outside Big Bang before - upgrading. - - Kyverno engine is removed while Kyverno Policies is added; policy enforcement - will not function unless you deploy an alternative policy engine or manage - Kyverno separately. - - Removal of observability components (Jaeger/Tempo) is disruptive if tracing - depended on them; plan replacement/disable tracing pipelines accordingly. - - Removal of identity/registry/scanning components (Keycloak/Harbor/Anchore/Sonarqube) - requires replacement solutions and updates to any integrations referencing - their services/URLs/secrets. + chart_updates: ['Big Bang 2.25.0 introduces several new packaged components + (Istio control plane/operator, Kyverno Policies, ECK Operator, Promtail, + Grafana, Authservice, Fortify, Mattermost Operator, Vault).', 'Big Bang + 2.25.0 removes multiple previously packaged components (Jaeger, Cluster + Auditor, Gatekeeper, Kyverno, Tempo, Wrapper, Sonarqube, Anchore Enterprise, + Keycloak, Harbor, Holocron).', One existing component was updated from 13.2.2-bb.2 + to 13.2.2-bb.4 (component name not provided in notes).] + features: [Adds first-class support for Istio via new Istio Operator and Istio + Controlplane packages (1.20.4-bb.*)., 'Introduces Kyverno Policies as a + standalone package (3.0.4-bb.28), separating policy content from the Kyverno + engine.', Adds Elastic Cloud on Kubernetes (ECK) Operator (2.12.1-bb.0) + to manage Elasticsearch/Kibana via CRDs., Adds logging/observability and + UI components (Promtail 6.15.5-bb.3 and Grafana 7.3.7-bb.1)., Adds Authservice + (1.0.0-bb.0) and Vault (0.25.0-bb.20) packages for auth and secrets management + options., Adds additional optional integrations/tools (Fortify 1.1.2320154-bb.3 + and Mattermost Operator 1.21.0-bb.0).] + breaking_changes: ['Multiple components are removed in 2.25.0 (Jaeger, Tempo, + Kyverno, Gatekeeper, Keycloak, Harbor, Anchore Enterprise, Sonarqube, etc.); + any clusters relying on these must migrate off them or pin/retain them outside + Big Bang before upgrading.', Kyverno engine is removed while Kyverno Policies + is added; policy enforcement will not function unless you deploy an alternative + policy engine or manage Kyverno separately., Removal of observability components + (Jaeger/Tempo) is disruptive if tracing depended on them; plan replacement/disable + tracing pipelines accordingly., Removal of identity/registry/scanning components + (Keycloak/Harbor/Anchore/Sonarqube) requires replacement solutions and updates + to any integrations referencing their services/URLs/secrets.] chart_version: 2.25.0 images: [] - version: 2.24.0 - kube: - - '1.28' + kube: ['1.28'] requirements: - name: Updated version: 1.20.4-bb.1 @@ -10454,31 +8808,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.24.0 updates the umbrella chart to include several new packaged - components (Kyverno, Argo CD, SonarQube, HAProxy, Keycloak, Metrics Server, - Harbor, Holocron). - - Several previously included components are removed from the default bundle - (Istio Controlplane, Elasticsearch/Kibana, ECK Operator, GitLab Runner). - - One existing component is patched from 13.2.2-bb.1 to 13.2.2-bb.2 (component - name not provided in notes). - features: - - Adds first-class, bundled support for Kyverno policy engine. - - Adds Argo CD as a packaged GitOps deployment option. - - Adds packaged integrations for Harbor, Keycloak, Metrics Server, HAProxy, - SonarQube, and Holocron. - breaking_changes: - - Removal of Istio Controlplane from the bundle can break clusters relying on - Big Bang-managed Istio; migration/ownership of Istio resources may be required. - - Removal of Elasticsearch/Kibana and ECK Operator can break logging/observability - deployments depending on those charts; data retention/migration planning needed. - - Removal of GitLab Runner from the bundle can break CI jobs that relied on - the in-cluster runner managed by Big Bang. + chart_updates: ['Big Bang 2.24.0 updates the umbrella chart to include several + new packaged components (Kyverno, Argo CD, SonarQube, HAProxy, Keycloak, + Metrics Server, Harbor, Holocron).', 'Several previously included components + are removed from the default bundle (Istio Controlplane, Elasticsearch/Kibana, + ECK Operator, GitLab Runner).', One existing component is patched from 13.2.2-bb.1 + to 13.2.2-bb.2 (component name not provided in notes).] + features: ['Adds first-class, bundled support for Kyverno policy engine.', Adds + Argo CD as a packaged GitOps deployment option., 'Adds packaged integrations + for Harbor, Keycloak, Metrics Server, HAProxy, SonarQube, and Holocron.'] + breaking_changes: [Removal of Istio Controlplane from the bundle can break clusters + relying on Big Bang-managed Istio; migration/ownership of Istio resources + may be required., Removal of Elasticsearch/Kibana and ECK Operator can break + logging/observability deployments depending on those charts; data retention/migration + planning needed., Removal of GitLab Runner from the bundle can break CI + jobs that relied on the in-cluster runner managed by Big Bang.] chart_version: 2.24.0 images: [] - version: 2.23.0 - kube: - - '1.28' + kube: ['1.28'] requirements: - name: Istio Controlplane version: 1.19.7-bb.0 @@ -10563,36 +8911,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.23.0 introduces several new components (Istio Control Plane, Elasticsearch - Kibana, Tempo, Wrapper). - - Multiple previously-included components are removed from the Big Bang bundle - in 2.23.0 (Kyverno, Kyverno Reporter, Fluentbit, Promtail, Neuvector, Twistlock, - ArgoCD, Minio Operator, GitLab, Sonarqube, Fortify, HAProxy, Mattermost Operator, - Keycloak, Holocron). - - One component is updated from 13.2.2-bb.0 to 13.2.2-bb.1 (component name not - specified in provided notes). - - Anchore Enterprise is upgraded from 1.27.4-bb.7 to 2.0.2-bb.1 (major version - jump). - features: - - Adds Istio Control Plane to the Big Bang bundle (1.19.7-bb.0). - - Adds Elasticsearch Kibana to the Big Bang bundle (1.11.0-bb.0). - - Adds Tempo to the Big Bang bundle (1.7.1-bb.3). - - Adds Wrapper chart/component (0.4.6). - breaking_changes: - - "Anchore Enterprise jumps from 1.x to 2.0.2, which likely includes breaking\ - \ configuration and API changes\u2014review Anchore 2.0 upgrade notes before\ - \ proceeding." - - Removal of many components means any existing deployments/CRs/values for those - packages will no longer be managed by Big Bang after upgrade; plan migrations - or independent lifecycle management before upgrading. + chart_updates: ['Big Bang 2.23.0 introduces several new components (Istio Control + Plane, Elasticsearch Kibana, Tempo, Wrapper).', 'Multiple previously-included + components are removed from the Big Bang bundle in 2.23.0 (Kyverno, Kyverno + Reporter, Fluentbit, Promtail, Neuvector, Twistlock, ArgoCD, Minio Operator, + GitLab, Sonarqube, Fortify, HAProxy, Mattermost Operator, Keycloak, Holocron).', + One component is updated from 13.2.2-bb.0 to 13.2.2-bb.1 (component name not + specified in provided notes)., Anchore Enterprise is upgraded from 1.27.4-bb.7 + to 2.0.2-bb.1 (major version jump).] + features: [Adds Istio Control Plane to the Big Bang bundle (1.19.7-bb.0)., Adds + Elasticsearch Kibana to the Big Bang bundle (1.11.0-bb.0)., Adds Tempo to + the Big Bang bundle (1.7.1-bb.3)., Adds Wrapper chart/component (0.4.6).] + breaking_changes: ["Anchore Enterprise jumps from 1.x to 2.0.2, which likely\ + \ includes breaking configuration and API changes\u2014review Anchore 2.0\ + \ upgrade notes before proceeding.", Removal of many components means any + existing deployments/CRs/values for those packages will no longer be managed + by Big Bang after upgrade; plan migrations or independent lifecycle management + before upgrading.] chart_version: 2.23.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.1'] - version: 2.22.0 - kube: - - '1.28' + kube: ['1.28'] requirements: - name: Updated version: 1.19.7-bb.0 @@ -10677,30 +9017,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang meta-chart 2.21.0 \u2192 2.22.0 updates the component set significantly\ - \ (many new packages added; several previously-included packages removed)." - - Argo CD packaged version updated from 5.53.1-bb.2 to 6.1.0-bb.2. - - "One unnamed component shows a very large version jump: 1.14.0-bb.2 \u2192\ - \ 13.2.2-bb.0 (identify which package this is in your values/previous release\ - \ to validate migration steps)." - features: - - Introduces multiple new platform and security packages (Cluster Auditor, Gatekeeper, - Kyverno, Kyverno Reporter, NeuVector, Twistlock). - - Adds several new ops/observability and app platform components (ECK Operator, - Promtail, MinIO Operator, GitLab, SonarQube, Mattermost Operator, Keycloak). - breaking_changes: - - "Removes several previously-managed packages from the Big Bang release (Istio\ - \ Operator, Kyverno Policies, Tempo, Monitoring, Authservice, Nexus, Velero,\ - \ Thanos). Plan ownership/installation for these if you still need them, and\ - \ confirm dependent integrations don\u2019t break." - - Because many components are newly introduced, expect new CRDs/namespaces/cluster-scoped - resources; review cluster policy and RBAC impacts before upgrading. + chart_updates: ["Big Bang meta-chart 2.21.0 \u2192 2.22.0 updates the component\ + \ set significantly (many new packages added; several previously-included\ + \ packages removed).", Argo CD packaged version updated from 5.53.1-bb.2 + to 6.1.0-bb.2., "One unnamed component shows a very large version jump:\ + \ 1.14.0-bb.2 \u2192 13.2.2-bb.0 (identify which package this is in your\ + \ values/previous release to validate migration steps)."] + features: ['Introduces multiple new platform and security packages (Cluster + Auditor, Gatekeeper, Kyverno, Kyverno Reporter, NeuVector, Twistlock).', + 'Adds several new ops/observability and app platform components (ECK Operator, + Promtail, MinIO Operator, GitLab, SonarQube, Mattermost Operator, Keycloak).'] + breaking_changes: ["Removes several previously-managed packages from the Big\ + \ Bang release (Istio Operator, Kyverno Policies, Tempo, Monitoring, Authservice,\ + \ Nexus, Velero, Thanos). Plan ownership/installation for these if you still\ + \ need them, and confirm dependent integrations don\u2019t break.", 'Because + many components are newly introduced, expect new CRDs/namespaces/cluster-scoped + resources; review cluster policy and RBAC impacts before upgrading.'] chart_version: 2.22.0 images: [] - version: 2.21.0 - kube: - - '1.28' + kube: ['1.28'] requirements: - name: Updated version: 1.19.6-bb.2 @@ -10785,35 +9121,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.21.0 includes major component set changes vs 2.20.0: several new - components were added (Jaeger, Kyverno Policies, Fluentbit, Monitoring, Authservice, - Gitlab Runner, Fortify, Velero, Holocron, Thanos) and many were removed (Istio - Controlplane, Cluster Auditor, Neuvector, Wrapper, Minio Operator/Minio, Mattermost - Operator/Mattermost, Keycloak, Vault, Metrics Server, Harbor, and an entry - labeled ''New 1.0.0'').' - - One existing component appears to have a version change from `12.23.0-bb.2` - to `1.14.0-bb.2` (the component name is not provided in the notes you pasted). - features: - - Adds observability/logging/monitoring stack components (Monitoring, Thanos, - Jaeger, Fluentbit) as first-class managed packages in Big Bang 2.21.0. - - Adds security/policy and platform services components (Kyverno Policies, Authservice, - Gitlab Runner, Velero, Fortify, Holocron) to the distribution. - breaking_changes: - - Removes multiple previously-managed components (Istio Controlplane, Keycloak, - Vault, Harbor, Minio, Mattermost, Metrics Server, Neuvector, Cluster Auditor, - etc.); existing deployments relying on Big Bang to install/upgrade these must - be migrated or managed separately before/after upgrade. - - "Introduces a potentially significant component version change (`12.23.0-bb.2`\ - \ \u2192 `1.14.0-bb.2`) which may indicate a chart rename or a downgrade/renumbering;\ - \ validate the actual component and compatibility before upgrading." + chart_updates: ['Big Bang 2.21.0 includes major component set changes vs 2.20.0: + several new components were added (Jaeger, Kyverno Policies, Fluentbit, + Monitoring, Authservice, Gitlab Runner, Fortify, Velero, Holocron, Thanos) + and many were removed (Istio Controlplane, Cluster Auditor, Neuvector, Wrapper, + Minio Operator/Minio, Mattermost Operator/Mattermost, Keycloak, Vault, Metrics + Server, Harbor, and an entry labeled ''New 1.0.0'').', One existing component + appears to have a version change from `12.23.0-bb.2` to `1.14.0-bb.2` (the + component name is not provided in the notes you pasted).] + features: ['Adds observability/logging/monitoring stack components (Monitoring, + Thanos, Jaeger, Fluentbit) as first-class managed packages in Big Bang 2.21.0.', + 'Adds security/policy and platform services components (Kyverno Policies, + Authservice, Gitlab Runner, Velero, Fortify, Holocron) to the distribution.'] + breaking_changes: ['Removes multiple previously-managed components (Istio Controlplane, + Keycloak, Vault, Harbor, Minio, Mattermost, Metrics Server, Neuvector, Cluster + Auditor, etc.); existing deployments relying on Big Bang to install/upgrade + these must be migrated or managed separately before/after upgrade.', "Introduces\ + \ a potentially significant component version change (`12.23.0-bb.2` \u2192\ + \ `1.14.0-bb.2`) which may indicate a chart rename or a downgrade/renumbering;\ + \ validate the actual component and compatibility before upgrading."] chart_version: 2.21.0 - images: - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.17.5 - - registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0 + images: ['registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.17.5', + 'registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter:2.18.0'] - version: 2.20.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Istio Controlplane version: 1.19.6-bb.1 @@ -10898,33 +9229,26 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Adds multiple new components to the Big Bang bundle: Istio Controlplane, - Istio Operator, Tempo, Wrapper, Argo CD, Minio, Nexus, HAProxy, Mattermost, - Vault, Harbor, and a component labeled "New" (v1.0.0).' - - Updates an existing component from 12.21.0-bb.1 to 12.23.0-bb.2 (component - name not provided in the notes you pasted). - - 'Removes several previously-included components: Kiali, Gatekeeper, Loki, - GitLab Runner, Sonarqube, and Fortify.' - features: - - Introduces first-class support for deploying Istio via newly-added Istio Operator - and Istio Controlplane packages. - - Adds new observability capability by bundling Tempo. - - Expands platform services by bundling Argo CD, Minio, Nexus, HAProxy, Mattermost, - Vault, and Harbor. - breaking_changes: - - Removal of previously-managed components (Kiali, Gatekeeper, Loki, GitLab - Runner, Sonarqube, Fortify) means Big Bang will no longer install/upgrade - these; existing installations may become orphaned and must be managed or removed - separately. - - Adding many new components can change the rendered manifests and required - cluster resources; ensure namespaces, storage classes, and ingress/gateway - expectations still match your environment. + chart_updates: ['Adds multiple new components to the Big Bang bundle: Istio + Controlplane, Istio Operator, Tempo, Wrapper, Argo CD, Minio, Nexus, HAProxy, + Mattermost, Vault, Harbor, and a component labeled "New" (v1.0.0).', Updates + an existing component from 12.21.0-bb.1 to 12.23.0-bb.2 (component name + not provided in the notes you pasted)., 'Removes several previously-included + components: Kiali, Gatekeeper, Loki, GitLab Runner, Sonarqube, and Fortify.'] + features: [Introduces first-class support for deploying Istio via newly-added + Istio Operator and Istio Controlplane packages., Adds new observability + capability by bundling Tempo., 'Expands platform services by bundling Argo + CD, Minio, Nexus, HAProxy, Mattermost, Vault, and Harbor.'] + breaking_changes: ['Removal of previously-managed components (Kiali, Gatekeeper, + Loki, GitLab Runner, Sonarqube, Fortify) means Big Bang will no longer install/upgrade + these; existing installations may become orphaned and must be managed or + removed separately.', 'Adding many new components can change the rendered + manifests and required cluster resources; ensure namespaces, storage classes, + and ingress/gateway expectations still match your environment.'] chart_version: 2.20.0 images: [] - version: 2.19.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.19.6-bb.0 @@ -11006,17 +9330,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No application release notes were provided beyond an admin/support message - indicating the currently supported Big Bang version is 3.25.0. - breaking_changes: - - No breaking changes were listed in the provided release note excerpts; treat - this as unknown until the full 2.19.0 changelog is reviewed. + features: [No application release notes were provided beyond an admin/support + message indicating the currently supported Big Bang version is 3.25.0.] + breaking_changes: [No breaking changes were listed in the provided release note + excerpts; treat this as unknown until the full 2.19.0 changelog is reviewed.] chart_version: 2.19.0 images: [] - version: 2.18.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.19.5-bb.2 @@ -11099,26 +9420,23 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.18.0 updates the package set relative to 2.17.0, including upgrading - one component and adding/removing multiple components (see breaking changes). - features: - - 'Adds new optional packages: Minio (5.0.11-bb.0), Sonarqube (8.0.3-bb.0), - and Velero (5.1.3-bb.2).' - - Upgrades one component from 12.13.12-bb.4 to 12.16.1-bb.0. - breaking_changes: - - 'Large package set removal: Istio Controlplane/Operator, Cluster Auditor, - Elasticsearch Kibana, Grafana, Twistlock, Wrapper, Authservice, Gitlab Runner, - Nexus, Fortify, Haproxy, Keycloak, Vault, and Harbor are removed in 2.18.0 - and will no longer be deployed/managed by Big Bang after upgrade.' - - If your environment relied on any removed packages for auth, ingress, observability, - scanning, registry, secrets, or CI runners, you must plan replacements or - manage them outside Big Bang before upgrading. + chart_updates: ['Big Bang 2.18.0 updates the package set relative to 2.17.0, + including upgrading one component and adding/removing multiple components + (see breaking changes).'] + features: ['Adds new optional packages: Minio (5.0.11-bb.0), Sonarqube (8.0.3-bb.0), + and Velero (5.1.3-bb.2).', Upgrades one component from 12.13.12-bb.4 to + 12.16.1-bb.0.] + breaking_changes: ['Large package set removal: Istio Controlplane/Operator, + Cluster Auditor, Elasticsearch Kibana, Grafana, Twistlock, Wrapper, Authservice, + Gitlab Runner, Nexus, Fortify, Haproxy, Keycloak, Vault, and Harbor are + removed in 2.18.0 and will no longer be deployed/managed by Big Bang after + upgrade.', 'If your environment relied on any removed packages for auth, + ingress, observability, scanning, registry, secrets, or CI runners, you + must plan replacements or manage them outside Big Bang before upgrading.'] chart_version: 2.18.0 images: [] - version: 2.17.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Istio Controlplane version: 1.19.4-bb.0 @@ -11201,14 +9519,13 @@ addons: helm_changes: '' chart_updates: [] features: [] - breaking_changes: - - Release notes not provided (only headings/links). Cannot identify actual changes - between Big Bang 2.16.0 and 2.17.0 from the supplied text. + breaking_changes: [Release notes not provided (only headings/links). Cannot + identify actual changes between Big Bang 2.16.0 and 2.17.0 from the supplied + text.] chart_version: 2.17.0 images: [] - version: 2.16.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.19.4-bb.0 @@ -11292,18 +9609,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang 2.16.0 release notes link provided but no details included in the - pasted text. - breaking_changes: - - Unable to determine breaking changes from the provided snippet; full 2.16.0 - release notes content is needed. + features: [Big Bang 2.16.0 release notes link provided but no details included + in the pasted text.] + breaking_changes: [Unable to determine breaking changes from the provided snippet; + full 2.16.0 release notes content is needed.] chart_version: 2.16.0 - images: - - registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.8 + images: ['registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal:8.8'] - version: 2.15.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.19.3-bb.1 @@ -11386,27 +9699,24 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang release updated from 2.14.0 to 2.15.0; notable composition change: - several charts added and several removed (see features/breaking changes).' - features: - - "Introduces several new optional/packaged components: Istio Operator, Fluentbit,\ - \ Promtail, Loki, Minio Operator, Sonarqube, Fortify, Haproxy, and a chart\ - \ listed as \u201CNew\u201D (version 12.13.12-bb.3)." - - Includes a minor update of an existing component from 1.13.0-bb.3 to 1.13.1-bb.0 - (exact component name not provided in notes). - breaking_changes: - - 'Removes multiple previously packaged components: ECK Operator, Authservice, - Gitlab Runner, Anchore Enterprise, Mattermost, and Metrics Server; any existing - values, overrides, or dependencies for these must be removed or replaced.' - - If you relied on Authservice/GitLab Runner/etc. from Big Bang, you must plan - an external/alternate deployment or accept loss of functionality during/after - upgrade. + chart_updates: ['Big Bang release updated from 2.14.0 to 2.15.0; notable composition + change: several charts added and several removed (see features/breaking + changes).'] + features: ["Introduces several new optional/packaged components: Istio Operator,\ + \ Fluentbit, Promtail, Loki, Minio Operator, Sonarqube, Fortify, Haproxy,\ + \ and a chart listed as \u201CNew\u201D (version 12.13.12-bb.3).", Includes + a minor update of an existing component from 1.13.0-bb.3 to 1.13.1-bb.0 + (exact component name not provided in notes).] + breaking_changes: ['Removes multiple previously packaged components: ECK Operator, + Authservice, Gitlab Runner, Anchore Enterprise, Mattermost, and Metrics + Server; any existing values, overrides, or dependencies for these must be + removed or replaced.', 'If you relied on Authservice/GitLab Runner/etc. + from Big Bang, you must plan an external/alternate deployment or accept + loss of functionality during/after upgrade.'] chart_version: 2.15.0 images: [] - version: 2.14.0 - kube: - - '1.27' + kube: ['1.27'] requirements: - name: Updated version: 1.19.3-bb.0 @@ -11482,20 +9792,18 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - No concrete application-level release notes were provided beyond the 'Admin - message' about supported Big Bang version, so features for 2.14.0 cannot be - determined from the supplied text. - breaking_changes: - - The 'Currently supported Big Bang Version' message changes from 3.25.0 (in - 2.13.0 notes) to 3.23.0 (in 2.14.0 notes). Treat this as a potential compatibility/support - policy change and verify what 'supported version' refers to in your environment - (K8s, Istio, underlying platform, etc.). + features: ['No concrete application-level release notes were provided beyond + the ''Admin message'' about supported Big Bang version, so features for + 2.14.0 cannot be determined from the supplied text.'] + breaking_changes: ['The ''Currently supported Big Bang Version'' message changes + from 3.25.0 (in 2.13.0 notes) to 3.23.0 (in 2.14.0 notes). Treat this as + a potential compatibility/support policy change and verify what ''supported + version'' refers to in your environment (K8s, Istio, underlying platform, + etc.).'] chart_version: 2.14.0 images: [] - version: 2.13.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.19.0-bb.2 @@ -11577,17 +9885,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang 2.13.0 updates the supported upstream Big Bang version to 3.25.0 - (from 3.22.1 in 2.12.0). - breaking_changes: - - Release notes provided only contain the admin message about supported version; - no breaking changes are listed in the provided text. + features: [Big Bang 2.13.0 updates the supported upstream Big Bang version to + 3.25.0 (from 3.22.1 in 2.12.0).] + breaking_changes: [Release notes provided only contain the admin message about + supported version; no breaking changes are listed in the provided text.] chart_version: 2.13.0 images: [] - version: 2.12.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.19.0-bb.0 @@ -11669,19 +9974,17 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided do not include specific changes between Big Bang 2.11.0\ - \ and 2.12.0; only an admin message is visible: \u201CCurrently supported\ - \ Big Bang Version is 3.22.1.\u201D" - breaking_changes: - - 'Potential support-policy breaking change: 2.12.0 appears to be out of the - currently supported window (admin message says supported version is 3.22.1), - which may impact upgrade assistance, security patches, and compatibility expectations.' + features: ["Release notes provided do not include specific changes between Big\ + \ Bang 2.11.0 and 2.12.0; only an admin message is visible: \u201CCurrently\ + \ supported Big Bang Version is 3.22.1.\u201D"] + breaking_changes: ['Potential support-policy breaking change: 2.12.0 appears + to be out of the currently supported window (admin message says supported + version is 3.22.1), which may impact upgrade assistance, security patches, + and compatibility expectations.'] chart_version: 2.12.0 images: [] - version: 2.11.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Istio Controlplane version: 1.18.2-bb.1 @@ -11762,36 +10065,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang 2.11.0 introduces several new packaged components (Cluster Auditor,\ - \ Promtail, Loki, Grafana, Harbor, and an additional component listed as \u201C\ - New\u201D)." - - Several previously bundled components are removed in 2.11.0 (Kyverno Policies, - Kyverno Reporter, Mattermost, Velero, Vault). - - One existing component shows a major version change from `1.12.4-bb.0` to - `0.25.0-bb.0` (component name not provided in notes; treat as a likely breaking/packaging - change and verify which chart this refers to). - features: - - Adds log aggregation/visualization stack components (Loki, Promtail, Grafana) - as first-class packages in Big Bang 2.11.0. - - Adds Cluster Auditor as a new component to improve cluster auditing/compliance - visibility. - - Adds Harbor as a packaged registry component (if enabled) in this Big Bang - release. - breaking_changes: - - Removes Kyverno Policies and Kyverno Reporter packages; any prior policy/reporting - functionality must be replaced or managed outside Big Bang. - - Removes Mattermost, Velero, and Vault packages; upgrades must account for - data migration/backup/restore and secrets management continuity if those were - in use. - - A component version changing from `1.12.4-bb.0` to `0.25.0-bb.0` suggests - a potentially breaking rename/replacement; confirm the component/chart mapping - before upgrading. + chart_updates: ["Big Bang 2.11.0 introduces several new packaged components\ + \ (Cluster Auditor, Promtail, Loki, Grafana, Harbor, and an additional component\ + \ listed as \u201CNew\u201D).", 'Several previously bundled components are + removed in 2.11.0 (Kyverno Policies, Kyverno Reporter, Mattermost, Velero, + Vault).', One existing component shows a major version change from `1.12.4-bb.0` + to `0.25.0-bb.0` (component name not provided in notes; treat as a likely + breaking/packaging change and verify which chart this refers to).] + features: ['Adds log aggregation/visualization stack components (Loki, Promtail, + Grafana) as first-class packages in Big Bang 2.11.0.', Adds Cluster Auditor + as a new component to improve cluster auditing/compliance visibility., Adds + Harbor as a packaged registry component (if enabled) in this Big Bang release.] + breaking_changes: [Removes Kyverno Policies and Kyverno Reporter packages; any + prior policy/reporting functionality must be replaced or managed outside + Big Bang., 'Removes Mattermost, Velero, and Vault packages; upgrades must + account for data migration/backup/restore and secrets management continuity + if those were in use.', A component version changing from `1.12.4-bb.0` + to `0.25.0-bb.0` suggests a potentially breaking rename/replacement; confirm + the component/chart mapping before upgrading.] chart_version: 2.11.0 images: [] - version: 2.10.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Istio Controlplane version: 1.18.2-bb.1 @@ -11870,35 +10165,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.10.0 introduces a major package composition change: many optional - packages are removed from the umbrella chart and several new packages are - added (Istio control plane, observability stack pieces, etc.).' - - One component shows a large version jump from `0.24.1-bb.3` to `1.12.4-bb.0` - (component name not provided in notes); treat this as high-risk and review - its specific chart/app changelog before upgrading. - features: - - Adds Istio Controlplane package (1.18.2-bb.1). - - Adds Jaeger (2.46.0-bb.2) plus an Elasticsearch/Kibana stack (1.3.1-bb.1) - for tracing/log analytics. - - Adds Fluent Bit (0.37.0-bb.0) and Monitoring (48.3.1-bb.0). - - 'Adds several app packages: Sonarqube (8.0.1-bb.4), Haproxy (1.12.0-bb.1), - Mattermost (8.0.1-bb.1), and Vault (0.24.1-bb.3).' - breaking_changes: - - 'Removes multiple previously-available packages from Big Bang: Cluster Auditor, - Promtail, Loki, Tempo, Grafana, Twistlock, ArgoCD, Authservice, Gitlab Runner, - Keycloak, and Harbor. If you depended on any of these being deployed/managed - by Big Bang, you must migrate to external installs or new replacement packages - before/at upgrade.' - - Observability stack changes are significant (Loki/Promtail/Grafana/Tempo removed; - new Monitoring/Jaeger/Elasticsearch/Kibana/Fluent Bit added). Expect changes - in dashboards, log shipping, tracing endpoints, and storage backends; plan - data migration/retention impacts. + chart_updates: ['Big Bang 2.10.0 introduces a major package composition change: + many optional packages are removed from the umbrella chart and several new + packages are added (Istio control plane, observability stack pieces, etc.).', + One component shows a large version jump from `0.24.1-bb.3` to `1.12.4-bb.0` + (component name not provided in notes); treat this as high-risk and review + its specific chart/app changelog before upgrading.] + features: [Adds Istio Controlplane package (1.18.2-bb.1)., Adds Jaeger (2.46.0-bb.2) + plus an Elasticsearch/Kibana stack (1.3.1-bb.1) for tracing/log analytics., + Adds Fluent Bit (0.37.0-bb.0) and Monitoring (48.3.1-bb.0)., 'Adds several + app packages: Sonarqube (8.0.1-bb.4), Haproxy (1.12.0-bb.1), Mattermost + (8.0.1-bb.1), and Vault (0.24.1-bb.3).'] + breaking_changes: ['Removes multiple previously-available packages from Big + Bang: Cluster Auditor, Promtail, Loki, Tempo, Grafana, Twistlock, ArgoCD, + Authservice, Gitlab Runner, Keycloak, and Harbor. If you depended on any + of these being deployed/managed by Big Bang, you must migrate to external + installs or new replacement packages before/at upgrade.', 'Observability + stack changes are significant (Loki/Promtail/Grafana/Tempo removed; new + Monitoring/Jaeger/Elasticsearch/Kibana/Fluent Bit added). Expect changes + in dashboards, log shipping, tracing endpoints, and storage backends; plan + data migration/retention impacts.'] chart_version: 2.10.0 images: [] - version: 2.9.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.18.2-bb.1 @@ -11977,30 +10267,25 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang release 2.9.0 updates the curated set of packaged components versus - 2.8.0, adding several new components and removing several previously-included - ones. - features: - - 'Adds new packaged components: Istio Operator, Kyverno Policies, Promtail, - Loki, Argo CD, Authservice, Anchore Enterprise, Velero, and Harbor (now included - as a managed package).' - breaking_changes: - - 'Multiple components are removed from the default Big Bang package set in - 2.9.0: Jaeger, Elasticsearch/Kibana, Fluentbit, Sonarqube, Haproxy, Mattermost, - and Vault. If you relied on any of these, you must plan migration/replacement - or manage them outside Big Bang after upgrade.' - - 'Logging/observability stack shifts: Fluentbit/ES/Kibana/Jaeger removal alongside - Loki/Promtail addition may require reworking log collection, storage, dashboards, - and retention configuration.' - - Security/policy and delivery capabilities change with Kyverno Policies and - Argo CD being newly introduced; enabling them may require new RBAC, namespaces, - and configuration decisions. + chart_updates: ['Big Bang release 2.9.0 updates the curated set of packaged + components versus 2.8.0, adding several new components and removing several + previously-included ones.'] + features: ['Adds new packaged components: Istio Operator, Kyverno Policies, + Promtail, Loki, Argo CD, Authservice, Anchore Enterprise, Velero, and Harbor + (now included as a managed package).'] + breaking_changes: ['Multiple components are removed from the default Big Bang + package set in 2.9.0: Jaeger, Elasticsearch/Kibana, Fluentbit, Sonarqube, + Haproxy, Mattermost, and Vault. If you relied on any of these, you must + plan migration/replacement or manage them outside Big Bang after upgrade.', + 'Logging/observability stack shifts: Fluentbit/ES/Kibana/Jaeger removal alongside + Loki/Promtail addition may require reworking log collection, storage, dashboards, + and retention configuration.', 'Security/policy and delivery capabilities + change with Kyverno Policies and Argo CD being newly introduced; enabling + them may require new RBAC, namespaces, and configuration decisions.'] chart_version: 2.9.0 images: [] - version: 2.8.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.18.2-bb.0 @@ -12078,17 +10363,14 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Release notes were referenced (Big Bang 2.7.0 and 2.8.0), but no actual changelog - content was provided to extract specific features. - breaking_changes: - - Unable to identify breaking changes because the release note details were - not included in the prompt. + features: ['Release notes were referenced (Big Bang 2.7.0 and 2.8.0), but no + actual changelog content was provided to extract specific features.'] + breaking_changes: [Unable to identify breaking changes because the release note + details were not included in the prompt.] chart_version: 2.8.0 images: [] - version: 2.7.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.18.1-bb.0 @@ -12165,41 +10447,34 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang 2.7.0 introduces significant bundle composition changes: multiple\ - \ new packages were added (Jaeger, Gatekeeper, Kyverno, ECK Operator, Loki,\ - \ Authservice, Sonarqube, Mattermost, Metrics Server, and another package\ - \ listed as \u201CNew\u201D)." - - 'Several packages present in 2.6.0 were removed in 2.7.0: Istio Controlplane/Operator, - Monitoring, Twistlock, and GitLab.' - - "One package was updated from `3.10.0-bb.0` to `18.4.3-bb.2` (the component\ - \ name wasn\u2019t provided in the notes)." - features: - - Adds several new optional capabilities to the Big Bang bundle, including policy - enforcement (Gatekeeper/Kyverno), tracing (Jaeger), logging (Loki), and additional - apps/operators (ECK Operator, Authservice, Sonarqube, Mattermost, Metrics - Server). - - Removes/decouples some previously bundled components (Istio, Monitoring, GitLab, - Twistlock), implying users now install/operate them separately or via different - packages depending on desired functionality. - breaking_changes: - - Removal of Istio Controlplane/Operator means any existing Istio-managed ingress/service - mesh setup must be migrated to whatever replaces it in 2.7.0, or installed - separately before/after the upgrade. - - Removal of Monitoring means any Prometheus/Grafana/Alertmanager stack previously - managed by Big Bang will no longer be upgraded/managed; you must preserve - CRDs/PVCs and plan an alternative monitoring deployment. - - Removal of GitLab from the bundle means Big Bang no longer manages GitLab - upgrades; ensure you have a standalone GitLab plan and avoid accidental uninstall - of resources during the upgrade. - - Removal of Twistlock means security scanning/enforcement previously integrated - will disappear unless replaced by another tool; confirm compliance requirements - before upgrading. + chart_updates: ["Big Bang 2.7.0 introduces significant bundle composition changes:\ + \ multiple new packages were added (Jaeger, Gatekeeper, Kyverno, ECK Operator,\ + \ Loki, Authservice, Sonarqube, Mattermost, Metrics Server, and another\ + \ package listed as \u201CNew\u201D).", 'Several packages present in 2.6.0 + were removed in 2.7.0: Istio Controlplane/Operator, Monitoring, Twistlock, + and GitLab.', "One package was updated from `3.10.0-bb.0` to `18.4.3-bb.2`\ + \ (the component name wasn\u2019t provided in the notes)."] + features: ['Adds several new optional capabilities to the Big Bang bundle, including + policy enforcement (Gatekeeper/Kyverno), tracing (Jaeger), logging (Loki), + and additional apps/operators (ECK Operator, Authservice, Sonarqube, Mattermost, + Metrics Server).', 'Removes/decouples some previously bundled components + (Istio, Monitoring, GitLab, Twistlock), implying users now install/operate + them separately or via different packages depending on desired functionality.'] + breaking_changes: ['Removal of Istio Controlplane/Operator means any existing + Istio-managed ingress/service mesh setup must be migrated to whatever replaces + it in 2.7.0, or installed separately before/after the upgrade.', Removal + of Monitoring means any Prometheus/Grafana/Alertmanager stack previously + managed by Big Bang will no longer be upgraded/managed; you must preserve + CRDs/PVCs and plan an alternative monitoring deployment., Removal of GitLab + from the bundle means Big Bang no longer manages GitLab upgrades; ensure + you have a standalone GitLab plan and avoid accidental uninstall of resources + during the upgrade., Removal of Twistlock means security scanning/enforcement + previously integrated will disappear unless replaced by another tool; confirm + compliance requirements before upgrading.] chart_version: 2.7.0 images: [] - version: 2.6.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Istio Controlplane version: 1.17.3-bb.1 @@ -12275,18 +10550,16 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang version 2.6.0 is the target upgrade from 2.5.0, but no detailed release-note - content was provided beyond placeholders, so features cannot be enumerated - from the supplied text. - breaking_changes: - - No breaking changes were listed in the provided notes; verify in the official - Big Bang 2.6.0 release notes and component changelogs before upgrading. + features: ['Big Bang version 2.6.0 is the target upgrade from 2.5.0, but no + detailed release-note content was provided beyond placeholders, so features + cannot be enumerated from the supplied text.'] + breaking_changes: [No breaking changes were listed in the provided notes; verify + in the official Big Bang 2.6.0 release notes and component changelogs before + upgrading.] chart_version: 2.6.0 images: [] - version: 2.5.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.17.3-bb.1 @@ -12359,34 +10632,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang version bump from 2.4.0 to 2.5.0 with significant component lineup - changes. - - Multiple new components introduced (observability, auth, developer tooling) - and several legacy components removed. - - GitLab component upgraded from 6.11.3-bb.0 to 7.0.4-bb.0. - features: - - 'Adds several new platform capabilities via new packaged components: Jaeger, - Kiali, Tempo, and a full Monitoring stack for observability.' - - Adds Elastic stack components (ECK Operator + Elasticsearch Kibana) to support - log/metric storage and visualization. - - Adds Authservice for authentication/authorization integration. - - Adds developer tooling packages including Nexus, Sonarqube, and Mattermost. - breaking_changes: - - Removes multiple previously-included components (Cluster Auditor, Kyverno - Policies, Neuvector, Minio Operator/Minio, Anchore Enterprise, Velero); any - workloads depending on them must be migrated or replaced before upgrade. - - "Large GitLab upgrade (6.11.x \u2192 7.0.x) may introduce GitLab breaking\ - \ changes and requires following GitLab\u2019s upgrade/migration steps and\ - \ verifying chart values compatibility." - - Vault is now included as a new component; if you already run Vault separately, - plan for namespace/resource conflicts and decide whether to adopt Big Bang-managed - Vault or disable it. + chart_updates: [Big Bang version bump from 2.4.0 to 2.5.0 with significant component + lineup changes., 'Multiple new components introduced (observability, auth, + developer tooling) and several legacy components removed.', GitLab component + upgraded from 6.11.3-bb.0 to 7.0.4-bb.0.] + features: ['Adds several new platform capabilities via new packaged components: + Jaeger, Kiali, Tempo, and a full Monitoring stack for observability.', Adds + Elastic stack components (ECK Operator + Elasticsearch Kibana) to support + log/metric storage and visualization., Adds Authservice for authentication/authorization + integration., 'Adds developer tooling packages including Nexus, Sonarqube, + and Mattermost.'] + breaking_changes: ['Removes multiple previously-included components (Cluster + Auditor, Kyverno Policies, Neuvector, Minio Operator/Minio, Anchore Enterprise, + Velero); any workloads depending on them must be migrated or replaced before + upgrade.', "Large GitLab upgrade (6.11.x \u2192 7.0.x) may introduce GitLab\ + \ breaking changes and requires following GitLab\u2019s upgrade/migration\ + \ steps and verifying chart values compatibility.", 'Vault is now included + as a new component; if you already run Vault separately, plan for namespace/resource + conflicts and decide whether to adopt Big Bang-managed Vault or disable + it.'] chart_version: 2.5.0 images: [] - version: 2.4.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.17.2-bb.2 @@ -12459,34 +10727,28 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Big Bang 2.4.0 is a meta-release that substantially reshuffles included components: - several packages are removed and several new ones are added (GitLab, Keycloak, - MinIO and MinIO Operator).' - - Multiple observability and security-related add-ons are removed (e.g., Fluentbit/Promtail/Tempo/Twistlock) - which may require replacement tooling or external integrations. - features: - - Adds GitLab as an included/managed component. - - Adds Keycloak as an included/managed component for identity management. - - Adds MinIO and the MinIO Operator as included/managed components for S3-compatible - object storage. - breaking_changes: - - Removes Istio Operator and Istio Controlplane components (service mesh management - must be handled differently or is no longer provided by this release). - - Removes Kiali (Istio observability UI) from the stack. - - Removes ECK Operator (Elastic Cloud on Kubernetes) from the stack. - - Removes Fluentbit and Promtail (log shipping) and Tempo (tracing); existing - logging/tracing pipelines will break unless replaced. - - Removes Twistlock (Prisma Cloud) integration/component. - - Removes Authservice; any SSO/authn flows depending on it must be migrated. - - Removes Nexus; any artifact repository functionality must be replaced or externalized. - - Removes Vault component; any in-cluster secret management workflows depending - on it must be migrated. + chart_updates: ['Big Bang 2.4.0 is a meta-release that substantially reshuffles + included components: several packages are removed and several new ones are + added (GitLab, Keycloak, MinIO and MinIO Operator).', 'Multiple observability + and security-related add-ons are removed (e.g., Fluentbit/Promtail/Tempo/Twistlock) + which may require replacement tooling or external integrations.'] + features: [Adds GitLab as an included/managed component., Adds Keycloak as an + included/managed component for identity management., Adds MinIO and the + MinIO Operator as included/managed components for S3-compatible object storage.] + breaking_changes: [Removes Istio Operator and Istio Controlplane components + (service mesh management must be handled differently or is no longer provided + by this release)., Removes Kiali (Istio observability UI) from the stack., + Removes ECK Operator (Elastic Cloud on Kubernetes) from the stack., Removes + Fluentbit and Promtail (log shipping) and Tempo (tracing); existing logging/tracing + pipelines will break unless replaced., Removes Twistlock (Prisma Cloud) + integration/component., Removes Authservice; any SSO/authn flows depending + on it must be migrated., Removes Nexus; any artifact repository functionality + must be replaced or externalized., Removes Vault component; any in-cluster + secret management workflows depending on it must be migrated.] chart_version: 2.4.0 images: [] - version: 2.3.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Istio Controlplane version: 1.17.2-bb.1 @@ -12562,18 +10824,16 @@ addons: summary: helm_changes: '' chart_updates: [] - features: - - Big Bang supported version baseline increased from 3.22.1 (in 2.2.0 notes) - to 3.25.0 (in 2.3.0 notes). - breaking_changes: - - 'Potential compatibility/support change: Big Bang 2.3.0 indicates a newer - currently supported Big Bang version (3.25.0) vs 3.22.1 in 2.2.0; ensure your - environment and dependent packages align with the newer supported baseline.' + features: [Big Bang supported version baseline increased from 3.22.1 (in 2.2.0 + notes) to 3.25.0 (in 2.3.0 notes).] + breaking_changes: ['Potential compatibility/support change: Big Bang 2.3.0 indicates + a newer currently supported Big Bang version (3.25.0) vs 3.22.1 in 2.2.0; + ensure your environment and dependent packages align with the newer supported + baseline.'] chart_version: 2.3.0 images: [] - version: 2.2.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.17.2-bb.1 @@ -12646,35 +10906,30 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang release 2.2.0 significantly changes the bundled component set compared - to 2.1.0, adding Kyverno Policies, Velero, and Metrics Server while removing - many previously bundled addons (Istio controlplane/operator, monitoring stack, - logging, policy, CI/CD, artifact, and secrets tooling). - - The supported Big Bang version in the admin message changes from 3.25.0 (noted - on 2.1.0 page) to 3.22.1 (noted on 2.2.0 page); verify which message is authoritative - for your environment/support contract. - features: - - Introduces Kyverno Policies as a new packaged component (noted as added at - 1.1.0-bb.6 in the component list). - - Introduces Velero as a new packaged component for backup/restore (added at - 3.1.5-bb.1). - - Introduces Metrics Server as a new packaged component to provide Kubernetes - resource metrics (added at 3.9.0-bb.1). - breaking_changes: - - Large-scale removal of previously included components (Istio, monitoring/logging, - Gatekeeper, Vault, Argo CD, Minio, GitLab Runner, Nexus, Mattermost, Twistlock, - etc.) means existing workloads depending on those components will lose them - unless you manage them separately. - - "Component version change listed as 3.9.0-bb.1 \u2192 0.24.1-bb.0 indicates\ - \ at least one packaged chart/app was replaced or significantly downgraded/renamed;\ - \ identify which component this refers to in your actual Big Bang manifest\ - \ before upgrading." + chart_updates: ['Big Bang release 2.2.0 significantly changes the bundled component + set compared to 2.1.0, adding Kyverno Policies, Velero, and Metrics Server + while removing many previously bundled addons (Istio controlplane/operator, + monitoring stack, logging, policy, CI/CD, artifact, and secrets tooling).', + The supported Big Bang version in the admin message changes from 3.25.0 (noted + on 2.1.0 page) to 3.22.1 (noted on 2.2.0 page); verify which message is + authoritative for your environment/support contract.] + features: [Introduces Kyverno Policies as a new packaged component (noted as + added at 1.1.0-bb.6 in the component list)., Introduces Velero as a new + packaged component for backup/restore (added at 3.1.5-bb.1)., Introduces + Metrics Server as a new packaged component to provide Kubernetes resource + metrics (added at 3.9.0-bb.1).] + breaking_changes: ['Large-scale removal of previously included components (Istio, + monitoring/logging, Gatekeeper, Vault, Argo CD, Minio, GitLab Runner, Nexus, + Mattermost, Twistlock, etc.) means existing workloads depending on those + components will lose them unless you manage them separately.', "Component\ + \ version change listed as 3.9.0-bb.1 \u2192 0.24.1-bb.0 indicates at least\ + \ one packaged chart/app was replaced or significantly downgraded/renamed;\ + \ identify which component this refers to in your actual Big Bang manifest\ + \ before upgrading."] chart_version: 2.2.0 images: [] - version: 2.1.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Istio Controlplane version: 1.17.2-bb.0 @@ -12749,34 +11004,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Big Bang 2.1.0 introduces several new packaged components (Istio control plane/operator, - Jaeger, Kiali, Gatekeeper, Elastic stack components, Fluent Bit, NeuVector, - Argo CD, GitLab Runner, Mattermost, Vault). - - "Some previously included packages are removed (Anchore Enterprise and Velero);\ - \ there is also a note indicating a 'New: 0.4.1 \u2192 removed' entry which\ - \ likely refers to an internal wrapper/umbrella component\u2014needs confirmation\ - \ from the official changelog." - features: - - Adds a full Istio service mesh stack (control plane/operator) with observability - components (Jaeger, Kiali). - - Adds policy enforcement via Gatekeeper. - - Adds logging and Elastic stack options via Fluent Bit, ECK operator, and Elasticsearch/Kibana - packages. - - Adds GitOps and CI/CD tooling via Argo CD and GitLab Runner. - - Adds platform apps/security tooling such as Mattermost, Vault, and NeuVector. - breaking_changes: - - Removal of Anchore Enterprise and Velero from the Big Bang bundle means existing - deployments of those components will no longer be managed/upgraded by Big - Bang 2.1.0 and must be handled separately (migrated, pinned, or replaced). - - Introducing Istio (if enabled) can change network behavior (mTLS, sidecars, - ingress/egress) and may require namespace labeling, resource tuning, and compatibility - checks for existing workloads. + chart_updates: ['Big Bang 2.1.0 introduces several new packaged components (Istio + control plane/operator, Jaeger, Kiali, Gatekeeper, Elastic stack components, + Fluent Bit, NeuVector, Argo CD, GitLab Runner, Mattermost, Vault).', "Some\ + \ previously included packages are removed (Anchore Enterprise and Velero);\ + \ there is also a note indicating a 'New: 0.4.1 \u2192 removed' entry which\ + \ likely refers to an internal wrapper/umbrella component\u2014needs confirmation\ + \ from the official changelog."] + features: ['Adds a full Istio service mesh stack (control plane/operator) with + observability components (Jaeger, Kiali).', Adds policy enforcement via + Gatekeeper., 'Adds logging and Elastic stack options via Fluent Bit, ECK + operator, and Elasticsearch/Kibana packages.', Adds GitOps and CI/CD tooling + via Argo CD and GitLab Runner., 'Adds platform apps/security tooling such + as Mattermost, Vault, and NeuVector.'] + breaking_changes: ['Removal of Anchore Enterprise and Velero from the Big Bang + bundle means existing deployments of those components will no longer be + managed/upgraded by Big Bang 2.1.0 and must be handled separately (migrated, + pinned, or replaced).', 'Introducing Istio (if enabled) can change network + behavior (mTLS, sidecars, ingress/egress) and may require namespace labeling, + resource tuning, and compatibility checks for existing workloads.'] chart_version: 2.1.0 images: [] - version: 2.0.0 - kube: - - '1.26' + kube: ['1.26'] requirements: - name: Updated version: 1.17.2-bb.0 @@ -12847,33 +11097,29 @@ addons: incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Big Bang version jump 1.42.0 \u2192 2.0.0 includes significant component\ - \ set changes (many new packages added; several removed)." - - "Core component version bumps include a major increase for the primary 'Updated'\ - \ component (2.31.3-bb.0 \u2192 3.9.0-bb.0), plus Nexus, Sonarqube, Anchore\ - \ Enterprise, Mattermost Operator, and Keycloak." - - Istio Operator, Gatekeeper, ECK Operator, Authservice, Gitlab Runner, Vault, - and Metrics Server are removed from the Big Bang bundle in 2.0.0. - features: - - 'Adds multiple new optional packages: Cluster Auditor, Kyverno, Kyverno Reporter, - Tempo, Monitoring, Twistlock, Velero, Minio Operator/Minio, and others listed - as ''new''.' - - Updates included applications to newer chart/app versions for Nexus, Sonarqube, - Anchore Enterprise, Mattermost Operator, and Keycloak. - breaking_changes: - - Removal of several previously-included components (Istio Operator, Gatekeeper, - ECK Operator, Authservice, Gitlab Runner, Vault, Metrics Server) requires - migrating any functionality/configuration to the new recommended approach - or external installs. - - "Large version bumps (notably Sonarqube 1.x \u2192 8.x and Nexus 41.x \u2192\ - \ 47.x) may introduce their own breaking changes and should be validated against\ - \ existing data/config and upgrade paths." + chart_updates: ["Big Bang version jump 1.42.0 \u2192 2.0.0 includes significant\ + \ component set changes (many new packages added; several removed).", "Core\ + \ component version bumps include a major increase for the primary 'Updated'\ + \ component (2.31.3-bb.0 \u2192 3.9.0-bb.0), plus Nexus, Sonarqube, Anchore\ + \ Enterprise, Mattermost Operator, and Keycloak.", 'Istio Operator, Gatekeeper, + ECK Operator, Authservice, Gitlab Runner, Vault, and Metrics Server are + removed from the Big Bang bundle in 2.0.0.'] + features: ['Adds multiple new optional packages: Cluster Auditor, Kyverno, Kyverno + Reporter, Tempo, Monitoring, Twistlock, Velero, Minio Operator/Minio, and + others listed as ''new''.', 'Updates included applications to newer chart/app + versions for Nexus, Sonarqube, Anchore Enterprise, Mattermost Operator, + and Keycloak.'] + breaking_changes: ['Removal of several previously-included components (Istio + Operator, Gatekeeper, ECK Operator, Authservice, Gitlab Runner, Vault, Metrics + Server) requires migrating any functionality/configuration to the new recommended + approach or external installs.', "Large version bumps (notably Sonarqube\ + \ 1.x \u2192 8.x and Nexus 41.x \u2192 47.x) may introduce their own breaking\ + \ changes and should be validated against existing data/config and upgrade\ + \ paths."] chart_version: 2.0.0 images: [] - version: 1.42.0 - kube: - - '1.22' + kube: ['1.22'] requirements: - name: Updated version: 1.14.3-bb.3 @@ -12947,135 +11193,63 @@ addons: helm_repository_url: https://aws.github.io/eks-charts versions: - version: 1.23.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 1.22.1 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 1.21.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.21.0 - version: 1.20.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.20.0 - version: 1.19.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.19.0 - version: 1.18.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.18.0 - version: 1.17.1 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.17.1 - version: 1.16.2 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Reverted the CNI spec used by the bundled CNI config to 0.4.0 to maintain - compatibility with EKS 1.23 (v1.16.0 had moved to CNI spec 1.0.0). - - In nftables mode, increased support to up to 50 CIDRs. - breaking_changes: - - 'Behavior change: the shipped CNI config/spec is reverted from 1.0.0 back - to 0.4.0 for EKS 1.23 compatibility; if you rely on CNI spec 1.0.0 semantics, - validate your CNI config/chain and cluster version expectations during upgrade.' + features: [Reverted the CNI spec used by the bundled CNI config to 0.4.0 to + maintain compatibility with EKS 1.23 (v1.16.0 had moved to CNI spec 1.0.0)., + 'In nftables mode, increased support to up to 50 CIDRs.'] + breaking_changes: ['Behavior change: the shipped CNI config/spec is reverted + from 1.0.0 back to 0.4.0 for EKS 1.23 compatibility; if you rely on CNI + spec 1.0.0 semantics, validate your CNI config/chain and cluster version + expectations during upgrade.'] chart_version: 1.16.2 images: [] - version: 1.16.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -13087,106 +11261,69 @@ addons: \ upgrade practice (from v1.15.0 note): ensure the full manifest/Helm release\ \ is applied so RBAC/CRDs stay in sync (don\u2019t patch only the DaemonSet\ \ image)." - chart_updates: - - Chart exposes additional parameters for `revisionHistory` and `securityContext` - (v1.16.0). - - Chart templates were updated to include feature flags in the ConfigMap (v1.16.0). - features: - - CNI spec updated to 1.0.0 in the VPC CNI conflist (may matter for tooling - that validates CNI config). - - Security Groups for Pods is now supported on IPv6 clusters (requires allowing - ICMPv6 Neighbor Discovery in SGs). - - Prometheus metrics scraping support from the CNI metrics helper. - - Manifest added for Multus 4.0.2 thick plugin support. - breaking_changes: - - For IPv6 clusters using Security Groups for Pods, you must allow ICMPv6 Neighbor - Discovery in EC2 security groups or pods may fail to resolve IPv6 to MAC (connectivity - issues). - - 'Operationally treat this as a full-release upgrade: RBAC/CRDs/config changes - accompany the DaemonSet; upgrading by only changing images risks startup failures - (highlighted in v1.15.0 notes and still relevant).' + chart_updates: [Chart exposes additional parameters for `revisionHistory` and + `securityContext` (v1.16.0)., Chart templates were updated to include feature + flags in the ConfigMap (v1.16.0).] + features: [CNI spec updated to 1.0.0 in the VPC CNI conflist (may matter for + tooling that validates CNI config)., Security Groups for Pods is now supported + on IPv6 clusters (requires allowing ICMPv6 Neighbor Discovery in SGs)., + Prometheus metrics scraping support from the CNI metrics helper., Manifest + added for Multus 4.0.2 thick plugin support.] + breaking_changes: ['For IPv6 clusters using Security Groups for Pods, you must + allow ICMPv6 Neighbor Discovery in EC2 security groups or pods may fail + to resolve IPv6 to MAC (connectivity issues).', 'Operationally treat this + as a full-release upgrade: RBAC/CRDs/config changes accompany the DaemonSet; + upgrading by only changing images risks startup failures (highlighted in + v1.15.0 notes and still relevant).'] chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '`aws-node` DaemonSet continues to include the additional `aws-eks-nodeagent` - container introduced in 1.14.x for Kubernetes NetworkPolicy support; image - bump to `amazon/aws-network-policy-agent:v1.0.2` in 1.15.0.' - - 'RBAC/manifest content changed in 1.15.0: the `aws-node` `ClusterRole` is - modified (remove `update` on `nodes`; add `get, list, patch` on `CNINode`). - Upgrade must apply the full manifest/chart so the new RBAC is present.' - - Security Groups for Pods integration now uses the `CNINode` CRD in 1.15.0, - deprecating reliance on the `vpc.amazonaws.com/has-trunk-attached` node label. - features: - - "Support for VPC Resource Controller\u2019s `CNINode` (used by Security Groups\ - \ for Pods) was added/reintroduced." - - New `DISABLE_CONTAINER_V6` env var allows disabling IPv6 networking inside - container network namespaces. - - New `IP_COOLDOWN_PERIOD` env var allows configuring the IP cooldown period. - breaking_changes: - - RBAC change in 1.15.0 requires updating the entire manifest/chart (including - `aws-node` `ClusterRole`) during upgrade/downgrade; partial applies can prevent - the CNI containers from starting. - - Security Groups for Pods now relies on the `CNINode` CRD and deprecates the - `vpc.amazonaws.com/has-trunk-attached` label; any tooling/automation depending - on that label should be updated. + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['`aws-node` DaemonSet continues to include the additional `aws-eks-nodeagent` + container introduced in 1.14.x for Kubernetes NetworkPolicy support; image + bump to `amazon/aws-network-policy-agent:v1.0.2` in 1.15.0.', 'RBAC/manifest + content changed in 1.15.0: the `aws-node` `ClusterRole` is modified (remove + `update` on `nodes`; add `get, list, patch` on `CNINode`). Upgrade must + apply the full manifest/chart so the new RBAC is present.', 'Security Groups + for Pods integration now uses the `CNINode` CRD in 1.15.0, deprecating reliance + on the `vpc.amazonaws.com/has-trunk-attached` node label.'] + features: ["Support for VPC Resource Controller\u2019s `CNINode` (used by Security\ + \ Groups for Pods) was added/reintroduced.", New `DISABLE_CONTAINER_V6` + env var allows disabling IPv6 networking inside container network namespaces., + New `IP_COOLDOWN_PERIOD` env var allows configuring the IP cooldown period.] + breaking_changes: [RBAC change in 1.15.0 requires updating the entire manifest/chart + (including `aws-node` `ClusterRole`) during upgrade/downgrade; partial applies + can prevent the CNI containers from starting., Security Groups for Pods + now relies on the `CNINode` CRD and deprecates the `vpc.amazonaws.com/has-trunk-attached` + label; any tooling/automation depending on that label should be updated.] chart_version: 1.15.0 images: [] - version: 1.14.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '`aws-node` DaemonSet now runs an additional container `aws-eks-nodeagent` - (AWS Network Policy Agent) alongside the existing CNI containers.' - - Verification output/images now include `amazon/aws-network-policy-agent:v1.0.1` - in addition to `amazon-k8s-cni-init` and `amazon-k8s-cni`. - - If deploying via raw manifests, use the v1.14.0 YAMLs (and region-specific - variants for gov/cloud-cn), as the DaemonSet spec changed to include the new - container. - features: - - Adds Kubernetes NetworkPolicy enforcement support via an in-pod Network Policy - Agent (`aws-eks-nodeagent`). - breaking_changes: - - "`aws-eks-nodeagent` exposes metrics on host-network port 8080 by default;\ - \ this can conflict with other hostNetwork workloads binding to 8080. Change\ - \ the agent\u2019s metrics port via the `metrics-bind-addr` container argument\ - \ if needed." + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['`aws-node` DaemonSet now runs an additional container `aws-eks-nodeagent` + (AWS Network Policy Agent) alongside the existing CNI containers.', 'Verification + output/images now include `amazon/aws-network-policy-agent:v1.0.1` in addition + to `amazon-k8s-cni-init` and `amazon-k8s-cni`.', 'If deploying via raw manifests, + use the v1.14.0 YAMLs (and region-specific variants for gov/cloud-cn), as + the DaemonSet spec changed to include the new container.'] + features: [Adds Kubernetes NetworkPolicy enforcement support via an in-pod Network + Policy Agent (`aws-eks-nodeagent`).] + breaking_changes: ["`aws-eks-nodeagent` exposes metrics on host-network port\ + \ 8080 by default; this can conflict with other hostNetwork workloads binding\ + \ to 8080. Change the agent\u2019s metrics port via the `metrics-bind-addr`\ + \ container argument if needed."] chart_version: 1.14.0 images: [] - version: 1.13.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -13203,67 +11340,38 @@ addons: \ If you had custom tolerations, re-validate output for any formatting differences.\n\ - **Env var case-insensitivity**: all AWS VPC CNI env vars are now treated\ \ case-insensitively; standardize to canonical uppercase to avoid confusion.\n" - chart_updates: - - 'CNI chart: fix tolerations templating to produce valid YAML.' - - 'CNI chart: refactor image template logic to better support flexible endpoints/registries.' - - 'Init container behavior: install all core CNI plugins via init container - (manifest content/containers may change).' - - 'EKS add-on manifest: add resource limits on init container (may affect custom - overrides).' - features: - - '`ENABLE_V6_EGRESS`: allows pods in an IPv4 cluster to reach IPv6 endpoints - (IPv6 egress capability).' - - '`DISABLE_LEAKED_ENI_CLEANUP`: lets operators disable the leaked ENI cleanup - task if it conflicts with their operational model.' - - '`AWS_EC2_ENDPOINT`: supports using a custom EC2 API endpoint (e.g., private - endpoints or special partitions).' + chart_updates: ['CNI chart: fix tolerations templating to produce valid YAML.', + 'CNI chart: refactor image template logic to better support flexible endpoints/registries.', + 'Init container behavior: install all core CNI plugins via init container + (manifest content/containers may change).', 'EKS add-on manifest: add resource + limits on init container (may affect custom overrides).'] + features: ['`ENABLE_V6_EGRESS`: allows pods in an IPv4 cluster to reach IPv6 + endpoints (IPv6 egress capability).', '`DISABLE_LEAKED_ENI_CLEANUP`: lets + operators disable the leaked ENI cleanup task if it conflicts with their + operational model.', '`AWS_EC2_ENDPOINT`: supports using a custom EC2 API + endpoint (e.g., private endpoints or special partitions).'] breaking_changes: [] chart_version: 1.13.0 images: [] - version: 1.12.5 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.2.7 images: [] - version: 1.11.5 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 1.10.3 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.1.15 images: [] - name: amazon-vpc-cni-k8s - icon: https://docs.tigera.io/img/calico-logo.webp git_url: https://github.com/projectcalico/calico release_url: https://github.com/projectcalico/calico/releases/tag/v{vsn} @@ -13272,267 +11380,187 @@ addons: eolApiSlug: calico versions: - version: 3.32.2 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifacts updated to v3.32.2 (container images/binaries/manifests, - Windows bundle, tigera-operator Helm chart, and CRD charts). + features: ['Release artifacts updated to v3.32.2 (container images/binaries/manifests, + Windows bundle, tigera-operator Helm chart, and CRD charts).'] breaking_changes: [] chart_version: 3.32.2 - images: - - quay.io/tigera/operator:v1.42.6 + images: ['quay.io/tigera/operator:v1.42.6'] - version: 3.32.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Calico v3.32.0 release artifacts include updated tigera-operator Helm chart - (v3.32.0) and separate CRD Helm charts for `crd.projectcalico.org/v1` (v3.32.0) - and a tech-preview `projectcalico.org/v3` CRD chart. - - v3.32.0 continues to publish the standard Calico release bundle (images/binaries/manifests) - plus Windows and OpenShift (ocp.tgz) assets for this version. + features: [Calico v3.32.0 release artifacts include updated tigera-operator + Helm chart (v3.32.0) and separate CRD Helm charts for `crd.projectcalico.org/v1` + (v3.32.0) and a tech-preview `projectcalico.org/v3` CRD chart., v3.32.0 + continues to publish the standard Calico release bundle (images/binaries/manifests) + plus Windows and OpenShift (ocp.tgz) assets for this version.] breaking_changes: [] chart_version: 3.32.0 - images: - - quay.io/tigera/operator:v1.42.0 + images: ['quay.io/tigera/operator:v1.42.0'] - version: 3.31.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - New release artifacts packaging includes per-arch image tarballs (including - FIPS for linux/amd64), making air-gapped installs/upgrades easier by importing - images directly from provided tar files. - - Updated tigera-operator Helm chart package version to v3.31.0 (chart content - likely updated to reference Calico v3.31.0 images/manifests). + features: ['New release artifacts packaging includes per-arch image tarballs + (including FIPS for linux/amd64), making air-gapped installs/upgrades easier + by importing images directly from provided tar files.', Updated tigera-operator + Helm chart package version to v3.31.0 (chart content likely updated to reference + Calico v3.31.0 images/manifests).] breaking_changes: [] chart_version: 3.31.0 - images: - - quay.io/tigera/operator:v1.40.0 + images: ['quay.io/tigera/operator:v1.40.0'] - version: 3.30.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v3.30.0 ships updated Calico component images/binaries and updated install - bundles (including tigera-operator Helm v3 chart) compared to v3.29.0. (No - feature-level details were provided in the notes you shared.) - breaking_changes: - - No breaking changes were listed in the notes you shared; confirm by reviewing - the v3.30.0 release notes and the tigera-operator Helm chart changelog before - upgrading. + features: [v3.30.0 ships updated Calico component images/binaries and updated + install bundles (including tigera-operator Helm v3 chart) compared to v3.29.0. + (No feature-level details were provided in the notes you shared.)] + breaking_changes: [No breaking changes were listed in the notes you shared; + confirm by reviewing the v3.30.0 release notes and the tigera-operator Helm + chart changelog before upgrading.] chart_version: 3.30.0 - images: - - quay.io/tigera/operator:v1.38.0 + images: ['quay.io/tigera/operator:v1.38.0'] eolAt: '2026-04-30' - version: 3.29.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifacts updated to v3.29.0 (new container images/binaries/manifests, - Windows bundle, and tigera-operator Helm v3 chart). + features: ['Release artifacts updated to v3.29.0 (new container images/binaries/manifests, + Windows bundle, and tigera-operator Helm v3 chart).'] breaking_changes: [] chart_version: 3.29.0 - images: - - quay.io/tigera/operator:v1.36.0 + images: ['quay.io/tigera/operator:v1.36.0'] eolAt: '2025-10-21' - version: 3.28.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release v3.28.0 is available with updated container images/binaries/manifests - and an updated tigera-operator Helm v3 chart artifact. - - Updated Calico for Windows bundle is provided for v3.28.0. - - Updated OpenShift manifest bundle (ocp.tgz) is provided for v3.28.0. + features: [Release v3.28.0 is available with updated container images/binaries/manifests + and an updated tigera-operator Helm v3 chart artifact., Updated Calico for + Windows bundle is provided for v3.28.0., Updated OpenShift manifest bundle + (ocp.tgz) is provided for v3.28.0.] breaking_changes: [] chart_version: 3.28.0 - images: - - quay.io/tigera/operator:v1.34.0 + images: ['quay.io/tigera/operator:v1.34.0'] eolAt: '2025-05-05' - version: 3.27.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes content for v3.27.0 vs v3.26.0 not provided beyond artifact - lists; cannot extract specific new features from supplied text. - breaking_changes: - - No breaking changes described in the provided excerpts; full v3.27.0 release - notes link would be needed to confirm. + features: [Release notes content for v3.27.0 vs v3.26.0 not provided beyond + artifact lists; cannot extract specific new features from supplied text.] + breaking_changes: [No breaking changes described in the provided excerpts; full + v3.27.0 release notes link would be needed to confirm.] chart_version: 3.27.0 - images: - - quay.io/tigera/operator:v1.32.3 + images: ['quay.io/tigera/operator:v1.32.3'] eolAt: '2024-10-29' - version: 3.26.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Calico v3.26.0 release available with updated artifacts (including tigera-operator-v3.26.0.tgz). + features: [Calico v3.26.0 release available with updated artifacts (including + tigera-operator-v3.26.0.tgz).] breaking_changes: [] chart_version: 3.26.0 - images: - - quay.io/tigera/operator:v1.30.0 + images: ['quay.io/tigera/operator:v1.30.0'] eolAt: '2024-05-11' - version: 3.25.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Upgrade Calico application and bundled artifacts from v3.24.1 to v3.25.0 (new - release tarball, updated Windows zip, updated tigera-operator Helm chart bundle). + features: ['Upgrade Calico application and bundled artifacts from v3.24.1 to + v3.25.0 (new release tarball, updated Windows zip, updated tigera-operator + Helm chart bundle).'] breaking_changes: [] chart_version: 3.25.0 - images: - - quay.io/tigera/operator:v1.29.0 + images: ['quay.io/tigera/operator:v1.29.0'] eolAt: '2023-12-15' - version: 3.24.1 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are high-level metadata only (assets, links) for v3.23.4 - and v3.24.1; no functional changes are included in the excerpt, so no specific - new features can be confirmed from the supplied text. - breaking_changes: - - No breaking changes are stated in the supplied release metadata; must review - the linked v3.24.x and v3.23.x release notes/changelog for actual upgrade-impacting - changes. + features: ['Release notes provided are high-level metadata only (assets, links) + for v3.23.4 and v3.24.1; no functional changes are included in the excerpt, + so no specific new features can be confirmed from the supplied text.'] + breaking_changes: [No breaking changes are stated in the supplied release metadata; + must review the linked v3.24.x and v3.23.x release notes/changelog for actual + upgrade-impacting changes.] chart_version: 3.24.1 - images: - - quay.io/tigera/operator:v1.28.1 + images: ['quay.io/tigera/operator:v1.28.1'] - version: 3.23.4 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Tigera operator Helm chart artifact updated from v3.22.5 to v3.23.4 (chart - bundle size 47KB -> 49KB); no explicit chart changelog details provided in - supplied notes. - features: - - No specific feature list provided in the supplied release note excerpts; refer - to the Calico v3.23 release notes page for details. - breaking_changes: - - No breaking changes described in the supplied excerpts; review the Calico - v3.23 release notes for any upgrade-impacting changes between 3.22 and 3.23. + chart_updates: [Tigera operator Helm chart artifact updated from v3.22.5 to + v3.23.4 (chart bundle size 47KB -> 49KB); no explicit chart changelog details + provided in supplied notes.] + features: [No specific feature list provided in the supplied release note excerpts; + refer to the Calico v3.23 release notes page for details.] + breaking_changes: [No breaking changes described in the supplied excerpts; review + the Calico v3.23 release notes for any upgrade-impacting changes between + 3.22 and 3.23.] chart_version: 3.23.4 - images: - - quay.io/tigera/operator:v1.27.14 + images: ['quay.io/tigera/operator:v1.27.14'] - version: 3.22.5 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Upgrade Calico application from v3.20.6 to v3.22.5 (includes updated container - images, binaries, and Kubernetes manifests). - - Updated bundled Tigera Operator Helm v3 chart artifact to tigera-operator-v3.22.5.tgz. - - Release includes updated calicoctl binaries across multiple platforms and - updated Windows packaging (calico-windows-v3.22.5.zip). - breaking_changes: - - Not provided in the notes shared; review the Calico v3.21 and v3.22 archived - release notes for any breaking changes impacting CNI, Felix, BGP, IPAM, or - CRDs before upgrading. + features: ['Upgrade Calico application from v3.20.6 to v3.22.5 (includes updated + container images, binaries, and Kubernetes manifests).', Updated bundled + Tigera Operator Helm v3 chart artifact to tigera-operator-v3.22.5.tgz., + Release includes updated calicoctl binaries across multiple platforms and + updated Windows packaging (calico-windows-v3.22.5.zip).] + breaking_changes: ['Not provided in the notes shared; review the Calico v3.21 + and v3.22 archived release notes for any breaking changes impacting CNI, + Felix, BGP, IPAM, or CRDs before upgrading.'] chart_version: 3.22.5 - images: - - quay.io/tigera/operator:v1.25.13 + images: ['quay.io/tigera/operator:v1.25.13'] - version: 3.20.6 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 3.20.6 - images: - - quay.io/tigera/operator:v1.20.9 + images: ['quay.io/tigera/operator:v1.20.9'] name: calico - icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png git_url: https://github.com/cert-manager/cert-manager @@ -13541,11 +11569,7 @@ addons: eolApiSlug: cert-manager versions: - version: 1.21.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' + kube: ['1.36', '1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: @@ -13579,55 +11603,43 @@ addons: \ and component `runtimeClassName` settings\n - (If using common labels)\ \ ensure `global.commonLabels` propagation fits your expectations with the\ \ new HTTP01 solver extra-labels behavior." - chart_updates: - - 'Helm chart removed the default tokenrequest Role/RoleBinding for the controller - ServiceAccount (`serviceaccounts/token: create`).' - - Controller Service metrics port name changed from `tcp-prometheus-servicemonitor` - to `http-metrics`. - - Removed Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, - and `prometheus.podmonitor.path` (schema will reject them). - - '`cert-manager-edit` aggregate ClusterRole permissions reduced for ACME Challenge/Order - resources (security hardening).' - - Gateway API configuration fields `enableGatewayAPI*` deprecated in favor of - `gatewayAPI.*` (old fields still supported). - features: - - Experimental ACME Renewal Information (ARI) support behind the `ACMEUseARI` - feature gate to honor CA-provided renewal windows. - - New `waitInsteadOfSelfCheck` option for ACME solvers to skip self-check and - wait before asking the ACME server to validate. - - Vault issuer can now use AWS IAM authentication (IRSA/EKS Pod Identity/ambient - EC2/ECS credentials) to avoid long-lived AWS secrets. - - New `renewalPolicies` field on Certificates for more expressive renewal scheduling. - - Configurable cap for CertificateRequest retry backoff via `--certificate-request-maximum-backoff-duration` - / `config.certificateRequestMaximumBackoffDuration` (default 32h). - - Gateway API improvements including HTTP01 parentRef fallback for ListenerSets - and an annotation to ignore selected TLS listeners. - - 'Cainjector improvements: `CAInjectorMerging` is GA and server-side apply - is now unconditional; new `--ignore-namespaces` flag.' - - 'Operational improvements: `runtimeClassName` support, startupapicheck TTL - cleanup, and better observability for Venafi/CyberArk OAuth auth failures.' - breaking_changes: - - Helm chart no longer creates default RBAC allowing the controller ServiceAccount - to `create` `serviceaccounts/token`; workloads relying on that undocumented - pattern must add RBAC or switch to a dedicated ServiceAccount. - - '`cert-manager-edit` aggregate ClusterRole no longer grants create/update - permissions for ACME Challenge/Order resources; any tooling that manipulates - these resources directly needs explicit RBAC.' - - Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, - and `prometheus.podmonitor.path` were removed and will cause schema validation - failure if still present; controller metrics port name is now `http-metrics`. + chart_updates: ['Helm chart removed the default tokenrequest Role/RoleBinding + for the controller ServiceAccount (`serviceaccounts/token: create`).', Controller + Service metrics port name changed from `tcp-prometheus-servicemonitor` to + `http-metrics`., 'Removed Helm values `prometheus.servicemonitor.targetPort`, + `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` (schema + will reject them).', '`cert-manager-edit` aggregate ClusterRole permissions + reduced for ACME Challenge/Order resources (security hardening).', Gateway + API configuration fields `enableGatewayAPI*` deprecated in favor of `gatewayAPI.*` + (old fields still supported).] + features: [Experimental ACME Renewal Information (ARI) support behind the `ACMEUseARI` + feature gate to honor CA-provided renewal windows., New `waitInsteadOfSelfCheck` + option for ACME solvers to skip self-check and wait before asking the ACME + server to validate., Vault issuer can now use AWS IAM authentication (IRSA/EKS + Pod Identity/ambient EC2/ECS credentials) to avoid long-lived AWS secrets., + New `renewalPolicies` field on Certificates for more expressive renewal scheduling., + Configurable cap for CertificateRequest retry backoff via `--certificate-request-maximum-backoff-duration` + / `config.certificateRequestMaximumBackoffDuration` (default 32h)., Gateway + API improvements including HTTP01 parentRef fallback for ListenerSets and + an annotation to ignore selected TLS listeners., 'Cainjector improvements: + `CAInjectorMerging` is GA and server-side apply is now unconditional; new + `--ignore-namespaces` flag.', 'Operational improvements: `runtimeClassName` + support, startupapicheck TTL cleanup, and better observability for Venafi/CyberArk + OAuth auth failures.'] + breaking_changes: [Helm chart no longer creates default RBAC allowing the controller + ServiceAccount to `create` `serviceaccounts/token`; workloads relying on + that undocumented pattern must add RBAC or switch to a dedicated ServiceAccount., + '`cert-manager-edit` aggregate ClusterRole no longer grants create/update + permissions for ACME Challenge/Order resources; any tooling that manipulates + these resources directly needs explicit RBAC.', 'Helm values `prometheus.servicemonitor.targetPort`, + `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` were + removed and will cause schema validation failure if still present; controller + metrics port name is now `http-metrics`.'] chart_version: 1.21.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.21.0 - - quay.io/jetstack/cert-manager-controller:v1.21.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.21.0 - - quay.io/jetstack/cert-manager-webhook:v1.21.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.21.0', 'quay.io/jetstack/cert-manager-controller:v1.21.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.21.0', 'quay.io/jetstack/cert-manager-webhook:v1.21.0'] - version: 1.20.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -13659,48 +11671,35 @@ addons: by the chart, note the **metrics label is now consistently `cert-manager`** (previously it could vary by namespace/release name). Update any label-selectors in Prometheus/alerts accordingly. *(#8162)*' - chart_updates: - - NetworkPolicy configurability improvements and example policy cleanup (#8370). - - '`startupapicheck-job` template now supports `imagePullSecrets` (#8186).' - - Helm chart adds `extraContainers` support for controller/operator pod sidecars - (#8355). - - Helm chart `global.nodeSelector` now merges with per-component nodeSelectors - (#8195). - - Helm chart NOTES.TXT includes Gateway API documentation (#8353). - - PodDisruptionBudget template supports `unhealthyPodEvictionPolicy` (#7728). - features: - - Alpha/experimental support for the new ListenerSet resource (feature gate - renamed from `XListenerSets` to `ListenerSets`). - - 'DNS-01: support for Azure Private DNS zones.' - - 'Gateway API + ACME: `parentRefs` are no longer required in some flows; you - can also override parentRefs via Certificate annotations.' - - OtherNames feature promoted to Beta and enabled by default. - - 'Operational flexibility improvements: configurable PEM decoding size limits, - plus the ability to run sidecars (via Helm) and set imagePullSecrets for startup - checks.' - breaking_changes: - - 'Container security context defaults changed: default UID/GID are now **65532/65532** - (was 1000/0). This can break clusters with strict PSP/OPA/Kyverno policies, - custom volume permissions, or sidecars expecting the old IDs.' - - Feature gate `DefaultPrivateKeyRotationPolicyAlways` is now **GA and cannot - be disabled**. If you previously relied on disabling it, you must remove that - configuration and validate resulting key rotation behavior. - - IssuerRef API defaults introduced in 1.19 were reverted; if you were depending - on implicit `group/kind` defaults, ensure your manifests explicitly set the - intended issuerRef fields to avoid unexpected behavior. + chart_updates: [NetworkPolicy configurability improvements and example policy + cleanup (#8370)., '`startupapicheck-job` template now supports `imagePullSecrets` + (#8186).', Helm chart adds `extraContainers` support for controller/operator + pod sidecars (#8355)., Helm chart `global.nodeSelector` now merges with + per-component nodeSelectors (#8195)., Helm chart NOTES.TXT includes Gateway + API documentation (#8353)., PodDisruptionBudget template supports `unhealthyPodEvictionPolicy` + (#7728).] + features: [Alpha/experimental support for the new ListenerSet resource (feature + gate renamed from `XListenerSets` to `ListenerSets`)., 'DNS-01: support + for Azure Private DNS zones.', 'Gateway API + ACME: `parentRefs` are no + longer required in some flows; you can also override parentRefs via Certificate + annotations.', OtherNames feature promoted to Beta and enabled by default., + 'Operational flexibility improvements: configurable PEM decoding size limits, + plus the ability to run sidecars (via Helm) and set imagePullSecrets for + startup checks.'] + breaking_changes: ['Container security context defaults changed: default UID/GID + are now **65532/65532** (was 1000/0). This can break clusters with strict + PSP/OPA/Kyverno policies, custom volume permissions, or sidecars expecting + the old IDs.', 'Feature gate `DefaultPrivateKeyRotationPolicyAlways` is + now **GA and cannot be disabled**. If you previously relied on disabling + it, you must remove that configuration and validate resulting key rotation + behavior.', 'IssuerRef API defaults introduced in 1.19 were reverted; if + you were depending on implicit `group/kind` defaults, ensure your manifests + explicitly set the intended issuerRef fields to avoid unexpected behavior.'] chart_version: 1.20.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.20.0 - - quay.io/jetstack/cert-manager-controller:v1.20.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.20.0 - - quay.io/jetstack/cert-manager-webhook:v1.20.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.20.0', 'quay.io/jetstack/cert-manager-controller:v1.20.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.20.0', 'quay.io/jetstack/cert-manager-webhook:v1.20.0'] - version: 1.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -13718,60 +11717,44 @@ addons: \ in diff.\n\n- **Helm chart quoting change (1.18.0):** nodeSelector values\ \ are quoted.\n - Mostly transparent, but can affect strict YAML/value types\ \ if you relied on non-string types.\n" - chart_updates: - - Default NetworkPolicy now includes IPv6 rules (1.19.0). - - Pods now support an experimental `hostUsers` field (not enabled by default) - (1.19.0). - - Services/ServiceMonitors switched to using **named ports** instead of numeric - ports (1.18.0). - - 'Ingress-shim: new `--extra-certificate-annotations` option to copy selected - annotations from Ingress-like resources to resulting Certificates (1.18.0).' - - 'Metrics changes: certificate metrics moved to a collector approach (1.19.0); - new `certmanager_certificate_challenge_status` metric (1.19.0); new notBefore/notAfter - timestamp metrics (1.18.0).' - - 'ACME HTTP-01: added feature gate to default solver Ingress `pathType` to - `Exact` (1.19.0); also earlier change set pathType to `Exact` for reliability/security - (1.18.0).' - features: - - Global `nodeSelector` Helm value to pin cert-manager components to specific - nodes (deployment flexibility). - - Configurable resource requests/limits for ACME HTTP-01 solver pods via Issuer/ClusterIssuer - (overrides global `--acme-http01-solver-resource-*`). - - CAInjectorMerging promoted to **BETA** and enabled by default (more robust - CA bundle injection behavior). - - 'Improved observability: version + git commit logged on startup; new certificate - challenge status metric; additional certificate issuance/expiry timestamp - metrics.' - - 'Platform/compatibility improvements: default NetworkPolicy adds IPv6 rules; - increased ACME authorization timeout to reduce flakiness.' - breaking_changes: - - "**Potential incident risk / known issue:** v1.19.0 has a known issue causing\ - \ **unexpected certificate renewal** after upgrade; it\u2019s fixed in **v1.19.1**.\ - \ Strongly prefer upgrading to 1.19.1+ if possible." - - "Monitoring breaking change: **removed the `path` label** from core ACME client\ - \ metrics\u2014dashboards/alerts that filter/group by `path` must be updated." - - "Behavioral breaking changes introduced in 1.18 (still relevant if you\u2019\ - re coming from 1.18.0): default `Certificate.spec.privateKey.rotationPolicy`\ - \ changed to **`Always`** (can trigger key rotation on renewals), and default\ - \ `Certificate.spec.revisionHistoryLimit` set to **1** (fewer historical CertificateRequest\ - \ revisions retained)." - - "Access-control/values breaking change: `global.rbac.disableHTTPChallengesRole`\ - \ was **reverted** in 1.19.0\u2014config relying on it must be removed and\ - \ you may need an alternative approach if you were using it to reduce privileges." + chart_updates: [Default NetworkPolicy now includes IPv6 rules (1.19.0)., Pods + now support an experimental `hostUsers` field (not enabled by default) (1.19.0)., + Services/ServiceMonitors switched to using **named ports** instead of numeric + ports (1.18.0)., 'Ingress-shim: new `--extra-certificate-annotations` option + to copy selected annotations from Ingress-like resources to resulting Certificates + (1.18.0).', 'Metrics changes: certificate metrics moved to a collector approach + (1.19.0); new `certmanager_certificate_challenge_status` metric (1.19.0); + new notBefore/notAfter timestamp metrics (1.18.0).', 'ACME HTTP-01: added + feature gate to default solver Ingress `pathType` to `Exact` (1.19.0); also + earlier change set pathType to `Exact` for reliability/security (1.18.0).'] + features: [Global `nodeSelector` Helm value to pin cert-manager components to + specific nodes (deployment flexibility)., Configurable resource requests/limits + for ACME HTTP-01 solver pods via Issuer/ClusterIssuer (overrides global + `--acme-http01-solver-resource-*`)., CAInjectorMerging promoted to **BETA** + and enabled by default (more robust CA bundle injection behavior)., 'Improved + observability: version + git commit logged on startup; new certificate challenge + status metric; additional certificate issuance/expiry timestamp metrics.', + 'Platform/compatibility improvements: default NetworkPolicy adds IPv6 rules; + increased ACME authorization timeout to reduce flakiness.'] + breaking_changes: ["**Potential incident risk / known issue:** v1.19.0 has a\ + \ known issue causing **unexpected certificate renewal** after upgrade;\ + \ it\u2019s fixed in **v1.19.1**. Strongly prefer upgrading to 1.19.1+ if\ + \ possible.", "Monitoring breaking change: **removed the `path` label**\ + \ from core ACME client metrics\u2014dashboards/alerts that filter/group\ + \ by `path` must be updated.", "Behavioral breaking changes introduced in\ + \ 1.18 (still relevant if you\u2019re coming from 1.18.0): default `Certificate.spec.privateKey.rotationPolicy`\ + \ changed to **`Always`** (can trigger key rotation on renewals), and default\ + \ `Certificate.spec.revisionHistoryLimit` set to **1** (fewer historical\ + \ CertificateRequest revisions retained).", "Access-control/values breaking\ + \ change: `global.rbac.disableHTTPChallengesRole` was **reverted** in 1.19.0\u2014\ + config relying on it must be removed and you may need an alternative approach\ + \ if you were using it to reduce privileges."] chart_version: 1.19.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.19.0 - - quay.io/jetstack/cert-manager-controller:v1.19.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.19.0 - - quay.io/jetstack/cert-manager-webhook:v1.19.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.19.0', 'quay.io/jetstack/cert-manager-controller:v1.19.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.19.0', 'quay.io/jetstack/cert-manager-webhook:v1.19.0'] eolAt: '2026-07-08' - version: 1.18.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -13783,59 +11766,43 @@ addons: \ `startupapicheck.extraEnv` (useful if you previously templated env vars).\n\ - **Chart templating fix:** nodeSelector values are now quoted; if you relied\ \ on unquoted numeric/bool-looking values, rendering/behavior may change slightly.\n" - chart_updates: - - RBAC can now be tightened via `global.rbac.disableHTTPChallengesRole` (drops - Pod-creation permissions when HTTP-01 is disabled). - - Service/ServiceMonitor ports are now defined using **named ports** instead - of numeric ports (may affect scraping or any tooling selecting ports by number). - - 'Ingress-shim related additions: supports copying selected annotations via - new flag `--extra-certificate-annotations`.' - - 'Helm template fixes: nodeSelector quoting; ServiceAccount annotations handling - boolean values correctly.' - features: - - 'ACME: **Support for ACME Profiles** (draft ACME profiles extension) allowing - more profile-driven issuance behavior when your ACME CA supports it.' - - 'Observability: new certificate validity metrics for NotBefore/NotAfter timestamps - (`certmanager_certificate_not_before_timestamp_seconds`, `certmanager_certificate_not_after_timestamp_seconds`).' - - 'Security hardening option: ability to disable HTTP-01 RBAC permissions via - Helm when not using HTTP-01 challenges.' - - "Vault Issuer: option to specify the expected server name when validating\ - \ Vault\u2019s presented TLS certs." - - 'Ingress-shim: can copy a configured list of annotations from Ingress-like - resources onto the generated Certificate.' - - 'Resource UX: new kubectl shortnames `iss` (Issuer) and `ciss` (ClusterIssuer).' - - 'Crypto: ability to customize the certificate signature algorithm.' - - 'Features promoted to GA: `UseDomainQualifiedFinalizer`; `AdditionalCertificateOutputFormats` - always enabled.' - breaking_changes: - - "Default `Certificate.spec.privateKey.rotationPolicy` changes from **`Never`\ - \ \u2192 `Always`**. This can trigger private key rotation on renewals/issuance\ - \ unless you explicitly set it back." - - Default `Certificate.spec.revisionHistoryLimit` effectively becomes **1** - (CertificateRequest revision history). This may surprise users relying on - multiple historical CertificateRequests for debugging/auditing. - - "Ingress HTTP-01 solver Ingress `pathType` changes from **ImplementationSpecific\ - \ \u2192 Exact**, which can change matching behavior on some ingress controllers." - - "Feature gate **`ValidateCAA` removed** (setting it becomes a no-op with a\ - \ warning); if you depended on it, behavior won\u2019t be enforced by that\ - \ gate anymore." - - 'Known issue: ingress-nginx validating webhook may reject ACME HTTP-01 challenge - paths (see cert-manager #7791); plan mitigations if you use ingress-nginx - + HTTP-01.' + chart_updates: [RBAC can now be tightened via `global.rbac.disableHTTPChallengesRole` + (drops Pod-creation permissions when HTTP-01 is disabled)., Service/ServiceMonitor + ports are now defined using **named ports** instead of numeric ports (may + affect scraping or any tooling selecting ports by number)., 'Ingress-shim + related additions: supports copying selected annotations via new flag `--extra-certificate-annotations`.', + 'Helm template fixes: nodeSelector quoting; ServiceAccount annotations handling + boolean values correctly.'] + features: ['ACME: **Support for ACME Profiles** (draft ACME profiles extension) + allowing more profile-driven issuance behavior when your ACME CA supports + it.', 'Observability: new certificate validity metrics for NotBefore/NotAfter + timestamps (`certmanager_certificate_not_before_timestamp_seconds`, `certmanager_certificate_not_after_timestamp_seconds`).', + 'Security hardening option: ability to disable HTTP-01 RBAC permissions via + Helm when not using HTTP-01 challenges.', "Vault Issuer: option to specify\ + \ the expected server name when validating Vault\u2019s presented TLS certs.", + 'Ingress-shim: can copy a configured list of annotations from Ingress-like + resources onto the generated Certificate.', 'Resource UX: new kubectl shortnames + `iss` (Issuer) and `ciss` (ClusterIssuer).', 'Crypto: ability to customize + the certificate signature algorithm.', 'Features promoted to GA: `UseDomainQualifiedFinalizer`; + `AdditionalCertificateOutputFormats` always enabled.'] + breaking_changes: ["Default `Certificate.spec.privateKey.rotationPolicy` changes\ + \ from **`Never` \u2192 `Always`**. This can trigger private key rotation\ + \ on renewals/issuance unless you explicitly set it back.", Default `Certificate.spec.revisionHistoryLimit` + effectively becomes **1** (CertificateRequest revision history). This may + surprise users relying on multiple historical CertificateRequests for debugging/auditing., + "Ingress HTTP-01 solver Ingress `pathType` changes from **ImplementationSpecific\ + \ \u2192 Exact**, which can change matching behavior on some ingress controllers.", + "Feature gate **`ValidateCAA` removed** (setting it becomes a no-op with a\ + \ warning); if you depended on it, behavior won\u2019t be enforced by that\ + \ gate anymore.", 'Known issue: ingress-nginx validating webhook may reject + ACME HTTP-01 challenge paths (see cert-manager #7791); plan mitigations + if you use ingress-nginx + HTTP-01.'] chart_version: 1.18.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.18.0 - - quay.io/jetstack/cert-manager-controller:v1.18.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.18.0 - - quay.io/jetstack/cert-manager-webhook:v1.18.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.18.0', 'quay.io/jetstack/cert-manager-controller:v1.18.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.18.0', 'quay.io/jetstack/cert-manager-webhook:v1.18.0'] eolAt: '2026-03-10' - version: 1.17.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -13854,53 +11821,36 @@ addons: \ can be added to Deployments; verify if you rely on custom SA creation.\n\ \n- **If you used `ValidateCAA` feature gate via Helm flags/env**: it is deprecated\ \ in 1.17 and will warn; plan removal before 1.18.\n" - chart_updates: - - Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` are now - **enabled by default** (promoted to Beta). Expect behavior changes without - explicitly setting flags. - - Optional new feature gate `CAInjectorMerging` available for ca-injector; enabling - changes CA bundle rotation behavior (merge vs replace). - - Some log lines are now structured; log formats may differ from 1.16. - features: - - "RSA signing compliance: CA and SelfSigned issuers select hash based on RSA\ - \ key size (3072\u2192SHA-384, 4096\u2192SHA-512)." - - Keystore passwords (JKS/PKCS#12) can be set as a literal string in the `Certificate` - resource, not only via Secret reference. - - Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` are now - enabled by default (Beta). - - New `CAInjectorMerging` feature gate to make CA bundle rotation safer by merging - new CAs instead of replacing. - - 'Helm improvements: extra env var injection for webhook/cainjector/startupapicheck - and `tpl` support for ServiceAccount annotations.' - - 'AzureDNS: new `tenantID` option for managed identity with service principals; - Venafi username/password client ID customization.' - - 'Larger trust bundles supported: increased PEM parsing capacity.' - breaking_changes: - - 'Potentially breaking cryptography change: CA/SelfSigned issuers now use stronger - hashes for larger RSA keys (3072/4096+). Verify downstream consumers support - SHA-384/SHA-512 with your chosen RSA key sizes.' - - 'Potentially breaking operational change: some previously unstructured log - messages are now structured; any tooling that greps/matches exact log strings - may break.' - - '`ValidateCAA` feature gate is deprecated and will be removed in 1.18; enabling - it now emits warnings (plan to stop using it).' + chart_updates: [Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` + are now **enabled by default** (promoted to Beta). Expect behavior changes + without explicitly setting flags., Optional new feature gate `CAInjectorMerging` + available for ca-injector; enabling changes CA bundle rotation behavior + (merge vs replace)., Some log lines are now structured; log formats may + differ from 1.16.] + features: ["RSA signing compliance: CA and SelfSigned issuers select hash based\ + \ on RSA key size (3072\u2192SHA-384, 4096\u2192SHA-512).", 'Keystore passwords + (JKS/PKCS#12) can be set as a literal string in the `Certificate` resource, + not only via Secret reference.', Feature gates `NameConstraints` and `UseDomainQualifiedFinalizer` + are now enabled by default (Beta)., New `CAInjectorMerging` feature gate + to make CA bundle rotation safer by merging new CAs instead of replacing., + 'Helm improvements: extra env var injection for webhook/cainjector/startupapicheck + and `tpl` support for ServiceAccount annotations.', 'AzureDNS: new `tenantID` + option for managed identity with service principals; Venafi username/password + client ID customization.', 'Larger trust bundles supported: increased PEM + parsing capacity.'] + breaking_changes: ['Potentially breaking cryptography change: CA/SelfSigned + issuers now use stronger hashes for larger RSA keys (3072/4096+). Verify + downstream consumers support SHA-384/SHA-512 with your chosen RSA key sizes.', + 'Potentially breaking operational change: some previously unstructured log + messages are now structured; any tooling that greps/matches exact log strings + may break.', '`ValidateCAA` feature gate is deprecated and will be removed + in 1.18; enabling it now emits warnings (plan to stop using it).'] chart_version: 1.17.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.17.0 - - quay.io/jetstack/cert-manager-controller:v1.17.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.17.0 - - quay.io/jetstack/cert-manager-webhook:v1.17.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.17.0', 'quay.io/jetstack/cert-manager-controller:v1.17.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.17.0', 'quay.io/jetstack/cert-manager-webhook:v1.17.0'] eolAt: '2025-10-07' - version: 1.16.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -13921,55 +11871,37 @@ addons: \ in 1.15 but matter for upgrades**:\n - `disableAutoApproval`, `approveSignerNames`\n\ \ - `extraObjects` (install extra manifests with the release)\n - optional\ \ `hostAliases` support for cert-manager pod DNS self-check scenarios" - chart_updates: - - Helm chart adds a JSON schema for values (1.16), making `helm install/upgrade` - stricter and more likely to fail on invalid/unknown values. - - Helm chart now supports adding extra environment variables to webhook/cainjector/startupapicheck - pods via new `*.extraEnv` values (1.16). - - 'Chart behavior around CRDs changed (1.15): CRDs are no longer removed on - uninstall by default; `crds.enabled`/`crds.keep` replace `installCRDs`.' - - startupapicheck image repository reference changed (1.15) to `quay.io/jetstack/cert-manager-startupapicheck`. - features: - - 'More Prometheus metrics: new metrics servers for webhook and cainjector; - controller now exposes process and Go runtime metrics.' - - Certificate renewal can now be expressed as `renewBeforePercentage` as an - alternative to `renewBefore`. - - Gateway API HTTP01 solver now supports a user-provided Pod template, similar - to the Ingress HTTP01 solver. - - 'Route53 ACME DNS01 improvements: better region handling (ambient/IRSA), regional - STS endpoints, and improved debug logging/user-agent tagging for AWS requests.' - - 'Vault and Venafi improvements: Vault supports client certificate auth; Venafi - adds SecretRef for CA bundle and improved duration handling; TPP OAuth with - username/password support.' - breaking_changes: - - Helm schema validation in 1.16 may reject existing values files that contain - unknown keys/typos; you may need to clean up `values.yaml` before upgrading. - - Venafi Issuer behavior changes in 1.16 can break renewals if requested durations - violate Venafi policy min/max, or if using TPP username/password auth in certain - configurations. - - 'Venafi TPP: API Key authentication (deprecated/removed in recent TPP versions) - is no longer used; environments relying on it must migrate to supported auth - methods.' - - Old cert-manager API versions were removed from the codebase (v1alpha2/v1alpha3/v1beta1 - for acme.cert-manager.io and cert-manager.io); ensure no manifests/CRs still - use those versions. + chart_updates: ['Helm chart adds a JSON schema for values (1.16), making `helm + install/upgrade` stricter and more likely to fail on invalid/unknown values.', + Helm chart now supports adding extra environment variables to webhook/cainjector/startupapicheck + pods via new `*.extraEnv` values (1.16)., 'Chart behavior around CRDs changed + (1.15): CRDs are no longer removed on uninstall by default; `crds.enabled`/`crds.keep` + replace `installCRDs`.', startupapicheck image repository reference changed + (1.15) to `quay.io/jetstack/cert-manager-startupapicheck`.] + features: ['More Prometheus metrics: new metrics servers for webhook and cainjector; + controller now exposes process and Go runtime metrics.', Certificate renewal + can now be expressed as `renewBeforePercentage` as an alternative to `renewBefore`., + 'Gateway API HTTP01 solver now supports a user-provided Pod template, similar + to the Ingress HTTP01 solver.', 'Route53 ACME DNS01 improvements: better + region handling (ambient/IRSA), regional STS endpoints, and improved debug + logging/user-agent tagging for AWS requests.', 'Vault and Venafi improvements: + Vault supports client certificate auth; Venafi adds SecretRef for CA bundle + and improved duration handling; TPP OAuth with username/password support.'] + breaking_changes: [Helm schema validation in 1.16 may reject existing values + files that contain unknown keys/typos; you may need to clean up `values.yaml` + before upgrading., 'Venafi Issuer behavior changes in 1.16 can break renewals + if requested durations violate Venafi policy min/max, or if using TPP username/password + auth in certain configurations.', 'Venafi TPP: API Key authentication (deprecated/removed + in recent TPP versions) is no longer used; environments relying on it must + migrate to supported auth methods.', Old cert-manager API versions were + removed from the codebase (v1alpha2/v1alpha3/v1beta1 for acme.cert-manager.io + and cert-manager.io); ensure no manifests/CRs still use those versions.] chart_version: 1.16.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.16.0 - - quay.io/jetstack/cert-manager-controller:v1.16.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.16.0 - - quay.io/jetstack/cert-manager-webhook:v1.16.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.16.0', 'quay.io/jetstack/cert-manager-controller:v1.16.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.16.0', 'quay.io/jetstack/cert-manager-webhook:v1.16.0'] eolAt: '2025-06-10' - version: 1.15.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -13987,57 +11919,41 @@ addons: \ for the cert-manager Pod (to help DNS01 self-check in custom DNS scenarios).\n\ \ - New chart options: `disableAutoApproval` and `approveSignerNames` (controls\ \ auto-approval behavior for CertificateRequests / signers).\n" - chart_updates: - - CRDs are now retained by default on Helm uninstall to prevent accidental data - loss; introduced `crds.keep`/`crds.enabled` to manage this behavior. - - Helm chart adds `extraObjects` to let you ship additional manifests with the - release. - - Helm chart supports optional `hostAliases` on the cert-manager Pod. - - 'Fixed/adjusted Helm behaviors noted in release notes: logic distinguishing - `0` vs empty values; restored default Prometheus Service resource behavior; - corrected cainjector image value; ensured cainjector ConfigMap mounts correctly.' - - Added Helm options `disableAutoApproval` and `approveSignerNames`. - - 'Operational note: `cmctl` and `kubectl cert-manager` moved to the separate - `cert-manager/cmctl` repo and are versioned independently (affects where you - fetch the binary, not the Helm chart directly).' - features: - - Gateway API integration is now Beta; enable it with `--enable-gateway-api` - (was previously experimental). - - '`LiteralCertificateSubject` and `AdditionalCertificateOutputFormats` feature - gates are now Beta; additional output formats are enabled by default.' - - Helm can now install extra Kubernetes objects via `extraObjects`, and can - set `hostAliases` to help DNS self-checks in custom environments. - - 'Vault integration enhancements: mTLS support when Vault requires strict client - certs, plus ability to configure additional Kubernetes auth audiences.' - - AWS Route53 provider supports AssumeRoleWithWebIdentity for credential retrieval; - JKS keystore can now set a custom key alias. - breaking_changes: - - '**CRD lifecycle change on uninstall**: Helm uninstall will no longer remove - cert-manager CRDs by default; adjust your uninstall/runbook (set `crds.keep=false` - only if you explicitly want CRDs deleted).' - - '**ACME `preferredChain` behavior fix**: if you relied on the previously unintended - chain selection when `preferredChain` is set, certificate chain selection - may change after upgrading (now uses the intended chain).' - - 'Tooling packaging change: `cmctl` moved to a separate repository and is versioned - independently; update any automation that downloads `cmctl` from the main - cert-manager release assets.' + chart_updates: [CRDs are now retained by default on Helm uninstall to prevent + accidental data loss; introduced `crds.keep`/`crds.enabled` to manage this + behavior., Helm chart adds `extraObjects` to let you ship additional manifests + with the release., Helm chart supports optional `hostAliases` on the cert-manager + Pod., 'Fixed/adjusted Helm behaviors noted in release notes: logic distinguishing + `0` vs empty values; restored default Prometheus Service resource behavior; + corrected cainjector image value; ensured cainjector ConfigMap mounts correctly.', + Added Helm options `disableAutoApproval` and `approveSignerNames`., 'Operational + note: `cmctl` and `kubectl cert-manager` moved to the separate `cert-manager/cmctl` + repo and are versioned independently (affects where you fetch the binary, + not the Helm chart directly).'] + features: [Gateway API integration is now Beta; enable it with `--enable-gateway-api` + (was previously experimental)., '`LiteralCertificateSubject` and `AdditionalCertificateOutputFormats` + feature gates are now Beta; additional output formats are enabled by default.', + 'Helm can now install extra Kubernetes objects via `extraObjects`, and can + set `hostAliases` to help DNS self-checks in custom environments.', 'Vault + integration enhancements: mTLS support when Vault requires strict client + certs, plus ability to configure additional Kubernetes auth audiences.', + AWS Route53 provider supports AssumeRoleWithWebIdentity for credential retrieval; + JKS keystore can now set a custom key alias.] + breaking_changes: ['**CRD lifecycle change on uninstall**: Helm uninstall will + no longer remove cert-manager CRDs by default; adjust your uninstall/runbook + (set `crds.keep=false` only if you explicitly want CRDs deleted).', '**ACME + `preferredChain` behavior fix**: if you relied on the previously unintended + chain selection when `preferredChain` is set, certificate chain selection + may change after upgrading (now uses the intended chain).', 'Tooling packaging + change: `cmctl` moved to a separate repository and is versioned independently; + update any automation that downloads `cmctl` from the main cert-manager + release assets.'] chart_version: 1.15.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.15.0 - - quay.io/jetstack/cert-manager-controller:v1.15.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.15.0 - - quay.io/jetstack/cert-manager-webhook:v1.15.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.15.0', 'quay.io/jetstack/cert-manager-controller:v1.15.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.15.0', 'quay.io/jetstack/cert-manager-webhook:v1.15.0'] eolAt: '2025-02-03' - version: 1.14.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -14059,56 +11975,39 @@ addons: \ chart was manually corrected during release due to a wrong `cainjector`\ \ image reference; upstream recommends installing **>= 1.14.2** instead of\ \ 1.14.0/1.14.1." - chart_updates: - - 'Security hardening defaults: pods now run with `readOnlyRootFilesystem: true` - by default (including the ACME HTTP01 solver pod).' - - Controller liveness probe enabled by default; additional clock-skew detector - liveness probe added. - - Webhook timeout default increased to 30s (max) to improve error visibility. - - Webhook can be restricted via custom `spec.namespaceSelector` support. - - Metrics endpoint can now be served over TLS (static cert files or dynamically - issued certs). - - 'ACME HTTP01 solver pods gain a default `cluster-autoscaler.kubernetes.io/safe-to-evict: - "true"` annotation (overridable in podTemplate).' - features: - - 'X.509: Certificate spec can now include certain `otherName` SANs (alpha; - requires enabling `OtherName` feature gate on controller and webhook).' - - 'CA Issuer: support for Name Constraints in CA certs and Authority Information - Accessors (AIA) URLs for issued certificates.' - - 'Security: more secure HTTP server defaults (DoS mitigations), optional HTTPS - metrics, and read-only root filesystem by default for pods.' - - 'Operational: controller liveness probe enabled by default plus clock-skew - restart detection; configurable dynamic serving leaf certificate duration.' - - 'PKCS#12: new `.spec.keystores.pkcs12.algorithms` to control encryption/MAC - algorithms.' - breaking_changes: - - If you set Helm `.Values.featureGates`, those gates no longer get passed to - the webhook (controller only). Use `.Values.webhook.featureGates` for webhook - gates. - - '`startupapicheck` job now uses a new `startupapicheck` image instead of `ctl`; - environments that mirror/preload images must include it.' - - 'Potential compatibility change: KeyUsage and BasicConstraints are now encoded - as **critical** in the CSR blob inside CertificateRequests; any downstream - tooling expecting non-critical encoding may be affected.' - - 'Webhook validation is stricter (from 1.13): CertificateRequest KeyUsages/ExtendedKeyUsages - must be explicitly declared on the resource and must not be exceeded by the - CSR contents.' + chart_updates: ['Security hardening defaults: pods now run with `readOnlyRootFilesystem: + true` by default (including the ACME HTTP01 solver pod).', Controller liveness + probe enabled by default; additional clock-skew detector liveness probe + added., Webhook timeout default increased to 30s (max) to improve error + visibility., Webhook can be restricted via custom `spec.namespaceSelector` + support., Metrics endpoint can now be served over TLS (static cert files + or dynamically issued certs)., 'ACME HTTP01 solver pods gain a default `cluster-autoscaler.kubernetes.io/safe-to-evict: + "true"` annotation (overridable in podTemplate).'] + features: ['X.509: Certificate spec can now include certain `otherName` SANs + (alpha; requires enabling `OtherName` feature gate on controller and webhook).', + 'CA Issuer: support for Name Constraints in CA certs and Authority Information + Accessors (AIA) URLs for issued certificates.', 'Security: more secure HTTP + server defaults (DoS mitigations), optional HTTPS metrics, and read-only + root filesystem by default for pods.', 'Operational: controller liveness + probe enabled by default plus clock-skew restart detection; configurable + dynamic serving leaf certificate duration.', 'PKCS#12: new `.spec.keystores.pkcs12.algorithms` + to control encryption/MAC algorithms.'] + breaking_changes: ['If you set Helm `.Values.featureGates`, those gates no longer + get passed to the webhook (controller only). Use `.Values.webhook.featureGates` + for webhook gates.', '`startupapicheck` job now uses a new `startupapicheck` + image instead of `ctl`; environments that mirror/preload images must include + it.', 'Potential compatibility change: KeyUsage and BasicConstraints are + now encoded as **critical** in the CSR blob inside CertificateRequests; + any downstream tooling expecting non-critical encoding may be affected.', + 'Webhook validation is stricter (from 1.13): CertificateRequest KeyUsages/ExtendedKeyUsages + must be explicitly declared on the resource and must not be exceeded by + the CSR contents.'] chart_version: 1.14.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.14.0 - - quay.io/jetstack/cert-manager-controller:v1.14.0 - - quay.io/jetstack/cert-manager-startupapicheck:v1.14.0 - - quay.io/jetstack/cert-manager-webhook:v1.14.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.14.0', 'quay.io/jetstack/cert-manager-controller:v1.14.0', + 'quay.io/jetstack/cert-manager-startupapicheck:v1.14.0', 'quay.io/jetstack/cert-manager-webhook:v1.14.0'] eolAt: '2024-10-03' - version: 1.13.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -14127,62 +12026,43 @@ addons: \ If coming from **< v1.12**, upgrade to the **latest v1.12 patch** first\ \ before moving to v1.13, to avoid unexpected certificate re-issuance (release\ \ note #6494 comment)." - chart_updates: - - 'Webhook helm template behavior changed so controller feature gates are no - longer inadvertently applied to the webhook (fix in #6093).' - - 'NetworkPolicy templating fix: corrected indentation for webhook `matchLabels` - (#6220).' - - Adds configurability / defaults around `enableServiceLinks` for deployments - and `startupapicheck` job (#6292, plus follow-up changes disabling service - links more broadly). - - Adds ServiceMonitor endpoint extension point via `prometheus.servicemonitor.endpointAdditionalProperties` - (#6110). - - Adds Apache 2.0 license annotation in chart metadata (#6225). - features: - - "DNS-over-HTTPS (DoH) support for ACME DNS-01 self-checks (use `--dns01-recursive-nameservers-only=true`\ - \ with an `https://\u2026/dns-query` endpoint)." - - Controller options can now be provided via a versioned configuration file - (useful for managing controller settings declaratively). - - Feature gates **StableCertificateRequestName** and **SecretsFilteredCaching** - promoted to **Beta** and enabled by default (note known issue for StableCertificateRequestName - in 1.13.0, fixed in 1.13.1+). - - CertificateRequest / CSR validation tightened when using pki CertificateTemplate - functions to ensure signed certs match requested usages and CA-ness. - - 'Helm: can add extra properties to Prometheus ServiceMonitor endpoints; `enableServiceLinks` - can be configured across deployments; logging options can be set via webhook - config file.' - breaking_changes: - - "**Helm breaking change:** `.featureGates` no longer applies to the webhook;\ - \ use `webhook.featureGates` instead. If you relied on controller gates being\ - \ passed through to the webhook\u2019s `--feature-gates`, that will now fail\ - \ unless the webhook actually supports those gates." - - '**Potentially breaking:** webhook validation of CertificateRequest is stricter: - all `keyUsages`/`extendedKeyUsages` must be explicitly declared on the CertificateRequest, - and the CSR must not contain additional usages beyond those declared.' - - '**Known issue in 1.13.0:** StableCertificateRequestName (now Beta, enabled - by default) has a name-collision bug; upgrade to **v1.13.1+** to avoid it.' - - 'Upgrade path warning: if upgrading from <1.12, you must first upgrade to - latest 1.12 patch before 1.13 or some certs may be unexpectedly re-issued.' + chart_updates: ['Webhook helm template behavior changed so controller feature + gates are no longer inadvertently applied to the webhook (fix in #6093).', + 'NetworkPolicy templating fix: corrected indentation for webhook `matchLabels` + (#6220).', 'Adds configurability / defaults around `enableServiceLinks` + for deployments and `startupapicheck` job (#6292, plus follow-up changes + disabling service links more broadly).', Adds ServiceMonitor endpoint extension + point via `prometheus.servicemonitor.endpointAdditionalProperties` (#6110)., + Adds Apache 2.0 license annotation in chart metadata (#6225).] + features: ["DNS-over-HTTPS (DoH) support for ACME DNS-01 self-checks (use `--dns01-recursive-nameservers-only=true`\ + \ with an `https://\u2026/dns-query` endpoint).", Controller options can + now be provided via a versioned configuration file (useful for managing + controller settings declaratively)., 'Feature gates **StableCertificateRequestName** + and **SecretsFilteredCaching** promoted to **Beta** and enabled by default + (note known issue for StableCertificateRequestName in 1.13.0, fixed in 1.13.1+).', + CertificateRequest / CSR validation tightened when using pki CertificateTemplate + functions to ensure signed certs match requested usages and CA-ness., 'Helm: + can add extra properties to Prometheus ServiceMonitor endpoints; `enableServiceLinks` + can be configured across deployments; logging options can be set via webhook + config file.'] + breaking_changes: ["**Helm breaking change:** `.featureGates` no longer applies\ + \ to the webhook; use `webhook.featureGates` instead. If you relied on controller\ + \ gates being passed through to the webhook\u2019s `--feature-gates`, that\ + \ will now fail unless the webhook actually supports those gates.", '**Potentially + breaking:** webhook validation of CertificateRequest is stricter: all `keyUsages`/`extendedKeyUsages` + must be explicitly declared on the CertificateRequest, and the CSR must + not contain additional usages beyond those declared.', '**Known issue in + 1.13.0:** StableCertificateRequestName (now Beta, enabled by default) has + a name-collision bug; upgrade to **v1.13.1+** to avoid it.', 'Upgrade path + warning: if upgrading from <1.12, you must first upgrade to latest 1.12 + patch before 1.13 or some certs may be unexpectedly re-issued.'] chart_version: 1.13.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.13.0 - - quay.io/jetstack/cert-manager-controller:v1.13.0 - - quay.io/jetstack/cert-manager-ctl:v1.13.0 - - quay.io/jetstack/cert-manager-webhook:v1.13.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.13.0', 'quay.io/jetstack/cert-manager-controller:v1.13.0', + 'quay.io/jetstack/cert-manager-ctl:v1.13.0', 'quay.io/jetstack/cert-manager-webhook:v1.13.0'] eolAt: '2024-06-05' - version: 1.12.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22'] requirements: [] incompatibilities: [] summary: @@ -14205,56 +12085,39 @@ addons: - ACME HTTP-01 solver can now be configured with `ingressClassName`; if you\ \ previously relied on the deprecated ingress.class annotation behavior, consider\ \ moving to the field.\n" - chart_updates: - - Added optional PodDisruptionBudgets for cert-manager components (off by default). - - Webhook NetworkPolicy updated to permit egress to Kubernetes API on 6443/TCP - (OpenShift/OKD compatibility). - - Helm chart now supports adding extra volumes and volumeMounts to cainjector/webhook/startupapicheck - pods via values. - - Helm chart exposes additional controller flags for DNS01 recursion and certificate - owner refs. - - Chart behavior updated so `--acme-http01-solver-image` in `acmesolver.extraArgs` - overrides `acmesolver.image`. - - 'Chart documentation: fixed dead links in values.yaml.' - features: - - JSON logging is now supported via `--logging-format=json` (handy for log aggregation/parsing). - - New `--concurrent-workers` flag lets you tune controller concurrency per controller. - - HTTP-01 solver can now set `ingressClassName` on created Ingresses, improving - compatibility with clusters that require it. - - Vault issuer supports ephemeral Kubernetes service account tokens via `serviceAccountRef` - (short-lived auth to Vault). - - Significant memory footprint reductions (controller and cainjector) through - filtered/metadata-only caching and other optimizations. - - cainjector now has flags to disable unneeded injectable kinds to reduce memory - usage. - breaking_changes: - - Gateway API integration (introduced in 1.11) moved to a more stable API; if - you use the experimental Gateway API support, ensure the required Gateway - API version is installed (1.11 notes). - - 'cainjector behavior change: if the `certificates.cert-manager.io` CRD is - not installed and you relied on cainjector running anyway, you now must pass - `--watch-certificates=false` or cainjector will not start.' - - ACME Challenge naming calculation changed; to avoid duplicate issuances, ensure - there is **no in-progress ACME issuance** during the upgrade. - - 'POTENTIALLY BREAKING for Go consumers only: cert-manager binaries/tests were - split into separate Go modules; code changes may be required if you import - these modules.' + chart_updates: [Added optional PodDisruptionBudgets for cert-manager components + (off by default)., Webhook NetworkPolicy updated to permit egress to Kubernetes + API on 6443/TCP (OpenShift/OKD compatibility)., Helm chart now supports + adding extra volumes and volumeMounts to cainjector/webhook/startupapicheck + pods via values., Helm chart exposes additional controller flags for DNS01 + recursion and certificate owner refs., Chart behavior updated so `--acme-http01-solver-image` + in `acmesolver.extraArgs` overrides `acmesolver.image`., 'Chart documentation: + fixed dead links in values.yaml.'] + features: [JSON logging is now supported via `--logging-format=json` (handy + for log aggregation/parsing)., New `--concurrent-workers` flag lets you + tune controller concurrency per controller., 'HTTP-01 solver can now set + `ingressClassName` on created Ingresses, improving compatibility with clusters + that require it.', Vault issuer supports ephemeral Kubernetes service account + tokens via `serviceAccountRef` (short-lived auth to Vault)., Significant + memory footprint reductions (controller and cainjector) through filtered/metadata-only + caching and other optimizations., cainjector now has flags to disable unneeded + injectable kinds to reduce memory usage.] + breaking_changes: ['Gateway API integration (introduced in 1.11) moved to a + more stable API; if you use the experimental Gateway API support, ensure + the required Gateway API version is installed (1.11 notes).', 'cainjector + behavior change: if the `certificates.cert-manager.io` CRD is not installed + and you relied on cainjector running anyway, you now must pass `--watch-certificates=false` + or cainjector will not start.', 'ACME Challenge naming calculation changed; + to avoid duplicate issuances, ensure there is **no in-progress ACME issuance** + during the upgrade.', 'POTENTIALLY BREAKING for Go consumers only: cert-manager + binaries/tests were split into separate Go modules; code changes may be + required if you import these modules.'] chart_version: 1.12.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.12.0 - - quay.io/jetstack/cert-manager-controller:v1.12.0 - - quay.io/jetstack/cert-manager-ctl:v1.12.0 - - quay.io/jetstack/cert-manager-webhook:v1.12.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.12.0', 'quay.io/jetstack/cert-manager-controller:v1.12.0', + 'quay.io/jetstack/cert-manager-ctl:v1.12.0', 'quay.io/jetstack/cert-manager-webhook:v1.12.0'] eolAt: '2025-05-19' - version: 1.11.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -14280,47 +12143,33 @@ addons: to watch only the cert-manager namespace. ' - chart_updates: - - 'Reduced runtime memory usage (notably: controller secret caching fixed; cainjector - namespace scoping works).' - - Gateway API integration moved to **v1beta1** for the experimental feature; - requires Gateway API v1beta1 CRDs installed if you use it. - - Security and dependency updates (Go minor bumps; `golang/x/net` and `x/text` - vulns fixed). - - Improved AzureDNS integration (Workload Identity support + a fix for misconfigured - WI setups). - - 'Venafi issuer improvements: vcert bumped; renewal and Ed25519 issues fixed; - TLS renegotiation support for certain TPP setups.' - - Certificate secrets will refresh when keystore format changes; secrets get - an additional label for troubleshooting/ownership. - features: - - Significant reduction in runtime memory usage (fixing duplicate Secret caching - and enabling cainjector namespace scoping). - - Helm chart can now configure the ACME HTTP-01 solver image and expose `--max-concurrent-challenges` - for tuning challenge throughput. - - AzureDNS solver gains Workload Identity support, improving AKS/Azure integrations. - - Issuers can specify a custom CA bundle when connecting to an ACME server. - - Experimental Gateway API integration now targets the more stable v1beta1 API. - breaking_changes: - - "**Gateway API breaking change (experimental):** cert-manager\u2019s `ExperimentalGatewayAPISupport`\ - \ now uses **Gateway API v1beta1**. Clusters must have v1beta1 Gateway API\ - \ CRDs installed; v1alpha2-only installs will break." + chart_updates: ['Reduced runtime memory usage (notably: controller secret caching + fixed; cainjector namespace scoping works).', Gateway API integration moved + to **v1beta1** for the experimental feature; requires Gateway API v1beta1 + CRDs installed if you use it., Security and dependency updates (Go minor + bumps; `golang/x/net` and `x/text` vulns fixed)., Improved AzureDNS integration + (Workload Identity support + a fix for misconfigured WI setups)., 'Venafi + issuer improvements: vcert bumped; renewal and Ed25519 issues fixed; TLS + renegotiation support for certain TPP setups.', Certificate secrets will + refresh when keystore format changes; secrets get an additional label for + troubleshooting/ownership.] + features: [Significant reduction in runtime memory usage (fixing duplicate Secret + caching and enabling cainjector namespace scoping)., Helm chart can now + configure the ACME HTTP-01 solver image and expose `--max-concurrent-challenges` + for tuning challenge throughput., 'AzureDNS solver gains Workload Identity + support, improving AKS/Azure integrations.', Issuers can specify a custom + CA bundle when connecting to an ACME server., Experimental Gateway API integration + now targets the more stable v1beta1 API.] + breaking_changes: ["**Gateway API breaking change (experimental):** cert-manager\u2019\ + s `ExperimentalGatewayAPISupport` now uses **Gateway API v1beta1**. Clusters\ + \ must have v1beta1 Gateway API CRDs installed; v1alpha2-only installs will\ + \ break."] chart_version: 1.11.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.11.0 - - quay.io/jetstack/cert-manager-controller:v1.11.0 - - quay.io/jetstack/cert-manager-ctl:v1.11.0 - - quay.io/jetstack/cert-manager-webhook:v1.11.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.11.0', 'quay.io/jetstack/cert-manager-controller:v1.11.0', + 'quay.io/jetstack/cert-manager-ctl:v1.11.0', 'quay.io/jetstack/cert-manager-webhook:v1.11.0'] eolAt: '2023-09-12' - version: 1.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: @@ -14340,49 +12189,35 @@ addons: \ you previously relied on older behavior, validate resources render into\ \ the intended namespace.\n\n*(From 1.9: note that `securityContext.enabled`\ \ was removed earlier; ensure you are not still setting it in values.)*" - chart_updates: - - Add NetworkPolicy support in the Helm chart. - - Add `commonLabels` to apply consistent labels across chart resources. - - Add support for ServiceMonitor annotations in the chart. - - Avoid hard-coding release namespace in chart templates. - - Rename containers in Pods to unique, role-reflecting names (breaking for scripts/CI). - - Set Pod seccomp profile to `RuntimeDefault` to improve PSS/restricted compliance - (may require OpenShift SCC changes). - features: - - Certificate metrics now include `issuer_name`, `issuer_kind`, and `issuer_group` - labels for better attribution in monitoring. - - Vault Issuer supports `caBundleSecretRef` (mutually exclusive with inline - `caBundle`) to source CA bundle from a Secret. - - Gateway API dependency bumped to v0.5.0 (relevant if you use Gateway-related - integrations). - - New (disabled-by-default) feature gate `StableCertificateRequestName` to generate - deterministic CertificateRequest names and reduce "multiple CertificateRequests - found" errors. - - 'Improved SelfSigned issuance behavior: CertificateRequests/CSRs will re-reconcile - when referenced private key Secrets appear or become valid.' - - 'Chart-level quality-of-life: ability to set global `commonLabels`, plus optional - NetworkPolicy resources.' - breaking_changes: - - '**Container name changes in cert-manager Pods** (Helm/static manifests): - update any automation/monitoring that references container names (e.g., `kubectl - logs -c cert-manager ...`, Prometheus scrape relabeling, log collection configs).' - - '**OpenShift SCC compatibility risk**: new `seccompProfile: RuntimeDefault` - may cause Pods to be rejected until SCCs are adjusted/approved for the service - accounts.' + chart_updates: [Add NetworkPolicy support in the Helm chart., Add `commonLabels` + to apply consistent labels across chart resources., Add support for ServiceMonitor + annotations in the chart., Avoid hard-coding release namespace in chart + templates., 'Rename containers in Pods to unique, role-reflecting names + (breaking for scripts/CI).', Set Pod seccomp profile to `RuntimeDefault` + to improve PSS/restricted compliance (may require OpenShift SCC changes).] + features: ['Certificate metrics now include `issuer_name`, `issuer_kind`, and + `issuer_group` labels for better attribution in monitoring.', Vault Issuer + supports `caBundleSecretRef` (mutually exclusive with inline `caBundle`) + to source CA bundle from a Secret., Gateway API dependency bumped to v0.5.0 + (relevant if you use Gateway-related integrations)., New (disabled-by-default) + feature gate `StableCertificateRequestName` to generate deterministic CertificateRequest + names and reduce "multiple CertificateRequests found" errors., 'Improved + SelfSigned issuance behavior: CertificateRequests/CSRs will re-reconcile + when referenced private key Secrets appear or become valid.', 'Chart-level + quality-of-life: ability to set global `commonLabels`, plus optional NetworkPolicy + resources.'] + breaking_changes: ['**Container name changes in cert-manager Pods** (Helm/static + manifests): update any automation/monitoring that references container names + (e.g., `kubectl logs -c cert-manager ...`, Prometheus scrape relabeling, + log collection configs).', '**OpenShift SCC compatibility risk**: new `seccompProfile: + RuntimeDefault` may cause Pods to be rejected until SCCs are adjusted/approved + for the service accounts.'] chart_version: 1.10.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.10.0 - - quay.io/jetstack/cert-manager-controller:v1.10.0 - - quay.io/jetstack/cert-manager-ctl:v1.10.0 - - quay.io/jetstack/cert-manager-webhook:v1.10.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.10.0', 'quay.io/jetstack/cert-manager-controller:v1.10.0', + 'quay.io/jetstack/cert-manager-ctl:v1.10.0', 'quay.io/jetstack/cert-manager-webhook:v1.10.0'] eolAt: '2023-05-19' - version: 1.9.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: @@ -14399,42 +12234,30 @@ addons: \ **Chart scheduling fix:** `startupapicheck` is now scheduled only on **Linux**\ \ nodes by default; ensure this matches your cluster node OS mix and any custom\ \ node selectors/tolerations.\n" - chart_updates: - - Adds `namespace` override for resource creation (supports subchart use). - - Option to disable auto-mounting service account tokens. - - Removes deprecated `securityContext.enabled` chart value. - - startupapicheck job scheduling constrained to Linux nodes. - features: - - 'Alpha: `Certificate.spec.literalSubject` to preserve ordered X.509 subject - RDN sequence (requires `--feature-gates=LiteralCertificateSubject=true` on - controller and webhook; mutually exclusive with `spec.subject`/`spec.commonName`).' - - 'ingress-shim: configure `Certificate.spec.privateKey` and `Certificate.spec.revisionHistoryLimit` - via Ingress annotations (enables rotationPolicy best practices like `Always`).' - - 'AWS credentials: can load both access key ID and secret access key from Kubernetes - Secrets for AWS-based integrations/solvers.' - - 'Observability: new (alpha) Prometheus summary metric for Venafi API request - latency.' - breaking_changes: - - 'ingress-shim: **drops support for `networking.k8s.io/v1beta1` Ingress**. - Clusters/manifests must use `networking.k8s.io/v1` (Kubernetes 1.22+).' - - "Helm chart: `securityContext.enabled` value removed\u2014must be deleted\ - \ from your values and replaced with explicit securityContext fields if needed." - - 'Feature-gated field: using `spec.literalSubject` requires enabling the feature - gate on both controller and webhook; otherwise applies/updates will fail validation.' + chart_updates: [Adds `namespace` override for resource creation (supports subchart + use)., Option to disable auto-mounting service account tokens., Removes + deprecated `securityContext.enabled` chart value., startupapicheck job scheduling + constrained to Linux nodes.] + features: ['Alpha: `Certificate.spec.literalSubject` to preserve ordered X.509 + subject RDN sequence (requires `--feature-gates=LiteralCertificateSubject=true` + on controller and webhook; mutually exclusive with `spec.subject`/`spec.commonName`).', + 'ingress-shim: configure `Certificate.spec.privateKey` and `Certificate.spec.revisionHistoryLimit` + via Ingress annotations (enables rotationPolicy best practices like `Always`).', + 'AWS credentials: can load both access key ID and secret access key from Kubernetes + Secrets for AWS-based integrations/solvers.', 'Observability: new (alpha) + Prometheus summary metric for Venafi API request latency.'] + breaking_changes: ['ingress-shim: **drops support for `networking.k8s.io/v1beta1` + Ingress**. Clusters/manifests must use `networking.k8s.io/v1` (Kubernetes + 1.22+).', "Helm chart: `securityContext.enabled` value removed\u2014must\ + \ be deleted from your values and replaced with explicit securityContext\ + \ fields if needed.", 'Feature-gated field: using `spec.literalSubject` + requires enabling the feature gate on both controller and webhook; otherwise + applies/updates will fail validation.'] chart_version: 1.9.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.9.0 - - quay.io/jetstack/cert-manager-controller:v1.9.0 - - quay.io/jetstack/cert-manager-ctl:v1.9.0 - - quay.io/jetstack/cert-manager-webhook:v1.9.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.9.0', 'quay.io/jetstack/cert-manager-controller:v1.9.0', + 'quay.io/jetstack/cert-manager-ctl:v1.9.0', 'quay.io/jetstack/cert-manager-webhook:v1.9.0'] - version: 1.8.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -14451,53 +12274,38 @@ addons: \ **alpha `additionalOutputFormats`**, you must enable the feature gate on\ \ **both** controller and webhook in v1.8 (`--feature-gates=AdditionalCertificateOutputFormats=true`),\ \ not only controller. (v1.8)\n" - chart_updates: - - 'Default nodeSelector changed to linux (`kubernetes.io/os: linux`).' - - New values to add labels to ServiceAccounts across components. - - 'Chart sets `allowPrivilegeEscalation: false` by default for core pods and - startupapicheck job.' - features: - - Alpha server-side-apply support behind `ServerSideApply=true` feature gate - on Kubernetes 1.22+, reducing optimistic-locking conflicts and log noise. - - "Exponential backoff for failed certificate issuances (1h \u2192 2h \u2192\ - \ 4h \u2026 up to 32h) plus a new `failedIssuanceAttempts` field on Certificates." - - Support for Kubernetes CSR `spec.expirationSeconds` (Kubernetes 1.22+), retaining - the existing duration annotation with a minimum of 600s. - - 'Ingress/Gateway shim enhancements: override whitelist-source-range via Issuer - `ingressTemplate`, and ability to use an external issuer resource as default - for ingress-shim.' - - 'Operational tooling improvements: `cmctl experimental uninstall` and build - system transition from Bazel to Make (primarily developer-facing).' - breaking_changes: - - 'Cert-manager API removals already landed in v1.7: v1alpha2/v1alpha3/v1beta1 - CRDs removed; all resources must be stored as v1 prior to upgrade (run `cmctl - upgrade migrate-api-version`).' - - "v1.8 validates `spec.privateKey.rotationPolicy` on Certificates; only `Never`\ - \ and `Always` are allowed\u2014invalid manifests will be rejected by the\ - \ API/webhook and can break GitOps syncs." - - If enabling `ServerSideApply=true` when upgrading to v1.8, pre-1.8 Challenge - resources may not be cleaned up; ensure no Challenges exist or delete them - once `valid`. - - "Container internal binary paths changed due to Bazel\u2192Make container\ - \ layout; scripts or init containers that referenced old deep Bazel paths\ - \ will break." - - Leader election now uses only Lease objects; old ConfigMap-based leader election - objects may remain and require manual cleanup (upgrade-from-very-old versions - not supported). + chart_updates: ['Default nodeSelector changed to linux (`kubernetes.io/os: linux`).', + New values to add labels to ServiceAccounts across components., 'Chart sets + `allowPrivilegeEscalation: false` by default for core pods and startupapicheck + job.'] + features: ['Alpha server-side-apply support behind `ServerSideApply=true` feature + gate on Kubernetes 1.22+, reducing optimistic-locking conflicts and log + noise.', "Exponential backoff for failed certificate issuances (1h \u2192\ + \ 2h \u2192 4h \u2026 up to 32h) plus a new `failedIssuanceAttempts` field\ + \ on Certificates.", 'Support for Kubernetes CSR `spec.expirationSeconds` + (Kubernetes 1.22+), retaining the existing duration annotation with a minimum + of 600s.', 'Ingress/Gateway shim enhancements: override whitelist-source-range + via Issuer `ingressTemplate`, and ability to use an external issuer resource + as default for ingress-shim.', 'Operational tooling improvements: `cmctl + experimental uninstall` and build system transition from Bazel to Make (primarily + developer-facing).'] + breaking_changes: ['Cert-manager API removals already landed in v1.7: v1alpha2/v1alpha3/v1beta1 + CRDs removed; all resources must be stored as v1 prior to upgrade (run `cmctl + upgrade migrate-api-version`).', "v1.8 validates `spec.privateKey.rotationPolicy`\ + \ on Certificates; only `Never` and `Always` are allowed\u2014invalid manifests\ + \ will be rejected by the API/webhook and can break GitOps syncs.", 'If + enabling `ServerSideApply=true` when upgrading to v1.8, pre-1.8 Challenge + resources may not be cleaned up; ensure no Challenges exist or delete them + once `valid`.', "Container internal binary paths changed due to Bazel\u2192\ + Make container layout; scripts or init containers that referenced old deep\ + \ Bazel paths will break.", Leader election now uses only Lease objects; + old ConfigMap-based leader election objects may remain and require manual + cleanup (upgrade-from-very-old versions not supported).] chart_version: 1.8.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.8.0 - - quay.io/jetstack/cert-manager-controller:v1.8.0 - - quay.io/jetstack/cert-manager-ctl:v1.8.0 - - quay.io/jetstack/cert-manager-webhook:v1.8.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.8.0', 'quay.io/jetstack/cert-manager-controller:v1.8.0', + 'quay.io/jetstack/cert-manager-ctl:v1.8.0', 'quay.io/jetstack/cert-manager-webhook:v1.8.0'] - version: 1.7.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: @@ -14516,53 +12324,37 @@ addons: as described in the release notes before retrying. ' - chart_updates: - - CRDs shipped/installed by the chart no longer include deprecated API versions - (`v1alpha2`, `v1alpha3`, `v1beta1`); CRD manifests are smaller and no longer - require a conversion webhook. - - Chart includes the service-annotation handling fix for controller/webhook - Services. - features: - - New `Certificate.spec.additionalOutputFormats` supports `CombinedPEM` (key+chain - bundle) and `DER` outputs in addition to existing secret data formats. - - Webhook can now be configured via a mounted configuration file (ConfigMap) - instead of only CLI flags. - - Server-Side Apply is now used to manage Secret labels/annotations and reconcile - `secretTemplate`, improving drift correction. - - New flag `--acme-http01-solver-nameservers` allows custom nameservers for - ACME HTTP-01 propagation checks. - - 'New `cmctl upgrade migrate-api-version` command helps migrate stored CRs - to `apiVersion: v1` before upgrading.' - breaking_changes: - - '**Deprecated APIs removed:** cert-manager no longer serves `v1alpha2`, `v1alpha3`, - or `v1beta1`. All cert-manager CRs must be stored in etcd as `v1` and CRDs - must have only `v1` as the stored version before upgrading (use `cmctl upgrade - migrate-api-version`).' - - '**Ingress class semantics changed (reverted):** HTTP-01 solver Ingresses - go back to using the `kubernetes.io/ingress.class` annotation (instead of - `spec.ingressClassName`). If you relied on the newer behavior or use non-default - classes/controllers, validate HTTP-01 behavior after upgrade.' - - '**Upgrading with Server-Side Apply:** SSA upgrades can produce invalid CRD - configs due to CRD spec changes (conversion webhook removal). Use client-side - apply/Helm for CRDs or patch CRD managedFields.' - - '**Flags:** `--dns01-self-check-nameservers` removed; use `--dns01-recursive-nameservers` - instead.' - - '**Kubernetes compatibility:** cert-manager 1.7 requires Kubernetes >= 1.18 - (due to reliance on Server-Side Apply).' + chart_updates: ['CRDs shipped/installed by the chart no longer include deprecated + API versions (`v1alpha2`, `v1alpha3`, `v1beta1`); CRD manifests are smaller + and no longer require a conversion webhook.', Chart includes the service-annotation + handling fix for controller/webhook Services.] + features: [New `Certificate.spec.additionalOutputFormats` supports `CombinedPEM` + (key+chain bundle) and `DER` outputs in addition to existing secret data + formats., Webhook can now be configured via a mounted configuration file + (ConfigMap) instead of only CLI flags., 'Server-Side Apply is now used to + manage Secret labels/annotations and reconcile `secretTemplate`, improving + drift correction.', New flag `--acme-http01-solver-nameservers` allows custom + nameservers for ACME HTTP-01 propagation checks., 'New `cmctl upgrade migrate-api-version` + command helps migrate stored CRs to `apiVersion: v1` before upgrading.'] + breaking_changes: ['**Deprecated APIs removed:** cert-manager no longer serves + `v1alpha2`, `v1alpha3`, or `v1beta1`. All cert-manager CRs must be stored + in etcd as `v1` and CRDs must have only `v1` as the stored version before + upgrading (use `cmctl upgrade migrate-api-version`).', '**Ingress class + semantics changed (reverted):** HTTP-01 solver Ingresses go back to using + the `kubernetes.io/ingress.class` annotation (instead of `spec.ingressClassName`). + If you relied on the newer behavior or use non-default classes/controllers, + validate HTTP-01 behavior after upgrade.', '**Upgrading with Server-Side + Apply:** SSA upgrades can produce invalid CRD configs due to CRD spec changes + (conversion webhook removal). Use client-side apply/Helm for CRDs or patch + CRD managedFields.', '**Flags:** `--dns01-self-check-nameservers` removed; + use `--dns01-recursive-nameservers` instead.', '**Kubernetes compatibility:** + cert-manager 1.7 requires Kubernetes >= 1.18 (due to reliance on Server-Side + Apply).'] chart_version: 1.7.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.7.0 - - quay.io/jetstack/cert-manager-controller:v1.7.0 - - quay.io/jetstack/cert-manager-ctl:v1.7.0 - - quay.io/jetstack/cert-manager-webhook:v1.7.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.7.0', 'quay.io/jetstack/cert-manager-controller:v1.7.0', + 'quay.io/jetstack/cert-manager-ctl:v1.7.0', 'quay.io/jetstack/cert-manager-webhook:v1.7.0'] - version: 1.6.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: @@ -14579,99 +12371,70 @@ addons: _No explicit values key renames/removals were called out in the provided notes; validate against your current `values.yaml` and run `helm diff` before applying._' - chart_updates: - - "Startup API check hook behavior improved: deletes leftover hook resources\ - \ after failed installs (reduces \u201Calready exists\u201D/hook collision\ - \ issues on retry)." - - PodSecurityPolicy added for the startup API check job (legacy PSP environments). - - Service templates updated to allow custom annotations via chart values. - features: - - API no longer serves deprecated cert-manager resource versions `v1alpha2`, - `v1alpha3`, `v1beta1` (upgrade enforces using `cert-manager.io/v1`). - - New Prometheus metric exposing Certificate `renewBefore` behavior for monitoring - and alerting. - - Azure DNS solver can specify a managed identity ID (improves support for multiple - identities). - - 'CLI improvements in `cmctl`: shell completion + better Kubernetes flag exposure, - plus build-time configurable command name.' - breaking_changes: - - "Deprecated cert-manager API versions `v1alpha2`, `v1alpha3`, and `v1beta1`\ - \ are **not served** in 1.6; manifests using them will fail after upgrade\u2014\ - convert resources/manifests to `cert-manager.io/v1` before upgrading." - - JKS keystores enforce a minimum password length of 6 characters in 1.6.0 due - to a dependency upgrade; this is fixed in 1.6.1, so avoid 1.6.0 if you rely - on shorter JKS passwords. + chart_updates: ["Startup API check hook behavior improved: deletes leftover\ + \ hook resources after failed installs (reduces \u201Calready exists\u201D\ + /hook collision issues on retry).", PodSecurityPolicy added for the startup + API check job (legacy PSP environments)., Service templates updated to allow + custom annotations via chart values.] + features: ['API no longer serves deprecated cert-manager resource versions `v1alpha2`, + `v1alpha3`, `v1beta1` (upgrade enforces using `cert-manager.io/v1`).', New + Prometheus metric exposing Certificate `renewBefore` behavior for monitoring + and alerting., Azure DNS solver can specify a managed identity ID (improves + support for multiple identities)., 'CLI improvements in `cmctl`: shell completion + + better Kubernetes flag exposure, plus build-time configurable command + name.'] + breaking_changes: ["Deprecated cert-manager API versions `v1alpha2`, `v1alpha3`,\ + \ and `v1beta1` are **not served** in 1.6; manifests using them will fail\ + \ after upgrade\u2014convert resources/manifests to `cert-manager.io/v1`\ + \ before upgrading.", 'JKS keystores enforce a minimum password length of + 6 characters in 1.6.0 due to a dependency upgrade; this is fixed in 1.6.1, + so avoid 1.6.0 if you rely on shorter JKS passwords.'] chart_version: 1.6.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.6.0 - - quay.io/jetstack/cert-manager-controller:v1.6.0 - - quay.io/jetstack/cert-manager-ctl:v1.6.0 - - quay.io/jetstack/cert-manager-webhook:v1.6.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.6.0', 'quay.io/jetstack/cert-manager-controller:v1.6.0', + 'quay.io/jetstack/cert-manager-ctl:v1.6.0', 'quay.io/jetstack/cert-manager-webhook:v1.6.0'] - version: 1.5.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - cert-manager 1.5 is the first release to support Kubernetes 1.22 (ensure your - cluster version/PSPs/security policies are compatible). - - cert-manager now only accepts AdmissionReviewVersion v1 and ConversionReviewVersion - v1 (requires Kubernetes >=1.16; webhook/API server must support v1). - - Added a startup API check Job that waits for the cert-manager API to become - ready, plus a `kubectl cert-manager check api` command (may create an extra - Job during startup/upgrade). - - New optional controller `gateway-shim` for Gateway API (can be enabled/disabled; - adds additional reconciler behavior if enabled). - - 'Helm-chart level improvements: ability to configure labels on the cert-manager - webhook Service via a Helm value; service port for Prometheus scraping now - has a name (may affect ServiceMonitor scraping selectors); and support for - configuring which annotations are copied from Certificate to CertificateRequest - (with some keys excluded by default).' - features: - - Kubernetes 1.22 support. - - 'Gateway API support: optional gateway-shim to auto-create ACME certs for - annotated Gateways and Gateway API HTTP01 solver support.' - - 'TLS Secret customization: add custom annotations/labels to the Secret containing - the issued key pair.' - - 'Crypto: Ed25519 private keys/signatures supported for Certificates.' - - Experimental CSR signing support for ACME, SelfSigned, Vault, and Venafi issuers - behind `--feature-gates=ExperimentalCertificateSigningRequestControllers=true`, - plus a CLI command to create Kubernetes CSRs from Certificate manifests. - - 'Observability/ops: named Prometheus scrape port, new `clock_time_seconds` - metric, improved shutdown/leader election behavior, and new kubectl plugin - commands (`version`, `check api`, `x install`).' - breaking_changes: - - cert-manager webhooks now only support AdmissionReview and ConversionReview - API version v1 (v1beta1 removed); clusters must be Kubernetes >=1.16 and any - integrations expecting v1beta1 will break. - - "Pre-v1 cert-manager resource requests must be convertible to v1 to be validated/mutated\ - \ by admission webhooks; if conversion isn\u2019t in place, older manifests\ - \ may be rejected (relevant if you still apply deprecated API versions)." - - 'Forward-looking: APIs deprecated in 1.4 (v1alpha2/v1alpha3/v1beta1) will - stop being served in 1.6; you should complete CRD/resource migration to v1 - during/after this upgrade to avoid being blocked later.' + kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [cert-manager 1.5 is the first release to support Kubernetes + 1.22 (ensure your cluster version/PSPs/security policies are compatible)., + cert-manager now only accepts AdmissionReviewVersion v1 and ConversionReviewVersion + v1 (requires Kubernetes >=1.16; webhook/API server must support v1)., 'Added + a startup API check Job that waits for the cert-manager API to become ready, + plus a `kubectl cert-manager check api` command (may create an extra Job + during startup/upgrade).', New optional controller `gateway-shim` for Gateway + API (can be enabled/disabled; adds additional reconciler behavior if enabled)., + 'Helm-chart level improvements: ability to configure labels on the cert-manager + webhook Service via a Helm value; service port for Prometheus scraping now + has a name (may affect ServiceMonitor scraping selectors); and support for + configuring which annotations are copied from Certificate to CertificateRequest + (with some keys excluded by default).'] + features: [Kubernetes 1.22 support., 'Gateway API support: optional gateway-shim + to auto-create ACME certs for annotated Gateways and Gateway API HTTP01 + solver support.', 'TLS Secret customization: add custom annotations/labels + to the Secret containing the issued key pair.', 'Crypto: Ed25519 private + keys/signatures supported for Certificates.', 'Experimental CSR signing + support for ACME, SelfSigned, Vault, and Venafi issuers behind `--feature-gates=ExperimentalCertificateSigningRequestControllers=true`, + plus a CLI command to create Kubernetes CSRs from Certificate manifests.', + 'Observability/ops: named Prometheus scrape port, new `clock_time_seconds` + metric, improved shutdown/leader election behavior, and new kubectl plugin + commands (`version`, `check api`, `x install`).'] + breaking_changes: [cert-manager webhooks now only support AdmissionReview and + ConversionReview API version v1 (v1beta1 removed); clusters must be Kubernetes + >=1.16 and any integrations expecting v1beta1 will break., "Pre-v1 cert-manager\ + \ resource requests must be convertible to v1 to be validated/mutated by\ + \ admission webhooks; if conversion isn\u2019t in place, older manifests\ + \ may be rejected (relevant if you still apply deprecated API versions).", + 'Forward-looking: APIs deprecated in 1.4 (v1alpha2/v1alpha3/v1beta1) will + stop being served in 1.6; you should complete CRD/resource migration to + v1 during/after this upgrade to avoid being blocked later.'] chart_version: 1.5.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.5.0 - - quay.io/jetstack/cert-manager-controller:v1.5.0 - - quay.io/jetstack/cert-manager-ctl:v1.5.0 - - quay.io/jetstack/cert-manager-webhook:v1.5.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.5.0', 'quay.io/jetstack/cert-manager-controller:v1.5.0', + 'quay.io/jetstack/cert-manager-ctl:v1.5.0', 'quay.io/jetstack/cert-manager-webhook:v1.5.0'] - version: 1.4.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -14684,45 +12447,33 @@ addons: \ note, still relevant if you\u2019re on 1.3.0) **Helm upgrade path:** upgrade\ \ to **v1.3.1 first** to avoid a CRD type conversion issue, then proceed to\ \ v1.4.0." - chart_updates: - - Controller leader election lock type changed to `ConfigMapsLeasesResourceLock` - (internal behavior; may affect required RBAC in locked-down clusters). - - Base image updated (distroless/static) and Kubernetes libraries updated to - v1.21.0 (generally transparent but can surface compatibility issues in very - old clusters/tools). - - Webhook can be configured to be reachable from outside the cluster (new capability; - requires conscious networking configuration if enabled). - features: - - 'Helm: add `serviceLabels` to apply custom labels to the controller Service.' - - 'Security: `runAsNonRoot` enabled by default (hardening); requires adjustments - if any container needs root.' - - 'Issuers: CA/Vault/Venafi now build and expose a proper certificate chain - and set `CertificateRequest.Status.CA` to the root-most certificate when available.' - - New option to implement the CA Issuer via the Kubernetes `CertificateSigningRequest` - controller. - - Webhook can be exposed outside the cluster (useful for external API server/webhook - reachability scenarios). - - Akamai issuer updated to EdgeDNS v2 API; kubectl plugin built for darwin/arm64. - breaking_changes: - - 'CA Issuer behavior change: `ca.crt` on issued Secrets now stores the **root - CA** (when available) rather than the issuing/intermediate CA; the intermediate - should now appear in `tls.crt` chain. Consumers that assumed `ca.crt` contained - the intermediate may need updates.' - - 'Helm default security context change: `runAsNonRoot=true` can break deployments - that add custom root-running containers unless values are overridden.' + chart_updates: [Controller leader election lock type changed to `ConfigMapsLeasesResourceLock` + (internal behavior; may affect required RBAC in locked-down clusters)., + Base image updated (distroless/static) and Kubernetes libraries updated to + v1.21.0 (generally transparent but can surface compatibility issues in very + old clusters/tools)., Webhook can be configured to be reachable from outside + the cluster (new capability; requires conscious networking configuration + if enabled).] + features: ['Helm: add `serviceLabels` to apply custom labels to the controller + Service.', 'Security: `runAsNonRoot` enabled by default (hardening); requires + adjustments if any container needs root.', 'Issuers: CA/Vault/Venafi now + build and expose a proper certificate chain and set `CertificateRequest.Status.CA` + to the root-most certificate when available.', New option to implement the + CA Issuer via the Kubernetes `CertificateSigningRequest` controller., Webhook + can be exposed outside the cluster (useful for external API server/webhook + reachability scenarios)., Akamai issuer updated to EdgeDNS v2 API; kubectl + plugin built for darwin/arm64.] + breaking_changes: ['CA Issuer behavior change: `ca.crt` on issued Secrets now + stores the **root CA** (when available) rather than the issuing/intermediate + CA; the intermediate should now appear in `tls.crt` chain. Consumers that + assumed `ca.crt` contained the intermediate may need updates.', 'Helm default + security context change: `runAsNonRoot=true` can break deployments that + add custom root-running containers unless values are overridden.'] chart_version: 1.4.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.4.0 - - quay.io/jetstack/cert-manager-controller:v1.4.0 - - quay.io/jetstack/cert-manager-webhook:v1.4.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.4.0', 'quay.io/jetstack/cert-manager-controller:v1.4.0', + 'quay.io/jetstack/cert-manager-webhook:v1.4.0'] - version: 1.3.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -14741,48 +12492,34 @@ addons: if you override webhook/service ports). ' - chart_updates: - - 'Helm chart: add `automountServiceAccountToken` field to service accounts.' - - 'Helm chart: fix/adjust Helm upgrade behaviors (v1.2 had a type conversion - bug fix; v1.3 notes include additional Helm upgrade fix).' - - 'Helm chart/service: ensure `targetPort` uses the value-defined port (may - affect custom port overrides).' - features: - - CertificateRequests now support an `Approved` condition and include requester - `UserInfo` fields (username/groups/uid/extra) for auditing. - - 'New kubectl plugin commands: `kubectl cert-manager approve|deny` and improved - default output for `kubectl get certificaterequest`.' - - Issuers and Certificates now publish `observedGeneration` in conditions to - make status vs. spec drift easier to detect. - - Certificates gain `revisionHistoryLimit` to garbage-collect old CertificateRequests - and reduce clutter. - - Controller can selectively disable specific controllers via `--controllers=\*,-foo`. - - Venafi issuer updated for Venafi Cloud OutagePREDICT compatibility. - breaking_changes: - - Controller flag `--renew-before-expiration-duration` was **removed** in v1.3; - move to `Certificate.spec.renewBefore` / ingress-shim annotations or manifests - will fail to start if still set. - - "CertificateRequests are now **immutable**: `spec` and `metadata.annotations`\ - \ can\u2019t be changed after creation; workflows that patch CertificateRequests\ - \ must be adjusted." - - 'Venafi Cloud zone syntax changed due to OutagePREDICT migration: zone is - now `<>\\<>` (e.g., `My Application\\My - CIT`).' - - "Helm upgrade pitfall: v1.3.0 has a CRD type conversion issue\u2014**upgrade\ - \ to v1.3.1** instead of v1.3.0." + chart_updates: ['Helm chart: add `automountServiceAccountToken` field to service + accounts.', 'Helm chart: fix/adjust Helm upgrade behaviors (v1.2 had a type + conversion bug fix; v1.3 notes include additional Helm upgrade fix).', 'Helm + chart/service: ensure `targetPort` uses the value-defined port (may affect + custom port overrides).'] + features: [CertificateRequests now support an `Approved` condition and include + requester `UserInfo` fields (username/groups/uid/extra) for auditing., 'New + kubectl plugin commands: `kubectl cert-manager approve|deny` and improved + default output for `kubectl get certificaterequest`.', Issuers and Certificates + now publish `observedGeneration` in conditions to make status vs. spec drift + easier to detect., Certificates gain `revisionHistoryLimit` to garbage-collect + old CertificateRequests and reduce clutter., 'Controller can selectively + disable specific controllers via `--controllers=\*,-foo`.', Venafi issuer + updated for Venafi Cloud OutagePREDICT compatibility.] + breaking_changes: [Controller flag `--renew-before-expiration-duration` was + **removed** in v1.3; move to `Certificate.spec.renewBefore` / ingress-shim + annotations or manifests will fail to start if still set., "CertificateRequests\ + \ are now **immutable**: `spec` and `metadata.annotations` can\u2019t be\ + \ changed after creation; workflows that patch CertificateRequests must\ + \ be adjusted.", 'Venafi Cloud zone syntax changed due to OutagePREDICT + migration: zone is now `<>\\<>` + (e.g., `My Application\\My CIT`).', "Helm upgrade pitfall: v1.3.0 has a\ + \ CRD type conversion issue\u2014**upgrade to v1.3.1** instead of v1.3.0."] chart_version: 1.3.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.3.0 - - quay.io/jetstack/cert-manager-controller:v1.3.0 - - quay.io/jetstack/cert-manager-webhook:v1.3.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.3.0', 'quay.io/jetstack/cert-manager-controller:v1.3.0', + 'quay.io/jetstack/cert-manager-webhook:v1.3.0'] - version: 1.2.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -14794,55 +12531,35 @@ addons: \ the provided notes don\u2019t include a full chart values diff; review your\ \ existing values file for any custom flags/args that may now be deprecated\ \ (e.g., `--renew-before-expiration-duration`)." - chart_updates: - - Minimum supported Kubernetes version is now **v1.16.0** (v1.2.0). - - Admissionregistration resources now use `admissionregistration.k8s.io/v1` - (v1.2.0). - - Ingress-related work moved to newer API group (`networking.k8s.io/v1beta1`) - in code paths (v1.2.0). - - User-Agent changed to reflect CNCF ownership transfer (v1.2.0). - - 'Vault issuer secret contents changed: `ca.crt` now stores the **root CA** - instead of the issuing CA (v1.2.0).' - features: - - Ingress-shim can now set key usages via `cert-manager.io/usages` and includes - Server Auth by default. - - 'New plugin: `kubectl cert-manager inspect secret` to print certificate info - from a Secret.' - - CRDs now include category names so you can list them with `kubectl get cert-manager` - / `kubectl get cert-manager-acme`. - - Controller can generate a PKCS12 truststore (`truststore.p12`) from a CA. - - Controller can expose pprof profiling when enabled via `--enable-profiling`. - - CA issuer can set a custom OCSP server for issued certificates. - - Cainjector leader election timing can be tuned via new flags (lease duration - / renew deadline / retry period). - - Ingress-shim now honors `cert-manager.io/duration` and `cert-manager.io/renew-before` - annotations. - breaking_changes: - - Kubernetes **v1.16.0** is now the minimum supported version; clusters on v1.15 - or below must upgrade Kubernetes first or stay on cert-manager v1.1.x. - - The controller flag `--renew-before-expiration-duration` is **deprecated** - in favor of `Certificate.spec.renewBefore` and will be removed in the next - release (plan to migrate now). - - 'Vault issuer output changed: `ca.crt` now contains the **root CA** (not the - issuing CA), which may break consumers that expect the previous CA chain behavior.' + chart_updates: [Minimum supported Kubernetes version is now **v1.16.0** (v1.2.0)., + Admissionregistration resources now use `admissionregistration.k8s.io/v1` + (v1.2.0)., Ingress-related work moved to newer API group (`networking.k8s.io/v1beta1`) + in code paths (v1.2.0)., User-Agent changed to reflect CNCF ownership transfer + (v1.2.0)., 'Vault issuer secret contents changed: `ca.crt` now stores the + **root CA** instead of the issuing CA (v1.2.0).'] + features: [Ingress-shim can now set key usages via `cert-manager.io/usages` + and includes Server Auth by default., 'New plugin: `kubectl cert-manager + inspect secret` to print certificate info from a Secret.', CRDs now include + category names so you can list them with `kubectl get cert-manager` / `kubectl + get cert-manager-acme`., Controller can generate a PKCS12 truststore (`truststore.p12`) + from a CA., Controller can expose pprof profiling when enabled via `--enable-profiling`., + CA issuer can set a custom OCSP server for issued certificates., Cainjector + leader election timing can be tuned via new flags (lease duration / renew + deadline / retry period)., Ingress-shim now honors `cert-manager.io/duration` + and `cert-manager.io/renew-before` annotations.] + breaking_changes: [Kubernetes **v1.16.0** is now the minimum supported version; + clusters on v1.15 or below must upgrade Kubernetes first or stay on cert-manager + v1.1.x., The controller flag `--renew-before-expiration-duration` is **deprecated** + in favor of `Certificate.spec.renewBefore` and will be removed in the next + release (plan to migrate now)., 'Vault issuer output changed: `ca.crt` now + contains the **root CA** (not the issuing CA), which may break consumers + that expect the previous CA chain behavior.'] chart_version: 1.2.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.2.0 - - quay.io/jetstack/cert-manager-controller:v1.2.0 - - quay.io/jetstack/cert-manager-webhook:v1.2.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.2.0', 'quay.io/jetstack/cert-manager-controller:v1.2.0', + 'quay.io/jetstack/cert-manager-webhook:v1.2.0'] - version: 1.1.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -14854,38 +12571,23 @@ addons: \ for monitoring/PSP/policy selection or you need longer webhook admission\ \ timeouts, consider setting these new values. Otherwise no required values\ \ changes are called out in the provided notes." - chart_updates: - - 'Helm chart: allow setting custom `podLabels` on `webhook` and `cainjector` - Deployments.' - - 'Helm chart: allow configuring the webhook timeout for admission calls.' - features: - - 'Certificate spec: `encodeUsagesInRequest` allows disabling encoding key usages - in the CSR.' - - "ACME: can pass Certificate `duration` to the ACME server (not supported by\ - \ Let\u2019s Encrypt at the time)." - - 'ACME: support issuing certificates with IP Subject Alternative Names.' - - 'ACME DNS-01: propagation check period is now configurable.' - - 'Controller tuning: Kubernetes client QPS throttling is now configurable.' - - 'Venafi TPP issuer: now supports access-token credentials.' + chart_updates: ['Helm chart: allow setting custom `podLabels` on `webhook` and + `cainjector` Deployments.', 'Helm chart: allow configuring the webhook timeout + for admission calls.'] + features: ['Certificate spec: `encodeUsagesInRequest` allows disabling encoding + key usages in the CSR.', "ACME: can pass Certificate `duration` to the ACME\ + \ server (not supported by Let\u2019s Encrypt at the time).", 'ACME: support + issuing certificates with IP Subject Alternative Names.', 'ACME DNS-01: + propagation check period is now configurable.', 'Controller tuning: Kubernetes + client QPS throttling is now configurable.', 'Venafi TPP issuer: now supports + access-token credentials.'] breaking_changes: [] chart_version: 1.1.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.1.0 - - quay.io/jetstack/cert-manager-controller:v1.1.0 - - quay.io/jetstack/cert-manager-webhook:v1.1.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.1.0', 'quay.io/jetstack/cert-manager-controller:v1.1.0', + 'quay.io/jetstack/cert-manager-webhook:v1.1.0'] - version: 1.0.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -14911,54 +12613,37 @@ addons: - **Use modern `kubectl` and `helm`:** Older versions may fail to update cert-manager CRDs correctly (called out as urgent in both v0.16.0 and v1.0.0 notes).' - chart_updates: - - Introduces the stable **v1 API** and makes it the **storage version** for - cert-manager resources; CRDs now include `apiextensions.k8s.io/v1` variants - and controllers are updated accordingly. - - 'Moves to newer/stable Kubernetes APIs across the board: admissionregistration.k8s.io/v1 - for webhooks and rbac.authorization.k8s.io/v1 for RBAC.' - - Improved logging via klog v2 and log-level usage; internal refactors like - cainjector leader election simplification. - - Enhances kubectl/ctl UX, especially `kubectl cert-manager status certificate`, - adding more related resource and event output for debugging. - - ACME improvements including preferred chain support and better handling of - Retry-After backoff; better error surfacing for Orders/Challenges. - features: - - Stable `v1` API is introduced and becomes the default/storage version, improving - long-term compatibility expectations. - - '`kubectl cert-manager status certificate` gains richer output (related Secret, - Issuer, Orders/Challenges, and Events) for faster troubleshooting.' - - Helm chart gains options for webhook host networking, configurable probes, - extra webhook annotations, and image digests for pinning. - - 'ACME enhancements: support for `preferredChain` and improved rate-limit backoff - handling via Retry-After.' - - 'Issuer/provider improvements: async Venafi issuance (0.16), Vault issuer - namespace support (1.0), and additional HTTP01 podTemplate fields (serviceAccountName/priorityClassName).' - breaking_changes: - - '**Kubernetes version compatibility:** Kubernetes < **v1.16** requires special - upgrade instructions for 0.16 -> 1.0 (per urgent notes).' - - '**API removals:** Support for `AuditSink` resources in `auditregistration.k8s.io/v1alpha1` - was removed (v0.16.0).' - - '**CRD upgrade sensitivity:** Upgrading CRDs can fail with old `kubectl`/`helm`; - treat CRD updates as a critical step and follow the documented upgrade guides.' + chart_updates: [Introduces the stable **v1 API** and makes it the **storage + version** for cert-manager resources; CRDs now include `apiextensions.k8s.io/v1` + variants and controllers are updated accordingly., 'Moves to newer/stable + Kubernetes APIs across the board: admissionregistration.k8s.io/v1 for webhooks + and rbac.authorization.k8s.io/v1 for RBAC.', Improved logging via klog v2 + and log-level usage; internal refactors like cainjector leader election + simplification., 'Enhances kubectl/ctl UX, especially `kubectl cert-manager + status certificate`, adding more related resource and event output for debugging.', + ACME improvements including preferred chain support and better handling of + Retry-After backoff; better error surfacing for Orders/Challenges.] + features: ['Stable `v1` API is introduced and becomes the default/storage version, + improving long-term compatibility expectations.', '`kubectl cert-manager + status certificate` gains richer output (related Secret, Issuer, Orders/Challenges, + and Events) for faster troubleshooting.', 'Helm chart gains options for + webhook host networking, configurable probes, extra webhook annotations, + and image digests for pinning.', 'ACME enhancements: support for `preferredChain` + and improved rate-limit backoff handling via Retry-After.', 'Issuer/provider + improvements: async Venafi issuance (0.16), Vault issuer namespace support + (1.0), and additional HTTP01 podTemplate fields (serviceAccountName/priorityClassName).'] + breaking_changes: ['**Kubernetes version compatibility:** Kubernetes < **v1.16** + requires special upgrade instructions for 0.16 -> 1.0 (per urgent notes).', + '**API removals:** Support for `AuditSink` resources in `auditregistration.k8s.io/v1alpha1` + was removed (v0.16.0).', '**CRD upgrade sensitivity:** Upgrading CRDs can + fail with old `kubectl`/`helm`; treat CRD updates as a critical step and + follow the documented upgrade guides.'] chart_version: 1.0.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v1.0.0 - - quay.io/jetstack/cert-manager-controller:v1.0.0 - - quay.io/jetstack/cert-manager-webhook:v1.0.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v1.0.0', 'quay.io/jetstack/cert-manager-controller:v1.0.0', + 'quay.io/jetstack/cert-manager-webhook:v1.0.0'] - version: 0.16.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -14968,55 +12653,36 @@ addons: \ via values (for cert-manager, webhook, and cainjector).\n- **Tooling caution**:\ \ v0.16 notes that **older `kubectl`/`helm` struggle to update CRDs**; follow\ \ the 0.15\u21920.16 upgrade doc and ensure your client tooling is new enough.\n" - chart_updates: - - 'v0.15: Helm chart can optionally install/manage CRDs via `installCRDs` (was - previously external/static-manifest managed).' - - 'v0.15: ServiceAccount customization added for webhook and cainjector (chart - options).' - - 'v0.16: Helm chart exposes container-level `securityContext` configuration - per deployment.' - features: - - Optional Helm-managed CRDs via `installCRDs`, reducing manual CRD lifecycle - steps when installing/upgrading with Helm. - - Webhook startup is more reliable because it can bootstrap/manage its own CA/certs - (dynamic authority), reducing dependency on the controller being ready. - - JKS and PKCS#12 keystore support is GA and configurable per-Certificate via - `spec.keystores`. - - 'New `kubectl cert-manager` (ctl) plugin features: status output improvements, - manual renewal support (0.15 feature-gated; more commands in 0.16), and creation - of CertificateRequests from Certificate YAML.' - - New `v1beta1` API version is introduced in 0.16, preparing for API stabilization/migrations. - - Experimental certificate controller implementations become enabled for all - users in 0.16, bringing features like private key rotation closer to default - behavior. - breaking_changes: - - "v0.15: Default KeyUsage no longer includes `serverAuth`; if you rely on it\ - \ and your issuer doesn\u2019t set it, you must explicitly add `serverAuth`\ - \ to Certificate/CertificateRequest `usages` to avoid behavior changes." - - 'v0.16: Support for `AuditSink` (`auditregistration.k8s.io/v1alpha1`) as a - cainjector target is removed; any setups relying on injecting CA bundles into - AuditSink will stop working.' - - 'v0.16: CRD upgrade can fail with older Helm/kubectl clients; using outdated - tooling may break the upgrade until clients are updated and CRDs are applied - per the documented procedure.' + chart_updates: ['v0.15: Helm chart can optionally install/manage CRDs via `installCRDs` + (was previously external/static-manifest managed).', 'v0.15: ServiceAccount + customization added for webhook and cainjector (chart options).', 'v0.16: + Helm chart exposes container-level `securityContext` configuration per deployment.'] + features: ['Optional Helm-managed CRDs via `installCRDs`, reducing manual CRD + lifecycle steps when installing/upgrading with Helm.', 'Webhook startup + is more reliable because it can bootstrap/manage its own CA/certs (dynamic + authority), reducing dependency on the controller being ready.', JKS and + PKCS#12 keystore support is GA and configurable per-Certificate via `spec.keystores`., + 'New `kubectl cert-manager` (ctl) plugin features: status output improvements, + manual renewal support (0.15 feature-gated; more commands in 0.16), and + creation of CertificateRequests from Certificate YAML.', 'New `v1beta1` + API version is introduced in 0.16, preparing for API stabilization/migrations.', + 'Experimental certificate controller implementations become enabled for all + users in 0.16, bringing features like private key rotation closer to default + behavior.'] + breaking_changes: ["v0.15: Default KeyUsage no longer includes `serverAuth`;\ + \ if you rely on it and your issuer doesn\u2019t set it, you must explicitly\ + \ add `serverAuth` to Certificate/CertificateRequest `usages` to avoid behavior\ + \ changes.", 'v0.16: Support for `AuditSink` (`auditregistration.k8s.io/v1alpha1`) + as a cainjector target is removed; any setups relying on injecting CA bundles + into AuditSink will stop working.', 'v0.16: CRD upgrade can fail with older + Helm/kubectl clients; using outdated tooling may break the upgrade until + clients are updated and CRDs are applied per the documented procedure.'] chart_version: 0.16.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.16.0 - - quay.io/jetstack/cert-manager-controller:v0.16.0 - - quay.io/jetstack/cert-manager-webhook:v0.16.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.16.0', 'quay.io/jetstack/cert-manager-controller:v0.16.0', + 'quay.io/jetstack/cert-manager-webhook:v0.16.0'] - version: 0.15.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -15033,53 +12699,36 @@ addons: \ (controller/cainjector/webhook). If your 0.14 install came from Helm and\ \ you didn\u2019t perform this, validate your current resources/selectors\ \ before the 0.15 upgrade." - chart_updates: - - Helm chart gained the `installCRDs` switch to optionally manage CRDs with - Helm (disabled by default). - - Webhook deployment/process was improved in 0.15 (DynamicAuthority / self-managed - CA for serving certs), reducing dependency on the controller for webhook startup - reliability. - - Chart supports additional customization around service accounts (webhook and - cainjector), and a narrower-scoped RBAC role for leader-election configmaps - (operational hardening). - features: - - Optional Helm-managed CRDs via `installCRDs`, simplifying installations that - want CRDs lifecycle tied to the Helm release. - - Experimental new Certificate controller architecture (feature-gated) to enable - capabilities like private key rotation and manual renewal triggering. - - Webhook startup is more reliable and faster because the webhook now bootstraps/maintains - its own CA and serving certs without waiting on the controller. - - General availability of per-Certificate JKS and PKCS#12 keystore output via - `certificate.spec.keystores` (no global experimental flags needed). - - New `kubectl cert-manager` (cert-manager-ctl) plugin adds `convert` (API version - conversion) and `renew` (manual renewal; requires experimental certificate - controllers). - breaking_changes: - - '**Urgent:** `serverAuth` key usage was removed from the default usages set. - If your Issuer does not automatically include it and you require it, you must - explicitly add `serverAuth` to `Certificate` and `CertificateRequest` `usages` - to avoid unexpected behavior after upgrade.' - - "If you previously relied on v0.14\u2019s global experimental JKS/PKCS12 flags,\ - \ v0.15\u2019s recommended approach is per-Certificate `spec.keystores`; plan\ - \ a migration of configuration/expectations accordingly." + chart_updates: [Helm chart gained the `installCRDs` switch to optionally manage + CRDs with Helm (disabled by default)., 'Webhook deployment/process was improved + in 0.15 (DynamicAuthority / self-managed CA for serving certs), reducing + dependency on the controller for webhook startup reliability.', 'Chart supports + additional customization around service accounts (webhook and cainjector), + and a narrower-scoped RBAC role for leader-election configmaps (operational + hardening).'] + features: ['Optional Helm-managed CRDs via `installCRDs`, simplifying installations + that want CRDs lifecycle tied to the Helm release.', Experimental new Certificate + controller architecture (feature-gated) to enable capabilities like private + key rotation and manual renewal triggering., Webhook startup is more reliable + and faster because the webhook now bootstraps/maintains its own CA and serving + certs without waiting on the controller., General availability of per-Certificate + JKS and PKCS#12 keystore output via `certificate.spec.keystores` (no global + experimental flags needed)., New `kubectl cert-manager` (cert-manager-ctl) + plugin adds `convert` (API version conversion) and `renew` (manual renewal; + requires experimental certificate controllers).] + breaking_changes: ['**Urgent:** `serverAuth` key usage was removed from the + default usages set. If your Issuer does not automatically include it and + you require it, you must explicitly add `serverAuth` to `Certificate` and + `CertificateRequest` `usages` to avoid unexpected behavior after upgrade.', + "If you previously relied on v0.14\u2019s global experimental JKS/PKCS12 flags,\ + \ v0.15\u2019s recommended approach is per-Certificate `spec.keystores`;\ + \ plan a migration of configuration/expectations accordingly."] chart_version: 0.15.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.15.0 - - quay.io/jetstack/cert-manager-controller:v0.15.0 - - quay.io/jetstack/cert-manager-webhook:v0.15.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.15.0', 'quay.io/jetstack/cert-manager-controller:v0.15.0', + 'quay.io/jetstack/cert-manager-webhook:v0.15.0'] - version: 0.14.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -15096,57 +12745,36 @@ addons: - If you previously disabled cainjector: a bug fix indicates `cainjector.enabled=false`\ \ now works correctly; re-check your values to ensure your intended state\ \ is applied post-upgrade.\n" - chart_updates: - - Webhook component is required starting v0.14 (no-webhook variant removed; - webhook enable toggle removed in chart). - - "Installation manifests reworked into two variants: `cert-manager.yaml` (standard)\ - \ and `cert-manager-legacy.yaml` (for Kubernetes 1.11\u20131.14 / OpenShift\ - \ 3.11)." - - 'CRD distribution changed: `00-crds.yaml` replaced by a release-published - CRD manifest; CRD conversion webhook enabled to serve v1alpha3 alongside v1alpha2.' - - Deployment selectors updated (requires deleting existing Deployments prior - to Helm upgrade). - - Webhook leader-election RoleBinding now uses leader election namespace rather - than hard-coded `kube-system`. - - Flags/params added around webhook TLS cipher suites and improved webhook startup - time. - features: - - CRD conversion webhook enabled and new `v1alpha3` API served alongside `v1alpha2`, - easing future API transitions. - - Experimental certificate bundle output support for **JKS** and **PKCS#12** - via controller flags (global enable). - - 'Venafi issuer enhancements: custom fields via `venafi.cert-manager.io/custom-fields` - annotation (TPP 19.2+ required for TPP).' - - New `emailSANs` field on Certificate resources. - - 'Improved install compatibility: support extended to Kubernetes 1.11 and OpenShift - 3.11 (via legacy manifests).' - breaking_changes: - - '**Helm upgrade requires manual intervention**: delete the three cert-manager - Deployments before upgrading due to immutable selector changes.' - - '**Webhook cannot be disabled anymore**; environments that relied on `webhook.enabled=false` - or no-webhook installs must now run the webhook and ensure API server-to-webhook - connectivity.' - - 'API evolution begins (`v1alpha3` + conversion webhook): while intended to - be seamless, any hardcoded assumptions about field locations/serialization - in clients may need validation.' + chart_updates: [Webhook component is required starting v0.14 (no-webhook variant + removed; webhook enable toggle removed in chart)., "Installation manifests\ + \ reworked into two variants: `cert-manager.yaml` (standard) and `cert-manager-legacy.yaml`\ + \ (for Kubernetes 1.11\u20131.14 / OpenShift 3.11).", 'CRD distribution + changed: `00-crds.yaml` replaced by a release-published CRD manifest; CRD + conversion webhook enabled to serve v1alpha3 alongside v1alpha2.', Deployment + selectors updated (requires deleting existing Deployments prior to Helm + upgrade)., Webhook leader-election RoleBinding now uses leader election + namespace rather than hard-coded `kube-system`., Flags/params added around + webhook TLS cipher suites and improved webhook startup time.] + features: ['CRD conversion webhook enabled and new `v1alpha3` API served alongside + `v1alpha2`, easing future API transitions.', Experimental certificate bundle + output support for **JKS** and **PKCS#12** via controller flags (global + enable)., 'Venafi issuer enhancements: custom fields via `venafi.cert-manager.io/custom-fields` + annotation (TPP 19.2+ required for TPP).', New `emailSANs` field on Certificate + resources., 'Improved install compatibility: support extended to Kubernetes + 1.11 and OpenShift 3.11 (via legacy manifests).'] + breaking_changes: ['**Helm upgrade requires manual intervention**: delete the + three cert-manager Deployments before upgrading due to immutable selector + changes.', '**Webhook cannot be disabled anymore**; environments that relied + on `webhook.enabled=false` or no-webhook installs must now run the webhook + and ensure API server-to-webhook connectivity.', 'API evolution begins (`v1alpha3` + + conversion webhook): while intended to be seamless, any hardcoded assumptions + about field locations/serialization in clients may need validation.'] chart_version: 0.14.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.14.0 - - quay.io/jetstack/cert-manager-controller:v0.14.0 - - quay.io/jetstack/cert-manager-webhook:v0.14.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.14.0', 'quay.io/jetstack/cert-manager-controller:v0.14.0', + 'quay.io/jetstack/cert-manager-webhook:v0.14.0'] - version: 0.13.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -15160,45 +12788,28 @@ addons: \ explicitly sets `containerPort` protocol.\n\n_No mandatory Helm values changes\ \ are called out for 0.12\u21920.13; v0.13 is described as not requiring special\ \ upgrade steps._" - chart_updates: - - Helm chart now supports configuring additional pod `volumes` and `volumeMounts`. - - Helm chart supports configurable deployment annotations for controller/webhook/cainjector. - - Helm chart supports setting pod securityContext for controller and separately - for webhook/cainjector. - - Helm chart can disable AppArmor when using PodSecurityPolicies. - - Helm chart fixes templating of false-y values (kubernetes/kubernetes#66450). - - Helm chart explicitly defines `containerPort` protocol. - features: - - ACME External Account Binding (EAB) support via `spec.acme.externalAccountBinding` - on ACME Issuer/ClusterIssuer, enabling use with ACME providers that require - EAB. - - Certificate subject supports the full set of standard X.509 subject fields - (e.g., OU, province, serialNumber, country, etc.). - - New `InvalidRequest` status condition on `CertificateRequest` lets external - issuers signal a non-retriable invalid CSR/request to avoid endless retries/quota - burn. - breaking_changes: - - "No breaking changes or special upgrade steps are indicated for v0.13.0 relative\ - \ to v0.12.0 in the provided notes (it\u2019s described as a minor, incremental\ - \ update)." + chart_updates: [Helm chart now supports configuring additional pod `volumes` + and `volumeMounts`., Helm chart supports configurable deployment annotations + for controller/webhook/cainjector., Helm chart supports setting pod securityContext + for controller and separately for webhook/cainjector., Helm chart can disable + AppArmor when using PodSecurityPolicies., Helm chart fixes templating of + false-y values (kubernetes/kubernetes#66450)., Helm chart explicitly defines + `containerPort` protocol.] + features: ['ACME External Account Binding (EAB) support via `spec.acme.externalAccountBinding` + on ACME Issuer/ClusterIssuer, enabling use with ACME providers that require + EAB.', 'Certificate subject supports the full set of standard X.509 subject + fields (e.g., OU, province, serialNumber, country, etc.).', New `InvalidRequest` + status condition on `CertificateRequest` lets external issuers signal a + non-retriable invalid CSR/request to avoid endless retries/quota burn.] + breaking_changes: ["No breaking changes or special upgrade steps are indicated\ + \ for v0.13.0 relative to v0.12.0 in the provided notes (it\u2019s described\ + \ as a minor, incremental update)."] chart_version: 0.13.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.13.0 - - quay.io/jetstack/cert-manager-controller:v0.13.0 - - quay.io/jetstack/cert-manager-webhook:v0.13.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.13.0', 'quay.io/jetstack/cert-manager-controller:v0.13.0', + 'quay.io/jetstack/cert-manager-webhook:v0.13.0'] - version: 0.12.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11'] requirements: [] incompatibilities: [] summary: @@ -15215,54 +12826,43 @@ addons: no user action. ' - chart_updates: - - Webhook component deployment was redesigned to no longer rely on an `APIService`, - reducing risk of cluster-wide issues if the webhook is unavailable. - - Multi-architecture image support is now automatic via Docker manifest lists - (no need for arch-specific images/manifests). - - Improved ACME Challenge diagnostics; more information surfaced on Challenge - resources (`kubectl describe challenge ...`). - - 'Various bug fixes: PSP compatibility, OwnerReferencesPermissionEnforcement - admission controller compatibility, leader election signal handling, and solver/docs - fixes.' - - 'Defaults/behavioral tweaks: webhook listen address default changed to **10250** - for better GKE private cluster compatibility.' - - 'Schema/validation tightened: `CertificateRequest.spec.csr` marked required; - additional API resource validation for `status` subresource; immutability - enforced on multiple Order fields.' - features: - - Automatic multi-architecture image selection using Docker manifest lists (arm/arm64 - etc.) without changing manifests. - - Much better debugging for ACME authorization failures via richer status/details - on Challenge resources. - - Webhook simplified (no `APIService`) and now includes support for CRD API - conversion groundwork for future v1beta1. - - Cloudflare issuer supports API token authentication. - - Certificates now include `serverAuth` extended key usage by default. - breaking_changes: - - '**Vault Kubernetes auth path change:** if you set a custom Kubernetes Auth - Mount Path, you must now specify the full mount path; cert-manager appends - `/login` automatically. Default changed from `kubernetes` to `/v1/auth/kubernetes`.' - - Order resource fields made immutable; if you have automation that mutates - these fields after creation, it will now fail and must be updated. - - '`CertificateRequest.spec.csr` is now required by schema; any manifests missing - it (for CRs you create directly) will be rejected.' + chart_updates: ['Webhook component deployment was redesigned to no longer rely + on an `APIService`, reducing risk of cluster-wide issues if the webhook + is unavailable.', Multi-architecture image support is now automatic via + Docker manifest lists (no need for arch-specific images/manifests)., Improved + ACME Challenge diagnostics; more information surfaced on Challenge resources + (`kubectl describe challenge ...`)., 'Various bug fixes: PSP compatibility, + OwnerReferencesPermissionEnforcement admission controller compatibility, + leader election signal handling, and solver/docs fixes.', 'Defaults/behavioral + tweaks: webhook listen address default changed to **10250** for better GKE + private cluster compatibility.', 'Schema/validation tightened: `CertificateRequest.spec.csr` + marked required; additional API resource validation for `status` subresource; + immutability enforced on multiple Order fields.'] + features: [Automatic multi-architecture image selection using Docker manifest + lists (arm/arm64 etc.) without changing manifests., Much better debugging + for ACME authorization failures via richer status/details on Challenge resources., + Webhook simplified (no `APIService`) and now includes support for CRD API + conversion groundwork for future v1beta1., Cloudflare issuer supports API + token authentication., Certificates now include `serverAuth` extended key + usage by default.] + breaking_changes: ['**Vault Kubernetes auth path change:** if you set a custom + Kubernetes Auth Mount Path, you must now specify the full mount path; cert-manager + appends `/login` automatically. Default changed from `kubernetes` to `/v1/auth/kubernetes`.', + 'Order resource fields made immutable; if you have automation that mutates + these fields after creation, it will now fail and must be updated.', '`CertificateRequest.spec.csr` + is now required by schema; any manifests missing it (for CRs you create + directly) will be rejected.'] chart_version: 0.12.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.12.0 - - quay.io/jetstack/cert-manager-controller:v0.12.0 - - quay.io/jetstack/cert-manager-webhook:v0.12.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.12.0', 'quay.io/jetstack/cert-manager-controller:v0.12.0', + 'quay.io/jetstack/cert-manager-webhook:v0.12.0'] - version: 0.11.0 - kube: - - '1.9' + kube: ['1.9'] requirements: [] incompatibilities: [] summary: null chart_version: 0.11.0 - images: - - quay.io/jetstack/cert-manager-cainjector:v0.11.0 - - quay.io/jetstack/cert-manager-controller:v0.11.0 - - quay.io/jetstack/cert-manager-webhook:v0.11.0 + images: ['quay.io/jetstack/cert-manager-cainjector:v0.11.0', 'quay.io/jetstack/cert-manager-controller:v0.11.0', + 'quay.io/jetstack/cert-manager-webhook:v0.11.0'] name: cert-manager - icon: https://avatars.githubusercontent.com/u/21054566?s=48&v=4 release_url: https://github.com/cilium/cilium/releases/tag/v{vsn} @@ -15271,10 +12871,7 @@ addons: eolApiSlug: cilium versions: - version: 1.20.1 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -15286,82 +12883,67 @@ addons: \ old behavior):**\n - Envoy route idle timeout behavior is restored to use\ \ `http-idle-timeout` as the source again; if you had workarounds/tuning around\ \ idle timeouts, re-validate after upgrade." - chart_updates: - - ClusterMesh documentation and guidance is updated/overhauled (Helm-first setup - and cert configuration instructions). - - Fix for ClusterMesh MCS-API CRD install/upgrade race when `clustermesh-apiserver` - starts before the CRD version is present. - - 'Helm templating fix so `envoy.httpUpstreamLingerTimeout: 0` is rendered into - the ConfigMap.' - - Helm support added to pass through `endpointPolicyUpdateTimeoutDuration`. - features: - - ClusterMesh documentation is substantially improved with Helm-first setup - and clearer certificate configuration guidance. - - Faster recovery for disrupted TCP connections when accessing DSR-enabled Services - (improves resiliency/perceived reliability). + chart_updates: [ClusterMesh documentation and guidance is updated/overhauled + (Helm-first setup and cert configuration instructions)., Fix for ClusterMesh + MCS-API CRD install/upgrade race when `clustermesh-apiserver` starts before + the CRD version is present., 'Helm templating fix so `envoy.httpUpstreamLingerTimeout: + 0` is rendered into the ConfigMap.', Helm support added to pass through + `endpointPolicyUpdateTimeoutDuration`.] + features: [ClusterMesh documentation is substantially improved with Helm-first + setup and clearer certificate configuration guidance., Faster recovery for + disrupted TCP connections when accessing DSR-enabled Services (improves + resiliency/perceived reliability).] breaking_changes: [] chart_version: 1.20.1 images: [] - version: 1.20.0 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Gateway API updates: moves to Gateway API v1.6.1 with new/expanded capabilities - including ListenerSets (delegated listeners), BackendTLSPolicy, TCPRoute/UDPRoute, - ExternalAuth filter, CORS and additional redirect codes, and configurable - gRPC-web translation.' - - Extensible datapath via datapath plugins for cloud providers to extend/instrument - eBPF datapath without forking Cilium. - - '`bpf.datapathMode=auto` can automatically select netkit on supported kernels - and fall back to veth (default remains veth).' - - 'Egress Gateway improvements: explicit IPv6 egress IP support and IPv4 traffic - honors policy-selected interface like IPv6.' - - 'BGP improvements: new Hive shell commands and clearer peer output; control - plane updates to GoBGP v4.6.1 with route-policy reconciliation optimizations.' - - 'IPAM enhancements: AWS ENI IPAM supports IPv6 prefixes (beta); migration - path from cluster-pool IPAM to multi-pool IPAM without rebuild.' - - NodePort can dynamically select preferred source address using kernel FIB - on supported kernels. - - New `preferIpv6` option applies consistently to health probes and Hubble peer - communication. - - 'Service/ClusterMesh features: topology-aware traffic distribution hints (PreferSameZone/PreferSameNode), - weighted Maglev backends via EndpointSlice annotation, more VXLAN per-Service - LB mode options, and stable MCS API support.' - - 'Security/encryption: improved ztunnel identity management (internal CA or - SPIRE) with new metrics; support for Kubernetes ClusterNetworkPolicy (KCNP); - ICMPv6 unreachable responses on IPv6 policy denies; new `cluster-mesh` policy - entity; AWS VPC group policies transformed into CiliumCIDRGroup; per-pod source - IP verification control via annotation guarded by namespace opt-in.' - - 'Day-2/observability: configuration drift metric (unapplied ConfigMap settings), - startup time/resource-sync metrics, Hubble correlates policy responsible for - audit verdicts, standalone DNS proxy metrics exported through Cilium.' - - 'Performance/scale: aggregated load-balancer state for shared backends, more - efficient Envoy updates via ADS/Delta xDS, optimized BPF policy map encoding, - and significantly smaller cilium-cni binary.' - - 'Updated foundations: Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, - MCS API v0.5.2, Ubuntu 26.04 base images, and default CNI config version from - 0.3.1 to 1.0.0.' - breaking_changes: - - Upgrade may require manual action if you use legacy Mutual Authentication, - Envoy Go extensions, Kafka-aware policies, `cilium.io/v2alpha1` CiliumNodeConfig - API, the libnetwork integration, or a custom CNI configuration (see Cilium - 1.20 upgrade guide). - - Default CNI configuration version changes from 0.3.1 to 1.0.0, which can affect - clusters using custom CNI config management or validating CNI config schema/format. + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Gateway API updates: moves to Gateway API v1.6.1 with new/expanded + capabilities including ListenerSets (delegated listeners), BackendTLSPolicy, + TCPRoute/UDPRoute, ExternalAuth filter, CORS and additional redirect codes, + and configurable gRPC-web translation.', Extensible datapath via datapath + plugins for cloud providers to extend/instrument eBPF datapath without forking + Cilium., '`bpf.datapathMode=auto` can automatically select netkit on supported + kernels and fall back to veth (default remains veth).', 'Egress Gateway + improvements: explicit IPv6 egress IP support and IPv4 traffic honors policy-selected + interface like IPv6.', 'BGP improvements: new Hive shell commands and clearer + peer output; control plane updates to GoBGP v4.6.1 with route-policy reconciliation + optimizations.', 'IPAM enhancements: AWS ENI IPAM supports IPv6 prefixes + (beta); migration path from cluster-pool IPAM to multi-pool IPAM without + rebuild.', NodePort can dynamically select preferred source address using + kernel FIB on supported kernels., New `preferIpv6` option applies consistently + to health probes and Hubble peer communication., 'Service/ClusterMesh features: + topology-aware traffic distribution hints (PreferSameZone/PreferSameNode), + weighted Maglev backends via EndpointSlice annotation, more VXLAN per-Service + LB mode options, and stable MCS API support.', 'Security/encryption: improved + ztunnel identity management (internal CA or SPIRE) with new metrics; support + for Kubernetes ClusterNetworkPolicy (KCNP); ICMPv6 unreachable responses + on IPv6 policy denies; new `cluster-mesh` policy entity; AWS VPC group policies + transformed into CiliumCIDRGroup; per-pod source IP verification control + via annotation guarded by namespace opt-in.', 'Day-2/observability: configuration + drift metric (unapplied ConfigMap settings), startup time/resource-sync + metrics, Hubble correlates policy responsible for audit verdicts, standalone + DNS proxy metrics exported through Cilium.', 'Performance/scale: aggregated + load-balancer state for shared backends, more efficient Envoy updates via + ADS/Delta xDS, optimized BPF policy map encoding, and significantly smaller + cilium-cni binary.', 'Updated foundations: Kubernetes v1.36, Envoy v1.37.x, + Gateway API v1.6.1, MCS API v0.5.2, Ubuntu 26.04 base images, and default + CNI config version from 0.3.1 to 1.0.0.'] + breaking_changes: ['Upgrade may require manual action if you use legacy Mutual + Authentication, Envoy Go extensions, Kafka-aware policies, `cilium.io/v2alpha1` + CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration + (see Cilium 1.20 upgrade guide).', 'Default CNI configuration version changes + from 0.3.1 to 1.0.0, which can affect clusters using custom CNI config management + or validating CNI config schema/format.'] chart_version: 1.20.0 images: [] - version: 1.19.4 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -15378,88 +12960,72 @@ addons: - **Helm chart enhancement**: You can now **override external images** used by the charts (useful for private registries / air-gapped installs).' - chart_updates: - - Cilium Agent and service reflectors now filter `EndpointSlice` watches by - the `service.kubernetes.io/service-proxy-name` label when `--k8s-service-proxy-name` - is configured, aligning `EndpointSlice` and `Service` filtering behavior. - - Chart now avoids setting the operator health port as `hostPort` unless `hostNetwork` - is enabled. - - Chart allows overriding external images referenced by the Helm charts (helps - with mirroring images). - features: - - EndpointSlice watch filtering now matches Service filtering when `k8s-service-proxy-name` - is used; this reduces unnecessary watch traffic but requires correct labeling - on manually managed EndpointSlices. - - iptables masquerading with `enable-masquerade-to-route-source` now sorts routes - by mask length to respect longest-prefix match (more correct source selection). - - SPIRE client settings for ztunnel can now be configured (better flexibility - for service-mesh-style deployments). - breaking_changes: - - 'Behavioral change when `k8s-service-proxy-name` is set: EndpointSlices missing - `service.kubernetes.io/service-proxy-name` may be ignored, which can break - Services backed by manually created EndpointSlices.' - - If you depended on the operator health port being exposed via `hostPort` while - `hostNetwork` was disabled, that exposure no longer happens by default in - this chart version. + chart_updates: ['Cilium Agent and service reflectors now filter `EndpointSlice` + watches by the `service.kubernetes.io/service-proxy-name` label when `--k8s-service-proxy-name` + is configured, aligning `EndpointSlice` and `Service` filtering behavior.', + Chart now avoids setting the operator health port as `hostPort` unless `hostNetwork` + is enabled., Chart allows overriding external images referenced by the Helm + charts (helps with mirroring images).] + features: [EndpointSlice watch filtering now matches Service filtering when + `k8s-service-proxy-name` is used; this reduces unnecessary watch traffic + but requires correct labeling on manually managed EndpointSlices., iptables + masquerading with `enable-masquerade-to-route-source` now sorts routes by + mask length to respect longest-prefix match (more correct source selection)., + SPIRE client settings for ztunnel can now be configured (better flexibility + for service-mesh-style deployments).] + breaking_changes: ['Behavioral change when `k8s-service-proxy-name` is set: + EndpointSlices missing `service.kubernetes.io/service-proxy-name` may be + ignored, which can break Services backed by manually created EndpointSlices.', + 'If you depended on the operator health port being exposed via `hostPort` + while `hostNetwork` was disabled, that exposure no longer happens by default + in this chart version.'] chart_version: 1.19.4 images: [] - version: 1.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm charts are now published to OCI registries, including `quay.io/cilium/charts/cilium` - (in addition to prior distribution methods). - - Cilium CLI/Helm preflight no longer includes Envoy ConfigMaps, which may change - what preflight validates in upgrades. - features: - - Helm charts are available via OCI registry (`quay.io/cilium/charts/cilium`), - aligning with the 1.18.6 change to publish charts to OCI registries. - - 'NetworkPolicy enhancements: multi-level DNS wildcard prefixes (`**.`), new - host firewall protocol matches (VRRP/IGMP), optional ICMP unreachable on denies, - and defaulting unspecified cluster selectors to local cluster only.' - - 'Encryption additions: strict modes for IPsec/WireGuard (drop unencrypted - inter-node traffic), Ztunnel namespace enrollment (beta) for transparent TCP - encryption/authentication, and IPsec support for BPF host routing.' - - 'Networking improvements: BIG TCP over UDP tunnels (VXLAN/Geneve), TCP-based - PLPMTUD, IPv6 tunnel underlay, Multi-Pool IPAM promoted to Stable and extended - to more modes, and more configurable masquerade (exclude IPAM pools, cross-subnet - options).' - - 'Services/Gateway: IPv6 ND advertisements for L2 announcements, IPv6 service - loopback, and Gateway API GAMMA support for GRPCRoute plus HTTPRoute.' - - 'BGP updates: new interface-based advertisements, optional withdraw of routes - with 0 endpoints, configurable source IP via `sourceInterface`, and migration - to v2 APIs.' - - 'Observability: trace packets using IP Options, hubble CLI filters for encrypted/unencrypted - flows, and policy-name tagging for drop events.' - - 'Operations: TLS/mTLS for operator Prometheus metrics, auto-install MCS CRDs, - and streamlined cert generation for Cluster Mesh/Hubble; core deps updated - (Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, GoBGP v3.37).' - breaking_changes: - - 'BGP: `CiliumBGPPeeringPolicy` v1 API support is removed; manifests must be - migrated to the v2 (`cilium.io/v2`) APIs.' - - 'NetworkPolicy behavior change: selectors that do not explicitly specify a - cluster now default to allow only the local cluster, which can reduce previously-allowed - cross-cluster traffic in Cluster Mesh setups.' - - 'NetworkPolicy deprecations: Kafka protocol match fields (beta) and `ToRequires`/`FromRequires` - fields are deprecated; plan to remove/replace usage before they are dropped - in a future release.' - - Mutual Authentication is now disabled by default; environments relying on - it for mTLS must explicitly re-enable it or migrate to Ztunnel. - - Encryption strict mode (if enabled) will drop unencrypted inter-node traffic; - ensure all nodes are correctly enrolled/compatible before turning it on. + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Helm charts are now published to OCI registries, including + `quay.io/cilium/charts/cilium` (in addition to prior distribution methods).', + 'Cilium CLI/Helm preflight no longer includes Envoy ConfigMaps, which may + change what preflight validates in upgrades.'] + features: ['Helm charts are available via OCI registry (`quay.io/cilium/charts/cilium`), + aligning with the 1.18.6 change to publish charts to OCI registries.', 'NetworkPolicy + enhancements: multi-level DNS wildcard prefixes (`**.`), new host firewall + protocol matches (VRRP/IGMP), optional ICMP unreachable on denies, and defaulting + unspecified cluster selectors to local cluster only.', 'Encryption additions: + strict modes for IPsec/WireGuard (drop unencrypted inter-node traffic), + Ztunnel namespace enrollment (beta) for transparent TCP encryption/authentication, + and IPsec support for BPF host routing.', 'Networking improvements: BIG + TCP over UDP tunnels (VXLAN/Geneve), TCP-based PLPMTUD, IPv6 tunnel underlay, + Multi-Pool IPAM promoted to Stable and extended to more modes, and more + configurable masquerade (exclude IPAM pools, cross-subnet options).', 'Services/Gateway: + IPv6 ND advertisements for L2 announcements, IPv6 service loopback, and + Gateway API GAMMA support for GRPCRoute plus HTTPRoute.', 'BGP updates: + new interface-based advertisements, optional withdraw of routes with 0 endpoints, + configurable source IP via `sourceInterface`, and migration to v2 APIs.', + 'Observability: trace packets using IP Options, hubble CLI filters for encrypted/unencrypted + flows, and policy-name tagging for drop events.', 'Operations: TLS/mTLS + for operator Prometheus metrics, auto-install MCS CRDs, and streamlined + cert generation for Cluster Mesh/Hubble; core deps updated (Kubernetes v1.35, + Envoy v1.35, Gateway API v1.4, GoBGP v3.37).'] + breaking_changes: ['BGP: `CiliumBGPPeeringPolicy` v1 API support is removed; + manifests must be migrated to the v2 (`cilium.io/v2`) APIs.', 'NetworkPolicy + behavior change: selectors that do not explicitly specify a cluster now + default to allow only the local cluster, which can reduce previously-allowed + cross-cluster traffic in Cluster Mesh setups.', 'NetworkPolicy deprecations: + Kafka protocol match fields (beta) and `ToRequires`/`FromRequires` fields + are deprecated; plan to remove/replace usage before they are dropped in + a future release.', Mutual Authentication is now disabled by default; environments + relying on it for mTLS must explicitly re-enable it or migrate to Ztunnel., + Encryption strict mode (if enabled) will drop unencrypted inter-node traffic; + ensure all nodes are correctly enrolled/compatible before turning it on.] chart_version: 1.19.0 images: [] - version: 1.18.10 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -15472,63 +13038,50 @@ addons: \ distribution method.\n- No explicit value renames/removals are mentioned\ \ in the provided notes; treat this as a patch upgrade and focus on image/tag/digest\ \ updates and any new optional knobs around external images." - chart_updates: - - 'Helm chart enhancement: allow overriding of external images in charts (useful - for air-gapped / private-registry environments).' - - 'Operational/documentation update: added documentation and warnings on DNS - interception (review if you use DNS proxy/interception features).' - - Various dependency and base-image updates; image digests updated for the patch - release (ensure your deployment uses the intended v1.18.10 images/digests). - features: - - Helm chart can now override external/ancillary images, improving compatibility - with private registries and image allowlists. - - Additional documentation/warnings around DNS interception to reduce misconfiguration - risk. + chart_updates: ['Helm chart enhancement: allow overriding of external images + in charts (useful for air-gapped / private-registry environments).', 'Operational/documentation + update: added documentation and warnings on DNS interception (review if + you use DNS proxy/interception features).', Various dependency and base-image + updates; image digests updated for the patch release (ensure your deployment + uses the intended v1.18.10 images/digests).] + features: ['Helm chart can now override external/ancillary images, improving + compatibility with private registries and image allowlists.', Additional + documentation/warnings around DNS interception to reduce misconfiguration + risk.] breaking_changes: [] chart_version: 1.18.10 - images: - - quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3 - - quay.io/cilium/cilium:v1.18.10@sha256:dd573bc2f7213dbd978e564a363ecaad060e9578ed557b92b53e42eeeb0f2294 - - quay.io/cilium/operator-generic:v1.18.10@sha256:ab08d58fd12e98d9a9601d4b52beee839ff2537fba73d262aabad222454a16b3 + images: ['quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3', + 'quay.io/cilium/cilium:v1.18.10@sha256:dd573bc2f7213dbd978e564a363ecaad060e9578ed557b92b53e42eeeb0f2294', + 'quay.io/cilium/operator-generic:v1.18.10@sha256:ab08d58fd12e98d9a9601d4b52beee839ff2537fba73d262aabad222454a16b3'] - version: 1.18.6 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm charts are now published to OCI registries (in addition to existing distribution - methods). - - Preflight check no longer includes Envoy ConfigMaps, simplifying running preflight - in clusters where Envoy configmaps caused issues/false positives. - - Runtime image now includes `libatomic1` to satisfy a `cilium-envoy` dependency. - - Operator Secret sync now re-synchronizes synced Secrets after 1 hour (periodic - resync behavior). - - Fixes a regression in the new services control plane where `loadBalancerSourceRanges` - was incorrectly applied by default to all Service types. - - 'WireGuard + L7 proxy: installs ingress proxy routes correctly; and delivers - host packets to `bpf_host` for ingress policies.' - features: - - Helm charts can be consumed from OCI registries, enabling standard `helm pull - oci://...` workflows and easier mirroring in private registries. - - CiliumNetworkPolicy `egressDeny` has added documentation/examples (policy - authoring aid, not a functional breaking change by itself). - - Hubble BPF supports policy verdicts from L3 devices (improves visibility in - certain L3 device paths). + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm charts are now published to OCI registries (in addition + to existing distribution methods)., 'Preflight check no longer includes + Envoy ConfigMaps, simplifying running preflight in clusters where Envoy + configmaps caused issues/false positives.', Runtime image now includes `libatomic1` + to satisfy a `cilium-envoy` dependency., Operator Secret sync now re-synchronizes + synced Secrets after 1 hour (periodic resync behavior)., Fixes a regression + in the new services control plane where `loadBalancerSourceRanges` was incorrectly + applied by default to all Service types., 'WireGuard + L7 proxy: installs + ingress proxy routes correctly; and delivers host packets to `bpf_host` + for ingress policies.'] + features: ['Helm charts can be consumed from OCI registries, enabling standard + `helm pull oci://...` workflows and easier mirroring in private registries.', + 'CiliumNetworkPolicy `egressDeny` has added documentation/examples (policy + authoring aid, not a functional breaking change by itself).', Hubble BPF + supports policy verdicts from L3 devices (improves visibility in certain + L3 device paths).] breaking_changes: [] chart_version: 1.18.6 - images: - - quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86 - - quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4 - - quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af + images: ['quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86', + 'quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4', + 'quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af'] - version: 1.18.2 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -15545,96 +13098,76 @@ addons: chart/packaging). ' - chart_updates: - - Cilium Operator includes an additional toleration for `node.cloudprovider.kubernetes.io/uninitialized` - (improves scheduling during cloud-provider init). - - 'API-server load reduction: unnecessary headless Service watching is disabled - when not using Gateway API/Ingress features (behavioral change aimed at reducing - apiserver load).' - - 'LB IPAM stability improvements: operator restart or pool selector/CIDR widening - no longer triggers LoadBalancer IP reallocations.' - - 'Envoy behavior: listeners are served only after clusters have been ACKed - (helps avoid transient traffic failures during xDS convergence).' - features: - - 'BGP Control Plane v2: configurable BGP **origin attribute** for LoadBalancer - IPs to ease migration from MetalLB integration.' - - 'Operational efficiency: reduced kube-apiserver watch load in clusters not - using Gateway API/Ingress by avoiding unnecessary headless service watching.' - breaking_changes: - - 'Policy validation is stricter: namespaced `CiliumNetworkPolicy` objects with - `nodeSelector` inside a `specs[]` entry are now **rejected** (previously accepted - but ignored). This can break installs that unknowingly relied on the old behavior; - fix policies before/with the upgrade.' + chart_updates: [Cilium Operator includes an additional toleration for `node.cloudprovider.kubernetes.io/uninitialized` + (improves scheduling during cloud-provider init)., 'API-server load reduction: + unnecessary headless Service watching is disabled when not using Gateway + API/Ingress features (behavioral change aimed at reducing apiserver load).', + 'LB IPAM stability improvements: operator restart or pool selector/CIDR widening + no longer triggers LoadBalancer IP reallocations.', 'Envoy behavior: listeners + are served only after clusters have been ACKed (helps avoid transient traffic + failures during xDS convergence).'] + features: ['BGP Control Plane v2: configurable BGP **origin attribute** for + LoadBalancer IPs to ease migration from MetalLB integration.', 'Operational + efficiency: reduced kube-apiserver watch load in clusters not using Gateway + API/Ingress by avoiding unnecessary headless service watching.'] + breaking_changes: ['Policy validation is stricter: namespaced `CiliumNetworkPolicy` + objects with `nodeSelector` inside a `specs[]` entry are now **rejected** + (previously accepted but ignored). This can break installs that unknowingly + relied on the old behavior; fix policies before/with the upgrade.'] chart_version: 1.18.2 - images: - - quay.io/cilium/cilium-envoy:v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324@sha256:7932d656b63f6f866b6732099d33355184322123cfe1182e6f05175a3bc2e0e0 - - quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667 - - quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805 + images: ['quay.io/cilium/cilium-envoy:v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324@sha256:7932d656b63f6f866b6732099d33355184322123cfe1182e6f05175a3bc2e0e0', + 'quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667', + 'quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805'] - version: 1.18.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Service load-balancing control-plane redesigned to reduce agent memory usage - and provide a better foundation for future load-balancing features. - - "Support added for new virtual network device configurations (e.g., VXLAN-in-IPsec\ - \ \u201CVinE\u201D and IPIP tunnels)." - - Egress Gateway policies can now select multiple gateway nodes for a single - policy, enabling HA/scale-out egress. - - Bandwidth manager adds ingress rate limiting support. - - L2 pod announcement can announce from multiple network devices. - - Neighbor subsystem reworked with reconciliation between desired neighbor entries - and kernel state to improve resilience. - - IPv6 tunneling datapath supports IPv6 underlay, including with IPsec transparent - encryption; kube-proxy replacement also supports IPv6 underlay service translation. - - Delegated IPAM can configure IPv6 routes when the delegated plugin supports - IPv6; ordered IPv6 fragments are now processed for policy/routing; egress - gateway CIDR matching supports IPv6 ranges. - - 'Hubble/hubble-cli improvements: policy names shown in flows, a new free-text - policy log field is exposed in flows, and encapsulated traffic decoding improves - observability.' - - ClusterMesh adds an option to restrict the "cluster" entity to the local cluster - only; Grafana policy dashboards improved. - - Operational improvements include better kube-apiserver connection handling - at scale and optional ConfigMap sync into the agent with drift metrics. - - 'Several CRDs promoted to stable: CiliumCIDRGroup, CiliumLoadBalancerIPPool, - and all BGP CRDs; Gateway API support bumped to v1.3.0 with new CiliumGatewayClassConfig - and improved reconciliation.' - - IPAM enhancements include AWS ENI prefix delegation on bare metal and multi-pool - IPAM support in external KVStore mode and with IPsec/tunnel routing. - - BGP enhancements include route aggregation, overlapping selector matches in - CiliumBGPAdvertisement, and new router-id generation modes. - - Performance improvements include faster policy/service processing at scale, - smaller arm64 images, optimized egress gateway matching, and batched CT map - GC. - breaking_changes: - - Minimum supported Linux kernel for the 1.18 release series is now 5.10 (or - equivalent, e.g., RHEL 8.6); clusters with older kernels must upgrade nodes - before upgrading Cilium. - - The local unix-socket Policy REST API is deprecated; prefer Kubernetes CRDs - or filesystem-based policy mechanisms going forward. - - Some underused features are deprecated (Custom Calls, Recorder API, External - Workloads); if you rely on them, plan migration before they are removed in - a future release. - - Cilium dependencies were updated (Kubernetes v1.33, Envoy v1.34, LLVM 19.1, - CNI v1.1), which can surface compatibility constraints with older clusters - or custom integrations. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Service load-balancing control-plane redesigned to reduce agent memory + usage and provide a better foundation for future load-balancing features., + "Support added for new virtual network device configurations (e.g., VXLAN-in-IPsec\ + \ \u201CVinE\u201D and IPIP tunnels).", 'Egress Gateway policies can now + select multiple gateway nodes for a single policy, enabling HA/scale-out + egress.', Bandwidth manager adds ingress rate limiting support., L2 pod + announcement can announce from multiple network devices., Neighbor subsystem + reworked with reconciliation between desired neighbor entries and kernel + state to improve resilience., 'IPv6 tunneling datapath supports IPv6 underlay, + including with IPsec transparent encryption; kube-proxy replacement also + supports IPv6 underlay service translation.', Delegated IPAM can configure + IPv6 routes when the delegated plugin supports IPv6; ordered IPv6 fragments + are now processed for policy/routing; egress gateway CIDR matching supports + IPv6 ranges., 'Hubble/hubble-cli improvements: policy names shown in flows, + a new free-text policy log field is exposed in flows, and encapsulated traffic + decoding improves observability.', ClusterMesh adds an option to restrict + the "cluster" entity to the local cluster only; Grafana policy dashboards + improved., Operational improvements include better kube-apiserver connection + handling at scale and optional ConfigMap sync into the agent with drift + metrics., 'Several CRDs promoted to stable: CiliumCIDRGroup, CiliumLoadBalancerIPPool, + and all BGP CRDs; Gateway API support bumped to v1.3.0 with new CiliumGatewayClassConfig + and improved reconciliation.', IPAM enhancements include AWS ENI prefix + delegation on bare metal and multi-pool IPAM support in external KVStore + mode and with IPsec/tunnel routing., 'BGP enhancements include route aggregation, + overlapping selector matches in CiliumBGPAdvertisement, and new router-id + generation modes.', 'Performance improvements include faster policy/service + processing at scale, smaller arm64 images, optimized egress gateway matching, + and batched CT map GC.'] + breaking_changes: ['Minimum supported Linux kernel for the 1.18 release series + is now 5.10 (or equivalent, e.g., RHEL 8.6); clusters with older kernels + must upgrade nodes before upgrading Cilium.', The local unix-socket Policy + REST API is deprecated; prefer Kubernetes CRDs or filesystem-based policy + mechanisms going forward., 'Some underused features are deprecated (Custom + Calls, Recorder API, External Workloads); if you rely on them, plan migration + before they are removed in a future release.', 'Cilium dependencies were + updated (Kubernetes v1.33, Envoy v1.34, LLVM 19.1, CNI v1.1), which can + surface compatibility constraints with older clusters or custom integrations.'] chart_version: 1.18.0 - images: - - quay.io/cilium/cilium-envoy:v1.34.4-1753677767-266d5a01d1d55bd1d60148f991b98dac0390d363@sha256:231b5bd9682dfc648ae97f33dcdc5225c5a526194dda08124f5eded833bf02bf - - quay.io/cilium/cilium:v1.18.0@sha256:dfea023972d06ec183cfa3c9e7809716f85daaff042e573ef366e9ec6a0c0ab2 - - quay.io/cilium/operator-generic:v1.18.0@sha256:398378b4507b6e9db22be2f4455d8f8e509b189470061b0f813f0fabaf944f51 + images: ['quay.io/cilium/cilium-envoy:v1.34.4-1753677767-266d5a01d1d55bd1d60148f991b98dac0390d363@sha256:231b5bd9682dfc648ae97f33dcdc5225c5a526194dda08124f5eded833bf02bf', + 'quay.io/cilium/cilium:v1.18.0@sha256:dfea023972d06ec183cfa3c9e7809716f85daaff042e573ef366e9ec6a0c0ab2', + 'quay.io/cilium/operator-generic:v1.18.0@sha256:398378b4507b6e9db22be2f4455d8f8e509b189470061b0f813f0fabaf944f51'] - version: 1.17.16 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -15648,73 +13181,57 @@ addons: \ registries / air-gapped setups). If you currently pin/override images, review\ \ chart values for new/expanded image override options (introduced via `helm:\ \ allow overriding of external images in charts`)." - chart_updates: - - Security hardening/behavior fix around LRP addressMatcher to avoid overriding - Service frontends by default (opt-in legacy override flag available). - - 'IPsec robustness: prevent panic in `parseSPI` on malformed input.' - - 'Cluster-pool IPAM: register additional metrics for CiliumNode synchronization - with Kubernetes.' - - 'Static pod identity: fix endpoint identity resolution when CNI pod UID differs - from Kubernetes mirror pod UID.' - - 'Dependency updates: OpenTelemetry to 1.41.0; x/net to v0.53; various base - image and action dependency bumps; envoy image updates.' - - 'CI/build plumbing: registry configurability, workflow runner tweaks, cert-manager - pull via OCI for clustermesh CI.' - - 'Release artifact refresh: updated image digests across Cilium components - (agent, operator variants, hubble-relay, clustermesh-apiserver, etc.).' - features: - - "Helm chart can publish/use OCI registries (not new to 1.17.16 but relevant\ - \ since you\u2019re coming from 1.17.12 which introduced it)." - - Helm chart now allows overriding of external images, improving support for - private registries and controlled supply chains. - - New/expanded cluster-pool IPAM metrics around CiliumNode sync help with observability - of IPAM state propagation. - breaking_changes: - - Local Redirect Policy (LRP) addressMatcher no longer overrides an existing - Service frontend by default. Environments that depended on that override behavior - must explicitly enable it via `--enable-lrp-address-matcher-override=true` - (otherwise traffic steering may change). + chart_updates: [Security hardening/behavior fix around LRP addressMatcher to + avoid overriding Service frontends by default (opt-in legacy override flag + available)., 'IPsec robustness: prevent panic in `parseSPI` on malformed + input.', 'Cluster-pool IPAM: register additional metrics for CiliumNode + synchronization with Kubernetes.', 'Static pod identity: fix endpoint identity + resolution when CNI pod UID differs from Kubernetes mirror pod UID.', 'Dependency + updates: OpenTelemetry to 1.41.0; x/net to v0.53; various base image and + action dependency bumps; envoy image updates.', 'CI/build plumbing: registry + configurability, workflow runner tweaks, cert-manager pull via OCI for clustermesh + CI.', 'Release artifact refresh: updated image digests across Cilium components + (agent, operator variants, hubble-relay, clustermesh-apiserver, etc.).'] + features: ["Helm chart can publish/use OCI registries (not new to 1.17.16 but\ + \ relevant since you\u2019re coming from 1.17.12 which introduced it).", + 'Helm chart now allows overriding of external images, improving support for + private registries and controlled supply chains.', New/expanded cluster-pool + IPAM metrics around CiliumNode sync help with observability of IPAM state + propagation.] + breaking_changes: [Local Redirect Policy (LRP) addressMatcher no longer overrides + an existing Service frontend by default. Environments that depended on that + override behavior must explicitly enable it via `--enable-lrp-address-matcher-override=true` + (otherwise traffic steering may change).] chart_version: 1.17.16 - images: - - quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3 - - quay.io/cilium/cilium:v1.17.16@sha256:4efb37b791561bc5a2c6d746bdd6f52a9c393623d2426e8c0877cc389610477c - - quay.io/cilium/operator-generic:v1.17.16@sha256:42955931dd62c9c2ea906d78eed0b651b22e70d59cd4877381f57bb98e4a09ae + images: ['quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3', + 'quay.io/cilium/cilium:v1.17.16@sha256:4efb37b791561bc5a2c6d746bdd6f52a9c393623d2426e8c0877cc389610477c', + 'quay.io/cilium/operator-generic:v1.17.16@sha256:42955931dd62c9c2ea906d78eed0b651b22e70d59cd4877381f57bb98e4a09ae'] eolAt: '2026-07-29' - version: 1.17.12 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Helm charts are now published to OCI registries; release process/registry\ - \ details changed (also noted as \u201Crelease: change OCI registry\u201D\ - )." - - Image digests and dependent component images updated as part of patch releases. - features: - - Helm charts are now published to OCI registries (may require changing how - you fetch/install the chart if you previously used the Helm repo URL). - - Documentation/examples added for using the `egressDeny` field in `CiliumNetworkPolicy`. - - BPF Hubble gains support for policy verdicts from L3 devices (noted under - other changes). - - CNI plugins dependency bumped to v1.9.0 (internal/packaged dependency update). - - 'Route handling: ingress proxy routes are installed when using WireGuard + - L7 proxy (behavioral improvement).' + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Helm charts are now published to OCI registries; release process/registry\ + \ details changed (also noted as \u201Crelease: change OCI registry\u201D\ + ).", Image digests and dependent component images updated as part of patch + releases.] + features: [Helm charts are now published to OCI registries (may require changing + how you fetch/install the chart if you previously used the Helm repo URL)., + Documentation/examples added for using the `egressDeny` field in `CiliumNetworkPolicy`., + BPF Hubble gains support for policy verdicts from L3 devices (noted under + other changes)., CNI plugins dependency bumped to v1.9.0 (internal/packaged + dependency update)., 'Route handling: ingress proxy routes are installed + when using WireGuard + L7 proxy (behavioral improvement).'] breaking_changes: [] chart_version: 1.17.12 - images: - - quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f - - quay.io/cilium/cilium:v1.17.12@sha256:f525e12698149b3958024599493d9cc56fadbc46c9250cbced8016e9b9b679e5 - - quay.io/cilium/operator-generic:v1.17.12@sha256:0b675406b1e43b198962d4f9c3a5ba6bb68fc98836cba05b224860109112f6d9 + images: ['quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f', + 'quay.io/cilium/cilium:v1.17.12@sha256:f525e12698149b3958024599493d9cc56fadbc46c9250cbced8016e9b9b679e5', + 'quay.io/cilium/operator-generic:v1.17.12@sha256:0b675406b1e43b198962d4f9c3a5ba6bb68fc98836cba05b224860109112f6d9'] eolAt: '2026-07-29' - version: 1.17.8 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -15728,44 +13245,35 @@ addons: - **Packaging/templating:** v1.17.8 includes support for downstream packagers\ \ to **extend `cilium-agent` `dnsPolicy`**. This is primarily relevant if\ \ you vendor/patch the chart; most users won\u2019t change values for this." - chart_updates: - - 'Cilium Agent liveness probe behavior changed: it no longer fails solely due - to Kubernetes API server unreachability (helps avoid agent restarts during - apiserver downtime).' - - 'Gateway API robustness: reconciler handles missing TLSRoute CRD more gracefully - and fixes parentRef matching logic.' - - 'Envoy/xDS reliability: fixes cases where updated resources were not sent - to Envoy; in v1.17.8, Envoy starts serving listeners only after clusters are - ACKed (reduces race conditions on rollout).' - - 'Kernel compatibility: fix for pre-v5.7 kernels where LocalRedirectPolicy - could trigger BPF verifier rejection.' - - 'NAT/masquerade robustness: improvements to NAT LRU fallback paths; addresses - flakes and should reduce edge-case failures under pressure.' - - 'Various datapath fixes: NodePort NAT46x64 clash avoidance, ipip MTU fix, - device controller netfilter dependency fix, WireGuard overlay cleanup, IPSec - key derivation hardening, and deadlock/panic fixes around missing IPv4 and - ipset reconciliation.' - - 'Policy correctness: fixes for invalid CNP/CCNP status reporting and an important - fix where L7 rules could override `enableDefaultDeny: false` and incorrectly - drop traffic.' - features: - - Adds new WireGuard observability points (`TRACE_FROM/TO_CRYPTO`) and BPF metrics - for packets to/from WireGuard, improving troubleshooting/monitoring. - - GAMMA (Gateway API for Mesh Management and Administration) reconciler can - now attach multiple HTTPRoutes to the same Service, expanding Gateway API - routing flexibility. + chart_updates: ['Cilium Agent liveness probe behavior changed: it no longer + fails solely due to Kubernetes API server unreachability (helps avoid agent + restarts during apiserver downtime).', 'Gateway API robustness: reconciler + handles missing TLSRoute CRD more gracefully and fixes parentRef matching + logic.', 'Envoy/xDS reliability: fixes cases where updated resources were + not sent to Envoy; in v1.17.8, Envoy starts serving listeners only after + clusters are ACKed (reduces race conditions on rollout).', 'Kernel compatibility: + fix for pre-v5.7 kernels where LocalRedirectPolicy could trigger BPF verifier + rejection.', 'NAT/masquerade robustness: improvements to NAT LRU fallback + paths; addresses flakes and should reduce edge-case failures under pressure.', + 'Various datapath fixes: NodePort NAT46x64 clash avoidance, ipip MTU fix, + device controller netfilter dependency fix, WireGuard overlay cleanup, IPSec + key derivation hardening, and deadlock/panic fixes around missing IPv4 and + ipset reconciliation.', 'Policy correctness: fixes for invalid CNP/CCNP + status reporting and an important fix where L7 rules could override `enableDefaultDeny: + false` and incorrectly drop traffic.'] + features: ['Adds new WireGuard observability points (`TRACE_FROM/TO_CRYPTO`) + and BPF metrics for packets to/from WireGuard, improving troubleshooting/monitoring.', + 'GAMMA (Gateway API for Mesh Management and Administration) reconciler can + now attach multiple HTTPRoutes to the same Service, expanding Gateway API + routing flexibility.'] breaking_changes: [] chart_version: 1.17.8 - images: - - quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28 - - quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636 - - quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c + images: ['quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28', + 'quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636', + 'quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c'] eolAt: '2026-07-29' - version: 1.17.4 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -15779,88 +13287,69 @@ addons: to 1.17.4 should reduce config collisions. ' - chart_updates: - - Hubble dynamic metrics Helm templating/config conflict fix landed (v1.17.4). - - 'Kafka-related Helm default/value updated: `kafka.apiKey=true` (v1.17.4).' - features: - - (1.17.0) Pod egress QoS via annotations for traffic priority (Guaranteed/Burstable/BestEffort). - - (1.17.0) Kubernetes Multi-Cluster Services (MCS) API support for global services - in ClusterMesh. - - (1.17.0) L4 protocol-based service load balancing (differentiate TCP vs UDP - on same port) plus per-service LB algorithm selection (maglev/random). - - (1.17.0) IPAM enhancements (AWS tag-based static allocation; multi-pool improvements) - and dynamic MTU detection without agent restart. - - '(1.17.0) Observability upgrades: new Hubble metrics ConfigMap workflow and - new Prometheus metrics exposing enabled features.' + chart_updates: [Hubble dynamic metrics Helm templating/config conflict fix landed + (v1.17.4)., 'Kafka-related Helm default/value updated: `kafka.apiKey=true` + (v1.17.4).'] + features: [(1.17.0) Pod egress QoS via annotations for traffic priority (Guaranteed/Burstable/BestEffort)., + (1.17.0) Kubernetes Multi-Cluster Services (MCS) API support for global services + in ClusterMesh., (1.17.0) L4 protocol-based service load balancing (differentiate + TCP vs UDP on same port) plus per-service LB algorithm selection (maglev/random)., + (1.17.0) IPAM enhancements (AWS tag-based static allocation; multi-pool improvements) + and dynamic MTU detection without agent restart., '(1.17.0) Observability + upgrades: new Hubble metrics ConfigMap workflow and new Prometheus metrics + exposing enabled features.'] breaking_changes: [] chart_version: 1.17.4 - images: - - quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182 - - quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a - - quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5 + images: ['quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182', + 'quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a', + 'quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5'] eolAt: '2026-07-29' - version: 1.17.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Quality of Service for egress: pod annotations can set egress priority (Guaranteed/Burstable/BestEffort) - to influence traffic handling.' - - Multi-Cluster Service (MCS) API support for Cluster Mesh to manage global - services across clusters. - - 'L4 protocol-aware load balancing: can distinguish TCP vs UDP (and similar) - on the same port to route to different backends.' - - Per-Service load-balancing algorithm selection (e.g., Maglev vs random) on - a per-service basis. - - LoadBalancer source ranges can be treated as deny lists instead of only allow - lists. - - 'Improved IPAM controls: support static allocation via AWS tags and improved - multi-pool handling of single IP ranges.' - - 'Dynamic MTU detection: agent adapts to runtime MTU changes without restart.' - - Network policy performance improvements for complex policy combinations, reducing - CPU cost. - - CiliumEndpointSlices can prioritize critical namespaces using Kubernetes priorityNamespaces - to speed endpoint propagation. - - Better NetworkPolicy validation feedback via Kubernetes (more/better validation). - - CIDRGroups can be labeled and selected by label in network policies. - - 'ToServices policy enhancements: services with selectors can be targeted by - ToServices rules.' - - FQDN/L7 filtering for hostNetwork via CiliumClusterwideNetworkPolicy for node-originated - DNS traffic. - - HTTP L7 policies can apply to port ranges (multiple ports redirected to Envoy). - - Gateway API support updated to v1.2.1 including HTTP retries and mirror fractions. - - 'Static gateway addressing: allow statically specifying gateway addresses.' - - Improved Envoy TLS handling via SDS, speeding policy calculation and improving - secrets access for TLS visibility. - - Dynamic Hubble metrics configuration via a hubble-metrics-config ConfigMap. - - New Prometheus metrics exposing which features are enabled in cilium-agent - and cilium-operator; plus many new metrics across BGP, connections, policy, - and component health. - - cilium-health tuned for more reliable high-scale connectivity checks. - - Rate-limited monitor events to balance eBPF event volume vs CPU usage. - - Double-Write Identity mode to ease migration between CRD and KVStore identity - backends. - breaking_changes: - - No explicit breaking changes were included in the provided release-note excerpts; - review the full v1.17.0 CHANGELOG.md for any required config/behavior changes - before upgrading. + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Quality of Service for egress: pod annotations can set egress priority + (Guaranteed/Burstable/BestEffort) to influence traffic handling.', Multi-Cluster + Service (MCS) API support for Cluster Mesh to manage global services across + clusters., 'L4 protocol-aware load balancing: can distinguish TCP vs UDP + (and similar) on the same port to route to different backends.', 'Per-Service + load-balancing algorithm selection (e.g., Maglev vs random) on a per-service + basis.', LoadBalancer source ranges can be treated as deny lists instead + of only allow lists., 'Improved IPAM controls: support static allocation + via AWS tags and improved multi-pool handling of single IP ranges.', 'Dynamic + MTU detection: agent adapts to runtime MTU changes without restart.', 'Network + policy performance improvements for complex policy combinations, reducing + CPU cost.', CiliumEndpointSlices can prioritize critical namespaces using + Kubernetes priorityNamespaces to speed endpoint propagation., Better NetworkPolicy + validation feedback via Kubernetes (more/better validation)., CIDRGroups + can be labeled and selected by label in network policies., 'ToServices policy + enhancements: services with selectors can be targeted by ToServices rules.', + FQDN/L7 filtering for hostNetwork via CiliumClusterwideNetworkPolicy for node-originated + DNS traffic., HTTP L7 policies can apply to port ranges (multiple ports + redirected to Envoy)., Gateway API support updated to v1.2.1 including HTTP + retries and mirror fractions., 'Static gateway addressing: allow statically + specifying gateway addresses.', 'Improved Envoy TLS handling via SDS, speeding + policy calculation and improving secrets access for TLS visibility.', Dynamic + Hubble metrics configuration via a hubble-metrics-config ConfigMap., 'New + Prometheus metrics exposing which features are enabled in cilium-agent and + cilium-operator; plus many new metrics across BGP, connections, policy, + and component health.', cilium-health tuned for more reliable high-scale + connectivity checks., Rate-limited monitor events to balance eBPF event + volume vs CPU usage., Double-Write Identity mode to ease migration between + CRD and KVStore identity backends.] + breaking_changes: [No explicit breaking changes were included in the provided + release-note excerpts; review the full v1.17.0 CHANGELOG.md for any required + config/behavior changes before upgrading.] chart_version: 1.17.0 - images: - - quay.io/cilium/cilium-envoy:v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e@sha256:57a3aa6355a3223da360395e3a109802867ff635cb852aa0afe03ec7bf04e545 - - quay.io/cilium/cilium:v1.17.0@sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d - - quay.io/cilium/operator-generic:v1.17.0@sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8 + images: ['quay.io/cilium/cilium-envoy:v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e@sha256:57a3aa6355a3223da360395e3a109802867ff635cb852aa0afe03ec7bf04e545', + 'quay.io/cilium/cilium:v1.17.0@sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d', + 'quay.io/cilium/operator-generic:v1.17.0@sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8'] eolAt: '2026-07-29' - version: 1.16.19 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: @@ -15870,24 +13359,18 @@ addons: \ install`) depending on your current workflow.\n - Note: the release notes\ \ don\u2019t list specific `values.yaml` key changes between 1.16.15 and 1.16.19;\ \ verify with `helm diff` against your current values." - chart_updates: - - Helm charts are now published to OCI registries (v1.16.19). - features: - - Helm chart publishing to OCI registries (distribution/consumption improvement). - - Documentation/examples added for using `egressDeny` in `CiliumNetworkPolicy`. - - CNI plugins bumped to v1.9.0 (packaged dependency update). + chart_updates: [Helm charts are now published to OCI registries (v1.16.19).] + features: [Helm chart publishing to OCI registries (distribution/consumption + improvement)., Documentation/examples added for using `egressDeny` in `CiliumNetworkPolicy`., + CNI plugins bumped to v1.9.0 (packaged dependency update).] breaking_changes: [] chart_version: 1.16.19 - images: - - quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f - - quay.io/cilium/cilium:v1.16.19@sha256:f0c260e30ef97ce3e45e833e702ab47efbbb1dadd0a394969c0a65553e98fefb - - quay.io/cilium/operator-generic:v1.16.19@sha256:8879e792c5566f6349b5f2865e07c0dd690eb32638afc4417b51b0ec574fa5f0 + images: ['quay.io/cilium/cilium-envoy:v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71@sha256:377175048c79d12c129d29e7a56268e1edaad37c96e649e892465c01bf2b4f8f', + 'quay.io/cilium/cilium:v1.16.19@sha256:f0c260e30ef97ce3e45e833e702ab47efbbb1dadd0a394969c0a65553e98fefb', + 'quay.io/cilium/operator-generic:v1.16.19@sha256:8879e792c5566f6349b5f2865e07c0dd690eb32638afc4417b51b0ec574fa5f0'] eolAt: '2026-02-03' - version: 1.16.15 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -15899,29 +13382,23 @@ addons: \ Kafka L7 policy behavior after the upgrade.\n\n> Note: This summary only\ \ reflects what was included in the text you provided; it does not include\ \ any additional Helm chart changelog entries." - chart_updates: - - v1.16.15 is mostly CI/build/release tooling and dependency churn; no chart-facing - feature changes were highlighted in the provided notes. - - 'v1.16.15 includes an Envoy behavior fix: listeners are served only after - clusters have been ACKed, which can affect L7/LB readiness timing in practice.' - - v1.16.15 fixes a kernel verifier rejection on pre-5.7 kernels when LocalRedirectPolicy - is enabled (stability fix for older kernels). - features: - - Envoy now delays serving listeners until clusters have been ACKed, improving - correctness during (re)configuration and potentially reducing transient L7 - failures during rollout. + chart_updates: [v1.16.15 is mostly CI/build/release tooling and dependency churn; + no chart-facing feature changes were highlighted in the provided notes., + 'v1.16.15 includes an Envoy behavior fix: listeners are served only after + clusters have been ACKed, which can affect L7/LB readiness timing in practice.', + v1.16.15 fixes a kernel verifier rejection on pre-5.7 kernels when LocalRedirectPolicy + is enabled (stability fix for older kernels).] + features: ['Envoy now delays serving listeners until clusters have been ACKed, + improving correctness during (re)configuration and potentially reducing + transient L7 failures during rollout.'] breaking_changes: [] chart_version: 1.16.15 - images: - - quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28 - - quay.io/cilium/cilium:v1.16.15@sha256:c0fa87d70a7ba624fbe581d40a7b7e9e8773a6efd4bb17d0bd14ff854039ec75 - - quay.io/cilium/operator-generic:v1.16.15@sha256:fea37022f858272c27cefe6b4959d45e2ca03d957decbfa210ce35931f346ecd + images: ['quay.io/cilium/cilium-envoy:v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece@sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28', + 'quay.io/cilium/cilium:v1.16.15@sha256:c0fa87d70a7ba624fbe581d40a7b7e9e8773a6efd4bb17d0bd14ff854039ec75', + 'quay.io/cilium/operator-generic:v1.16.15@sha256:fea37022f858272c27cefe6b4959d45e2ca03d957decbfa210ce35931f346ecd'] eolAt: '2026-02-03' - version: 1.16.10 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -15931,29 +13408,23 @@ addons: after upgrade. ' - chart_updates: - - 'Daemon status reporting changed: `cilium status` is now independent of Kubernetes - status (agent/daemon-side behavior change).' - - "Hubble/Helm related robustness: Hubble peer-service endpoint uses an absolute\ - \ FQDN (already present by 1.16.5, but relevant if you\u2019re comparing older\ - \ installs)." - features: - - 'Operational improvement: `cilium status` no longer depends on Kubernetes - status, which can make troubleshooting clearer when the apiserver is degraded.' - - 'Improved policy feedback: invalid CiliumNetworkPolicy / CiliumClusterwideNetworkPolicy - rules are now correctly reported as invalid.' + chart_updates: ['Daemon status reporting changed: `cilium status` is now independent + of Kubernetes status (agent/daemon-side behavior change).', "Hubble/Helm\ + \ related robustness: Hubble peer-service endpoint uses an absolute FQDN\ + \ (already present by 1.16.5, but relevant if you\u2019re comparing older\ + \ installs)."] + features: ['Operational improvement: `cilium status` no longer depends on Kubernetes + status, which can make troubleshooting clearer when the apiserver is degraded.', + 'Improved policy feedback: invalid CiliumNetworkPolicy / CiliumClusterwideNetworkPolicy + rules are now correctly reported as invalid.'] breaking_changes: [] chart_version: 1.16.10 - images: - - quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182 - - quay.io/cilium/cilium:v1.16.10@sha256:fc4ccc494c4a381439162fd3684c07ba9c26d3c2670a2b2e1623acee99097461 - - quay.io/cilium/operator-generic:v1.16.10@sha256:05e5f5e676aa51ae5e3bf6be3594ecf52958f46f07f9f55368a7a952012a13c1 + images: ['quay.io/cilium/cilium-envoy:v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c@sha256:a04218c6879007d60d96339a441c448565b6f86650358652da27582e0efbf182', + 'quay.io/cilium/cilium:v1.16.10@sha256:fc4ccc494c4a381439162fd3684c07ba9c26d3c2670a2b2e1623acee99097461', + 'quay.io/cilium/operator-generic:v1.16.10@sha256:05e5f5e676aa51ae5e3bf6be3594ecf52958f46f07f9f55368a7a952012a13c1'] eolAt: '2026-02-03' - version: 1.16.5 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -15981,41 +13452,33 @@ addons: - **CronJob appArmorProfile template condition fix (1.16.1).** No values change required, but if you use that CronJob + AppArmor, confirm manifests render as expected.' - chart_updates: - - 'Deprecation: Providing Hubble TLS secrets directly in Helm values is deprecated; - update your installation approach accordingly.' - - 'Chart/templating: Added Gateway API required labels/annotations and fixed - internal listener reference qualification (namespace + CEC name).' - - 'Chart options: Added NAT map stats interval/entries configuration fields.' - - 'Chart options: Added imagePullSecrets support for SPIRE agent/server pods.' - - 'Chart behavior: Hubble peer-service endpoint is rendered as an absolute FQDN - to avoid incorrect DNS resolution.' - - 'Templating: Fixed CronJob AppArmor profile condition rendering.' - features: - - Gateway API support gets additional required labels/annotations and better - handling of internal listener references, improving correctness in multi-namespace/CEC - scenarios. - - Optional new tuning knobs were added for NAT map statistics reporting (interval/entries), - useful for observability/performance tuning. - - SPIRE components can now be configured with imagePullSecrets, simplifying - private registry use cases. - breaking_changes: - - Hubble TLS secrets provided directly via Helm values are now deprecated; while - not an immediate hard break, you should migrate before it becomes unsupported - in a future release. - - Hubble no longer builds 32-bit binaries (1.16.5). If you run Hubble components - on 32-bit architectures, this is effectively breaking. + chart_updates: ['Deprecation: Providing Hubble TLS secrets directly in Helm + values is deprecated; update your installation approach accordingly.', 'Chart/templating: + Added Gateway API required labels/annotations and fixed internal listener + reference qualification (namespace + CEC name).', 'Chart options: Added + NAT map stats interval/entries configuration fields.', 'Chart options: Added + imagePullSecrets support for SPIRE agent/server pods.', 'Chart behavior: + Hubble peer-service endpoint is rendered as an absolute FQDN to avoid incorrect + DNS resolution.', 'Templating: Fixed CronJob AppArmor profile condition + rendering.'] + features: ['Gateway API support gets additional required labels/annotations + and better handling of internal listener references, improving correctness + in multi-namespace/CEC scenarios.', 'Optional new tuning knobs were added + for NAT map statistics reporting (interval/entries), useful for observability/performance + tuning.', 'SPIRE components can now be configured with imagePullSecrets, + simplifying private registry use cases.'] + breaking_changes: ['Hubble TLS secrets provided directly via Helm values are + now deprecated; while not an immediate hard break, you should migrate before + it becomes unsupported in a future release.', 'Hubble no longer builds 32-bit + binaries (1.16.5). If you run Hubble components on 32-bit architectures, + this is effectively breaking.'] chart_version: 1.16.5 - images: - - quay.io/cilium/cilium-envoy:v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8@sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced - - quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d - - quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039 + images: ['quay.io/cilium/cilium-envoy:v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8@sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced', + 'quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d', + 'quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039'] eolAt: '2026-02-03' - version: 1.16.1 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -16039,37 +13502,29 @@ addons: \ configurable for agent/server pods** (1.16.1).\n - If you run SPIRE integration\ \ and pull from private registries, you can now set imagePullSecrets for those\ \ pods via Helm values.\n" - chart_updates: - - 'Gateway API manifests: add required labels and annotations (metadata changes).' - - 'Helm templates: fix appArmorProfile conditional in CronJob template.' - - 'Helm: expose NAT map stats interval/entries as configurable values.' - - 'Helm: add support to configure imagePullSecrets for SPIRE agent/server pods.' - - 'Helm/docs: improve Hubble TLS configuration guidance; deprecate value-driven - TLS secret provisioning.' - features: - - 'Security fixes: 1.16.1 addresses two published advisories (GHSA-vwf8-q6fw-4wcm, - GHSA-qcm3-7879-xcww).' - - 'Operational tuning: Helm can now configure NAT map stats interval/entries - for better observability/tuning of NAT map behavior.' - - 'SPIRE integration: chart now supports setting imagePullSecrets for SPIRE - agent/server pods (useful for private registries).' - - 'Gateway API: required labels/annotations added and route sorting now considers - HTTP method conditions for more correct routing behavior.' - breaking_changes: - - 'Deprecation: Providing Hubble TLS secrets via Helm values is deprecated in - 1.16.1; future chart versions may remove this path, so migrate to Kubernetes - Secrets/references now.' + chart_updates: ['Gateway API manifests: add required labels and annotations + (metadata changes).', 'Helm templates: fix appArmorProfile conditional in + CronJob template.', 'Helm: expose NAT map stats interval/entries as configurable + values.', 'Helm: add support to configure imagePullSecrets for SPIRE agent/server + pods.', 'Helm/docs: improve Hubble TLS configuration guidance; deprecate + value-driven TLS secret provisioning.'] + features: ['Security fixes: 1.16.1 addresses two published advisories (GHSA-vwf8-q6fw-4wcm, + GHSA-qcm3-7879-xcww).', 'Operational tuning: Helm can now configure NAT + map stats interval/entries for better observability/tuning of NAT map behavior.', + 'SPIRE integration: chart now supports setting imagePullSecrets for SPIRE + agent/server pods (useful for private registries).', 'Gateway API: required + labels/annotations added and route sorting now considers HTTP method conditions + for more correct routing behavior.'] + breaking_changes: ['Deprecation: Providing Hubble TLS secrets via Helm values + is deprecated in 1.16.1; future chart versions may remove this path, so + migrate to Kubernetes Secrets/references now.'] chart_version: 1.16.1 - images: - - quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b - - quay.io/cilium/cilium:v1.16.1@sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39 - - quay.io/cilium/operator-generic:v1.16.1@sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4 + images: ['quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b', + 'quay.io/cilium/cilium:v1.16.1@sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39', + 'quay.io/cilium/operator-generic:v1.16.1@sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4'] eolAt: '2026-02-03' - version: 1.16.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -16082,56 +13537,45 @@ addons: \ your rendered manifests (`helm template`) against current to catch any renamed/removed\ \ values (especially around Envoy, Gateway API, and ClusterMesh/KVStoreMesh\ \ defaults)." - chart_updates: - - Cilium 1.16.0 introduces/expands features across networking, BGP, Gateway - API/Ingress, policy, operations, and Hubble observability. - - No chart-structure changes are explicitly called out in the supplied notes, - but behavior may change due to new defaults (notably Envoy deployment model - for new installs, and ClusterMesh KVStoreMesh default). - features: - - Cilium NetKit to improve container-network throughput/latency closer to host - networking performance. - - BGPv2 with a new API, plus BGP advertisement support for ExternalIP and ClusterIP - services. - - Kubernetes 1.30 Service Traffic Distribution can be configured via Service - spec (not annotations). - - Local Redirect Policy is promoted to Stable for redirecting service traffic - to local backends (e.g., node-local DNS). - - Multicast datapath support for defining multicast groups in Cilium. - - Per-pod fixed MAC address support. - - 'Gateway API enhancements: GAMMA support (east-west), Gateway API 1.1 support, - and ExternalTrafficPolicy support for Ingress/Gateway API.' - - Envoy proxy can run as a dedicated DaemonSet (separate lifecycle); enabled - by default for new installs. - - CiliumEnvoyConfig now supports nodeSelector to target specific nodes. - - 'Network policy improvements: port ranges, validation status in `kubectl describe`, - per-policy control of default-deny behavior, CIDRGroups in egress/deny, loading - default policies from filesystem, and node-based selectors (ToNodes/FromNodes).' - - 'Operational improvements: new ELF loader logic reduces median memory usage; - improved DNS-based policy performance; KVStoreMesh becomes the default ClusterMesh - deployment option.' - - 'Hubble/observability improvements: CEL flow filters, improved HTTP metrics, - improved BPF map pressure metrics, more egress-path observability metrics, - k8s event generation on packet drops, and filtering flows by node labels.' - breaking_changes: - - 'The supplied 1.16.0 release-notes excerpt does not explicitly list breaking - changes. Treat the following as **potential behavior changes to validate** - during upgrade testing: KVStoreMesh becoming the default for ClusterMesh deployments, - and the move to a dedicated Envoy DaemonSet being default for new installs - (may affect how you manage/upgrade Envoy if you adopt it). Review the full - v1.16.0 CHANGELOG.md for any explicit breaking changes that apply to your - deployment.' + chart_updates: ['Cilium 1.16.0 introduces/expands features across networking, + BGP, Gateway API/Ingress, policy, operations, and Hubble observability.', + 'No chart-structure changes are explicitly called out in the supplied notes, + but behavior may change due to new defaults (notably Envoy deployment model + for new installs, and ClusterMesh KVStoreMesh default).'] + features: [Cilium NetKit to improve container-network throughput/latency closer + to host networking performance., 'BGPv2 with a new API, plus BGP advertisement + support for ExternalIP and ClusterIP services.', Kubernetes 1.30 Service + Traffic Distribution can be configured via Service spec (not annotations)., + 'Local Redirect Policy is promoted to Stable for redirecting service traffic + to local backends (e.g., node-local DNS).', Multicast datapath support for + defining multicast groups in Cilium., Per-pod fixed MAC address support., + 'Gateway API enhancements: GAMMA support (east-west), Gateway API 1.1 support, + and ExternalTrafficPolicy support for Ingress/Gateway API.', Envoy proxy + can run as a dedicated DaemonSet (separate lifecycle); enabled by default + for new installs., CiliumEnvoyConfig now supports nodeSelector to target + specific nodes., 'Network policy improvements: port ranges, validation status + in `kubectl describe`, per-policy control of default-deny behavior, CIDRGroups + in egress/deny, loading default policies from filesystem, and node-based + selectors (ToNodes/FromNodes).', 'Operational improvements: new ELF loader + logic reduces median memory usage; improved DNS-based policy performance; + KVStoreMesh becomes the default ClusterMesh deployment option.', 'Hubble/observability + improvements: CEL flow filters, improved HTTP metrics, improved BPF map + pressure metrics, more egress-path observability metrics, k8s event generation + on packet drops, and filtering flows by node labels.'] + breaking_changes: ['The supplied 1.16.0 release-notes excerpt does not explicitly + list breaking changes. Treat the following as **potential behavior changes + to validate** during upgrade testing: KVStoreMesh becoming the default for + ClusterMesh deployments, and the move to a dedicated Envoy DaemonSet being + default for new installs (may affect how you manage/upgrade Envoy if you + adopt it). Review the full v1.16.0 CHANGELOG.md for any explicit breaking + changes that apply to your deployment.'] chart_version: 1.16.0 - images: - - quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b - - quay.io/cilium/cilium:v1.16.0@sha256:46ffa4ef3cf6d8885dcc4af5963b0683f7d59daa90d49ed9fb68d3b1627fe058 - - quay.io/cilium/operator-generic:v1.16.0@sha256:d6621c11c4e4943bf2998af7febe05be5ed6fdcf812b27ad4388f47022190316 + images: ['quay.io/cilium/cilium-envoy:v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51@sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b', + 'quay.io/cilium/cilium:v1.16.0@sha256:46ffa4ef3cf6d8885dcc4af5963b0683f7d59daa90d49ed9fb68d3b1627fe058', + 'quay.io/cilium/operator-generic:v1.16.0@sha256:d6621c11c4e4943bf2998af7febe05be5ed6fdcf812b27ad4388f47022190316'] eolAt: '2026-02-03' - version: 1.15.17 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -16140,25 +13584,19 @@ addons: \ set this value today, keep your current behavior by pinning it in `values.yaml`.\n\ \ - If you did **not** set it, expect behavior to follow the new default\ \ in 1.15.17; validate Kafka L7 policies/traffic in staging." - chart_updates: - - 'Helm chart defaults updated for Kafka (`apiKey: true`) in 1.15.17 (may affect - Kafka L7 policy behavior).' - features: - - No major new user-facing features called out in the provided notes; this patch - set is primarily bugfixes and dependency/image updates. - breaking_changes: - - Potential behavior change for Kafka L7 policy users due to Helm default `apiKey` - being set to `true` in 1.15.17 if you relied on the previous default. + chart_updates: ['Helm chart defaults updated for Kafka (`apiKey: true`) in 1.15.17 + (may affect Kafka L7 policy behavior).'] + features: [No major new user-facing features called out in the provided notes; + this patch set is primarily bugfixes and dependency/image updates.] + breaking_changes: [Potential behavior change for Kafka L7 policy users due to + Helm default `apiKey` being set to `true` in 1.15.17 if you relied on the + previous default.] chart_version: 1.15.17 - images: - - quay.io/cilium/cilium:v1.15.17@sha256:8824313a6f17d934b4e63902fee71e6ca36be6f69d68ae174df28f1b0705e587 - - quay.io/cilium/operator-generic:v1.15.17@sha256:a0f5b5dc8cecd4e5ead7d3bddb3756e4b34beba8e7aa089e7e2fb761725defe1 + images: ['quay.io/cilium/cilium:v1.15.17@sha256:8824313a6f17d934b4e63902fee71e6ca36be6f69d68ae174df28f1b0705e587', + 'quay.io/cilium/operator-generic:v1.15.17@sha256:a0f5b5dc8cecd4e5ead7d3bddb3756e4b34beba8e7aa089e7e2fb761725defe1'] eolAt: '2025-07-29' - version: 1.15.12 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -16184,32 +13622,24 @@ addons: If it errors, remove/rename the flagged deprecated values.' - chart_updates: - - No chart-template changes were explicitly listed for 1.15.12 in the provided - excerpt (mostly CI/docs/dependency bumps). - - 1.15.12 updates image digests and bumps bundled dependencies (notably CNI - plugins to v1.6.0, Envoy image tags, Go patch version), which can affect runtime - behavior only insofar as bugfixes/security patches apply. - features: - - cilium-health-ep controller made more robust against successive failures (improves - health endpoint/controller resilience). - - Gateway API checks fixed for namespace handling (improves correctness for - Gateway API users). - breaking_changes: - - No breaking changes were mentioned in the provided release notes for the target - patch release (1.15.12). Patch upgrades in the same minor series are expected - to be non-breaking, but Helm schema validation may block upgrades if you still - use removed/deprecated values. + chart_updates: [No chart-template changes were explicitly listed for 1.15.12 + in the provided excerpt (mostly CI/docs/dependency bumps)., '1.15.12 updates + image digests and bumps bundled dependencies (notably CNI plugins to v1.6.0, + Envoy image tags, Go patch version), which can affect runtime behavior only + insofar as bugfixes/security patches apply.'] + features: [cilium-health-ep controller made more robust against successive failures + (improves health endpoint/controller resilience)., Gateway API checks fixed + for namespace handling (improves correctness for Gateway API users).] + breaking_changes: ['No breaking changes were mentioned in the provided release + notes for the target patch release (1.15.12). Patch upgrades in the same + minor series are expected to be non-breaking, but Helm schema validation + may block upgrades if you still use removed/deprecated values.'] chart_version: 1.15.12 - images: - - quay.io/cilium/cilium:v1.15.12@sha256:d1793b67d976e1bc0a4ab01b34c94adfcd35a8be7612d04c6d618bf25f50f0d1 - - quay.io/cilium/operator-generic:v1.15.12@sha256:e48d863367bfd39843917400aa7454ca6a4af74f995cf29a2edb81d7d13c7277 + images: ['quay.io/cilium/cilium:v1.15.12@sha256:d1793b67d976e1bc0a4ab01b34c94adfcd35a8be7612d04c6d618bf25f50f0d1', + 'quay.io/cilium/operator-generic:v1.15.12@sha256:e48d863367bfd39843917400aa7454ca6a4af74f995cf29a2edb81d7d13c7277'] eolAt: '2025-07-29' - version: 1.15.8 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -16225,31 +13655,24 @@ addons: \ types for comparison\u201D indicates the chart became stricter about value\ \ types; keep booleans/ints/strings consistent with chart expectations to\ \ avoid template errors.\n" - chart_updates: - - 'Helm: add validation to block removed/deprecated values (upgrade may now - hard-fail on stale values).' - - 'Helm: cleanup deprecated attributes and old Kubernetes version checks.' - - 'Helm: remove duplicate Envoy pod metrics output.' - - 'Docs/values: allow setting DNS proxy socket linger timeout to zero via Helm - (enables explicitly disabling linger).' - features: - - Hubble Relay is more resilient to transient errors, improving stability in - flaky network/control-plane conditions. - - 'Gateway API routing improvements: routes can be sorted with HTTP method conditions - and react to ReferenceGrant changes more reliably.' - breaking_changes: - - Helm upgrades may now fail if you still use values that were previously deprecated - and are now removed; you must remove/replace them before upgrading. + chart_updates: ['Helm: add validation to block removed/deprecated values (upgrade + may now hard-fail on stale values).', 'Helm: cleanup deprecated attributes + and old Kubernetes version checks.', 'Helm: remove duplicate Envoy pod metrics + output.', 'Docs/values: allow setting DNS proxy socket linger timeout to + zero via Helm (enables explicitly disabling linger).'] + features: ['Hubble Relay is more resilient to transient errors, improving stability + in flaky network/control-plane conditions.', 'Gateway API routing improvements: + routes can be sorted with HTTP method conditions and react to ReferenceGrant + changes more reliably.'] + breaking_changes: [Helm upgrades may now fail if you still use values that were + previously deprecated and are now removed; you must remove/replace them + before upgrading.] chart_version: 1.15.8 - images: - - quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7 - - quay.io/cilium/operator-generic:v1.15.8@sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18 + images: ['quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7', + 'quay.io/cilium/operator-generic:v1.15.8@sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18'] eolAt: '2025-07-29' - version: 1.15.5 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -16283,47 +13706,36 @@ addons: \ comparison` \u2014 indicates some previously tolerated value type mismatches\ \ may have caused issues; ensure your values types match the chart expectations\ \ (strings vs bools vs ints).\n" - chart_updates: - - Chart now removes deprecated clustermesh CA configuration from the Helm chart - (if you relied on the old CA options, migrate to the supported clustermesh - CA/config approach). - - "clustermesh-apiserver and kvstoremesh images were merged into a single image\ - \ in 1.15.0; verify your deployments/overrides don\u2019t assume separate\ - \ images." - - 'Default metrics enablement changed: operator and clustermesh/kvstore metrics - are enabled by default in Helm (may affect Prometheus scraping and RBAC).' - - Chart includes extraVolumeMounts support for the cilium-config init container - and a securityContext for SPIRE pods (verify if you override these templates). - - Ingress/Gateway features and related Helm wiring expanded (e.g., trusted LB - hops, proxy protocol support, SSL passthrough annotation support). - features: - - Dynamic flowlog exporters can now be configured via a YAML file (ConfigMap) - without restarting the agent. - - Gateway API support was extended up to v1.0, including GRPCRoute support and - additional Gateway API capabilities. - - ClusterMesh can be extended up to 511 clusters via `--max-connected-clusters=511` - (with identity-space tradeoffs). - - 'BGP control plane enhancements: new routes API/CLI commands and support for - BGP MD5/passwords and advertised path attributes.' - - Improved Hubble functionality (filters, redaction options, new dashboards/metrics) - and additional observability metrics across components. - breaking_changes: - - Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` - were removed; upgrades will fail if they remain in your values. - - '`kubeProxyReplacement` Helm value usage changed (no longer `strict`); adjust - values to the current expected type/value.' - - A deprecated tunnel option (and its Helm value) was removed; remove/replace - any legacy tunnel-related values before upgrading. + chart_updates: ['Chart now removes deprecated clustermesh CA configuration from + the Helm chart (if you relied on the old CA options, migrate to the supported + clustermesh CA/config approach).', "clustermesh-apiserver and kvstoremesh\ + \ images were merged into a single image in 1.15.0; verify your deployments/overrides\ + \ don\u2019t assume separate images.", 'Default metrics enablement changed: + operator and clustermesh/kvstore metrics are enabled by default in Helm + (may affect Prometheus scraping and RBAC).', Chart includes extraVolumeMounts + support for the cilium-config init container and a securityContext for SPIRE + pods (verify if you override these templates)., 'Ingress/Gateway features + and related Helm wiring expanded (e.g., trusted LB hops, proxy protocol + support, SSL passthrough annotation support).'] + features: [Dynamic flowlog exporters can now be configured via a YAML file (ConfigMap) + without restarting the agent., 'Gateway API support was extended up to v1.0, + including GRPCRoute support and additional Gateway API capabilities.', ClusterMesh + can be extended up to 511 clusters via `--max-connected-clusters=511` (with + identity-space tradeoffs)., 'BGP control plane enhancements: new routes + API/CLI commands and support for BGP MD5/passwords and advertised path attributes.', + 'Improved Hubble functionality (filters, redaction options, new dashboards/metrics) + and additional observability metrics across components.'] + breaking_changes: [Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` + were removed; upgrades will fail if they remain in your values., '`kubeProxyReplacement` + Helm value usage changed (no longer `strict`); adjust values to the current + expected type/value.', A deprecated tunnel option (and its Helm value) was + removed; remove/replace any legacy tunnel-related values before upgrading.] chart_version: 1.15.5 - images: - - quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40 - - quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8 + images: ['quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40', + 'quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8'] eolAt: '2025-07-29' - version: 1.15.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -16355,59 +13767,45 @@ addons: \ affect Helm\n- **clustermesh-apiserver + kvstoremesh image merge**: the\ \ components were merged into a single image; verify your Helm values for\ \ image overrides, deployments, and metrics toggles if you run clustermesh/kvstoremesh.\n" - chart_updates: - - Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` - removed (upgrade will fail if still set). - - Deprecated tunnel Helm value removed; must use routing-mode/tunnel-protocol - style config. - - Helm chart updated to use `strict=true` semantics for kubeProxyReplacement-related - configuration (avoid old enum-like settings). - - SPIRE Helm values schema changed to align with other image configuration patterns - (verify any custom SPIRE image overrides/securityContext). - - Deprecated clustermesh CA configuration removed from chart; use global CA - config. - - Operator + clustermesh kvstore metrics enabled by default via Helm; confirm - your Prometheus scraping expectations. - - clustermesh-apiserver and kvstoremesh consolidated into one image; validate - your clustermesh-related Helm values and upgrades. - features: - - Dynamic FlowLog exporters can be updated via a ConfigMap-backed YAML file - without restarting cilium-agent. - - Gateway API v1.0 support, including GRPCRoute, plus multiple Gateway API controller - improvements and startup CRD checks. - - ClusterMesh scalability increased up to 511 clusters via `--max-connected-clusters=511` - (with identity tradeoff). - - BGP improvements including new `bgp/routes` API endpoint, `cilium bgp routes` - CLI, passwords/MD5 secret handling improvements, and route policy tooling. - - 'Observability enhancements: new Hubble dashboards, more Hubble filtering - (HTTP URLs/headers), and improved relay health/readiness behavior.' - - Egress Gateway changed to BPF-based interface selection; `--install-egress-gateway-routes` - is no longer needed. - - Modularization and module health reporting improvements in `cilium status`, - plus more Prometheus metrics across components. - breaking_changes: - - If you set Helm values `enableK8sEventHandover` or `enableCnpStatusUpdates`, - the upgrade will break because these options and their corresponding agent/operator - flags were removed. - - If you relied on the deprecated `tunnel` Helm/flag configuration, it is removed; - you must migrate to routing-mode/tunnel-protocol configuration. - - Egress Gateway no longer needs (and effectively deprecates) the `--install-egress-gateway-routes` - behavior; operational expectations for route setup change. - - ClusterMesh 511-cluster mode is only for new clusters and must be consistent - across all clusters; enabling it reduces available cluster-local identities - to 32,768. - - clustermesh-apiserver/kvstoremesh packaging changed (single image); custom - image overrides and deployment assumptions may need adjustment. + chart_updates: [Deprecated Helm values `enableK8sEventHandover` and `enableCnpStatusUpdates` + removed (upgrade will fail if still set)., Deprecated tunnel Helm value + removed; must use routing-mode/tunnel-protocol style config., Helm chart + updated to use `strict=true` semantics for kubeProxyReplacement-related + configuration (avoid old enum-like settings)., SPIRE Helm values schema + changed to align with other image configuration patterns (verify any custom + SPIRE image overrides/securityContext)., Deprecated clustermesh CA configuration + removed from chart; use global CA config., Operator + clustermesh kvstore + metrics enabled by default via Helm; confirm your Prometheus scraping expectations., + clustermesh-apiserver and kvstoremesh consolidated into one image; validate + your clustermesh-related Helm values and upgrades.] + features: [Dynamic FlowLog exporters can be updated via a ConfigMap-backed YAML + file without restarting cilium-agent., 'Gateway API v1.0 support, including + GRPCRoute, plus multiple Gateway API controller improvements and startup + CRD checks.', ClusterMesh scalability increased up to 511 clusters via `--max-connected-clusters=511` + (with identity tradeoff)., 'BGP improvements including new `bgp/routes` + API endpoint, `cilium bgp routes` CLI, passwords/MD5 secret handling improvements, + and route policy tooling.', 'Observability enhancements: new Hubble dashboards, + more Hubble filtering (HTTP URLs/headers), and improved relay health/readiness + behavior.', Egress Gateway changed to BPF-based interface selection; `--install-egress-gateway-routes` + is no longer needed., 'Modularization and module health reporting improvements + in `cilium status`, plus more Prometheus metrics across components.'] + breaking_changes: ['If you set Helm values `enableK8sEventHandover` or `enableCnpStatusUpdates`, + the upgrade will break because these options and their corresponding agent/operator + flags were removed.', 'If you relied on the deprecated `tunnel` Helm/flag + configuration, it is removed; you must migrate to routing-mode/tunnel-protocol + configuration.', Egress Gateway no longer needs (and effectively deprecates) + the `--install-egress-gateway-routes` behavior; operational expectations + for route setup change., 'ClusterMesh 511-cluster mode is only for new clusters + and must be consistent across all clusters; enabling it reduces available + cluster-local identities to 32,768.', clustermesh-apiserver/kvstoremesh + packaging changed (single image); custom image overrides and deployment + assumptions may need adjustment.] chart_version: 1.15.0 - images: - - quay.io/cilium/cilium:v1.15.0@sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619 - - quay.io/cilium/operator-generic:v1.15.0@sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79 + images: ['quay.io/cilium/cilium:v1.15.0@sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619', + 'quay.io/cilium/operator-generic:v1.15.0@sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79'] eolAt: '2025-07-29' - version: 1.14.18 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -16418,30 +13816,23 @@ addons: \ (e.g., omit the value or use a small positive number), you can now explicitly\ \ set `0`.\n\nNo other Helm-values changes are called out in the notes you\ \ provided for 1.14.14 \u2192 1.14.18." - chart_updates: - - No functional Helm chart template changes were called out in the excerpts - provided (most Helm-related items were CI/linting oriented). - - Image digests/tags advance to `v1.14.18` for all Cilium components; ensure - any private registry mirroring or allowlists are updated accordingly. - features: - - No notable new user-facing features are highlighted in the provided patch - release notes; the focus is on bugfixes, dependency bumps, and minor operational - robustness improvements. - - 'XDP: `cilium_calls_xdp` map is now per-endpoint (internal change that may - improve correctness/isolation for some XDP datapath scenarios).' - breaking_changes: - - "None called out in the provided release note excerpts for these patch versions\ - \ (1.14.14 \u2192 1.14.18)." + chart_updates: [No functional Helm chart template changes were called out in + the excerpts provided (most Helm-related items were CI/linting oriented)., + Image digests/tags advance to `v1.14.18` for all Cilium components; ensure + any private registry mirroring or allowlists are updated accordingly.] + features: ['No notable new user-facing features are highlighted in the provided + patch release notes; the focus is on bugfixes, dependency bumps, and minor + operational robustness improvements.', 'XDP: `cilium_calls_xdp` map is now + per-endpoint (internal change that may improve correctness/isolation for + some XDP datapath scenarios).'] + breaking_changes: ["None called out in the provided release note excerpts for\ + \ these patch versions (1.14.14 \u2192 1.14.18)."] chart_version: 1.14.18 - images: - - quay.io/cilium/cilium:v1.14.18@sha256:a09bd4ee7345ccdb42679985bf3e5a696ad8416e31a70a3609129bc745804123 - - quay.io/cilium/operator-generic:v1.14.18@sha256:f41a9f3d899e14ba34a9696e7327147cd9811fc563c255668d59658ad90aa69e + images: ['quay.io/cilium/cilium:v1.14.18@sha256:a09bd4ee7345ccdb42679985bf3e5a696ad8416e31a70a3609129bc745804123', + 'quay.io/cilium/operator-generic:v1.14.18@sha256:f41a9f3d899e14ba34a9696e7327147cd9811fc563c255668d59658ad90aa69e'] eolAt: '2025-02-04' - version: 1.14.14 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -16452,56 +13843,43 @@ addons: _No other Helm values changes were mentioned in the provided notes for 1.14.14._' - chart_updates: - - 'Helm chart: allow configuring DNS proxy upstream socket linger timeout to - `0` (enables fully disabling the linger behavior via values).' - features: - - "Security fix included for advisory GHSA-q7w8-72mr-vpgw (upgrade recommended\ - \ even if you don\u2019t change config)." - - 'Improved resilience in high node-churn clusters: agent can recover from stale - nodeID mappings that could lead to dropped IPsec traffic.' - - 'More accurate observability: report correct drop reason when packets are - dropped by `bpf_lxc`.' + chart_updates: ['Helm chart: allow configuring DNS proxy upstream socket linger + timeout to `0` (enables fully disabling the linger behavior via values).'] + features: ["Security fix included for advisory GHSA-q7w8-72mr-vpgw (upgrade\ + \ recommended even if you don\u2019t change config).", 'Improved resilience + in high node-churn clusters: agent can recover from stale nodeID mappings + that could lead to dropped IPsec traffic.', 'More accurate observability: + report correct drop reason when packets are dropped by `bpf_lxc`.'] breaking_changes: [] chart_version: 1.14.14 - images: - - quay.io/cilium/cilium:v1.14.14@sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637 - - quay.io/cilium/operator-generic:v1.14.14@sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2 + images: ['quay.io/cilium/cilium:v1.14.14@sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637', + 'quay.io/cilium/operator-generic:v1.14.14@sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2'] eolAt: '2025-02-04' - version: 1.14.11 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Reduces BPF conntrack/NAT map pressure by skipping overlay traffic in BPF - SNAT processing, which can help stability under high connection churn and - in overlay/tunnel-heavy clusters. - - Improves DNS proxy behavior, including reserving ports that conflict with - the transparent DNS proxy and fixing timeouts/memory leak scenarios. - - 'Envoy/L7 improvements: upstream connections can be made unique per downstream - when preserving original pod source IP, plus additional Envoy configuration - knobs (idle timeout, trusted XFF hops).' - - Operational robustness fixes for cloud IPAM modes (ENI/Azure/Alibaba) including - correct route MTU selection and netlink retries during ENI device setup. - - Operator/metrics and general reliability improvements (e.g., operator error/warn - metrics, reduced noisy logs, safer taint handling in chained CNI mode). + features: ['Reduces BPF conntrack/NAT map pressure by skipping overlay traffic + in BPF SNAT processing, which can help stability under high connection churn + and in overlay/tunnel-heavy clusters.', 'Improves DNS proxy behavior, including + reserving ports that conflict with the transparent DNS proxy and fixing + timeouts/memory leak scenarios.', 'Envoy/L7 improvements: upstream connections + can be made unique per downstream when preserving original pod source IP, + plus additional Envoy configuration knobs (idle timeout, trusted XFF hops).', + Operational robustness fixes for cloud IPAM modes (ENI/Azure/Alibaba) including + correct route MTU selection and netlink retries during ENI device setup., + 'Operator/metrics and general reliability improvements (e.g., operator error/warn + metrics, reduced noisy logs, safer taint handling in chained CNI mode).'] breaking_changes: [] chart_version: 1.14.11 - images: - - quay.io/cilium/cilium:v1.14.11@sha256:2b2118042dc6efe88dbc40c78909b6afd72b369896782ce38d132435724ee269 - - quay.io/cilium/operator-generic:v1.14.11@sha256:df76f71a06f1c681848bfa86fdd99243af593d33034c9e2057c6af969bc25109 + images: ['quay.io/cilium/cilium:v1.14.11@sha256:2b2118042dc6efe88dbc40c78909b6afd72b369896782ce38d132435724ee269', + 'quay.io/cilium/operator-generic:v1.14.11@sha256:df76f71a06f1c681848bfa86fdd99243af593d33034c9e2057c6af969bc25109'] eolAt: '2025-02-04' - version: 1.14.6 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -16516,31 +13894,24 @@ addons: \ any custom `prometheus.metrics` formatting.\n- **SPIRE agent scheduling:**\ \ Adds a **default toleration** for SPIRE agent on control-plane nodes (only\ \ relevant if you deploy SPIRE/SPIFFE integration)." - chart_updates: - - Envoy `ServiceMonitor` template typo + annotation fix (Prometheus Operator - users). - - Chart validation/logic tightened for managed Kubernetes toggles (GKE / AKS - BYOCNI) to prevent invalid routing-mode combos. - - Improved Helm/flag parsing for list-like metrics settings (e.g., `prometheus.metrics`). - - Default toleration added for SPIRE agent to run on control-plane nodes. - features: - - Adds a `proxy_type` label to L7 proxy metrics, improving visibility and filtering - of L7 metrics. - - Cilium DNS proxy can operate in a transparent mode (`--dnsproxy-enable-transparent-mode`) - so queries can use the original pod IP as the source toward upstream DNS servers. - - Adds BGPv1 routes API endpoint plus `cilium bgp routes` CLI command, and integrates - it into `bugtool` for easier troubleshooting. + chart_updates: [Envoy `ServiceMonitor` template typo + annotation fix (Prometheus + Operator users)., Chart validation/logic tightened for managed Kubernetes + toggles (GKE / AKS BYOCNI) to prevent invalid routing-mode combos., 'Improved + Helm/flag parsing for list-like metrics settings (e.g., `prometheus.metrics`).', + Default toleration added for SPIRE agent to run on control-plane nodes.] + features: ['Adds a `proxy_type` label to L7 proxy metrics, improving visibility + and filtering of L7 metrics.', Cilium DNS proxy can operate in a transparent + mode (`--dnsproxy-enable-transparent-mode`) so queries can use the original + pod IP as the source toward upstream DNS servers., 'Adds BGPv1 routes API + endpoint plus `cilium bgp routes` CLI command, and integrates it into `bugtool` + for easier troubleshooting.'] breaking_changes: [] chart_version: 1.14.6 - images: - - quay.io/cilium/cilium:v1.14.6@sha256:37a49f1abb333279a9b802ee8a21c61cde9dd9138b5ac55f77bdfca733ba852a - - quay.io/cilium/operator-generic:v1.14.6@sha256:2f0bf8fb8362c7379f3bf95036b90ad5b67378ed05cd8eb0410c1afc13423848 + images: ['quay.io/cilium/cilium:v1.14.6@sha256:37a49f1abb333279a9b802ee8a21c61cde9dd9138b5ac55f77bdfca733ba852a', + 'quay.io/cilium/operator-generic:v1.14.6@sha256:2f0bf8fb8362c7379f3bf95036b90ad5b67378ed05cd8eb0410c1afc13423848'] eolAt: '2025-02-04' - version: 1.14.2 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -16573,33 +13944,26 @@ addons: - **`enableEndpointCRD` Helm option type changed from string to boolean.** If you had `' - chart_updates: - - '1.14.2 is a patch release focused on stability: multiple IPsec fixes, Gateway - API fixes, NodePort datapath fixes, and smaller operational improvements.' - - 'Minor Helm chart change in 1.14.2: fixes Envoy DaemonSet log level handling - when multiple verbose debug groups are configured.' - features: - - 'Gateway API: support for additional/extended Gateway API features (more complete - feature coverage) compared to earlier 1.14.x.' - - 'Operational visibility: `cilium status` now shows SPIRE connection information - (helps validate mutual-auth/SPIRE deployments).' - breaking_changes: - - "1.14.0 had a strong warning: do not upgrade to 1.14.0 if you are using IPsec.\ - \ For a 1.14.0 \u2192 1.14.2 target, treat IPsec as a key risk area and ensure\ - \ you land on 1.14.2 quickly (or upgrade directly to 1.14.2)." - - 'Helm value type change: `enableEndpointCRD` changed from string to boolean - in 1.14.0; existing values files may fail template rendering or silently misconfigure - if not updated.' + chart_updates: ['1.14.2 is a patch release focused on stability: multiple IPsec + fixes, Gateway API fixes, NodePort datapath fixes, and smaller operational + improvements.', 'Minor Helm chart change in 1.14.2: fixes Envoy DaemonSet + log level handling when multiple verbose debug groups are configured.'] + features: ['Gateway API: support for additional/extended Gateway API features + (more complete feature coverage) compared to earlier 1.14.x.', 'Operational + visibility: `cilium status` now shows SPIRE connection information (helps + validate mutual-auth/SPIRE deployments).'] + breaking_changes: ["1.14.0 had a strong warning: do not upgrade to 1.14.0 if\ + \ you are using IPsec. For a 1.14.0 \u2192 1.14.2 target, treat IPsec as\ + \ a key risk area and ensure you land on 1.14.2 quickly (or upgrade directly\ + \ to 1.14.2).", 'Helm value type change: `enableEndpointCRD` changed from + string to boolean in 1.14.0; existing values files may fail template rendering + or silently misconfigure if not updated.'] chart_version: 1.14.2 - images: - - quay.io/cilium/cilium:v1.14.2@sha256:6263f3a3d5d63b267b538298dbeb5ae87da3efacf09a2c620446c873ba807d35 - - quay.io/cilium/operator-generic:v1.14.2@sha256:52f70250dea22e506959439a7c4ea31b10fe8375db62f5c27ab746e3a2af866d + images: ['quay.io/cilium/cilium:v1.14.2@sha256:6263f3a3d5d63b267b538298dbeb5ae87da3efacf09a2c620446c873ba807d35', + 'quay.io/cilium/operator-generic:v1.14.2@sha256:52f70250dea22e506959439a7c4ea31b10fe8375db62f5c27ab746e3a2af866d'] eolAt: '2025-02-04' - version: 1.14.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -16642,113 +14006,92 @@ addons: \ CA handling improvements**\n - Chart adds support for specifying a CA bundle\ \ and allowing `caBundle` to come from a Secret.\n - Action: if you have\ \ custom PKI for webhooks/API services, review these new options.\n" - chart_updates: - - Adds optional new component **kvstoremesh** and corresponding Helm configuration - to improve clustermesh scalability. - - Adds support for deploying **Envoy (L7 proxy) as an independent DaemonSet**, - decoupling it from the agent for availability/performance/security benefits. - - Helm chart includes additional dashboards / dashboard integrations (Hubble - dashboards and sample dashboards integration). - - 'Chart validation tightened: enabling Ingress/Gateway API while L7 proxy disabled - now fails fast (prevents broken installs).' - - 'Various Helm cleanups: deprecated values removed/cleaned up; clustermesh - CA configuration deprecated in favor of global CA configuration; TLS configuration - simplified for clustermesh peers.' - - Adds service account for nodeinit daemonset and other minor chart template - fixes (e.g., indentation fixes). - features: - - '**Gateway API improvements**: adds TLSRoute support and supports newer Gateway - API versions (v0.6.x/v0.7.0 called out in notes).' - - '**L2 announcements**: introduces L2 announcement functionality including - gratuitous ARP (gARP) pod announcements for on-LAN advertisement use cases.' - - '**WireGuard enhancements**: adds host-to-host and load balancer traffic encryption - capabilities.' - - '**High-scale IPCache mode**: new mode designed for very large clustermeshes - (millions of pods), plus compatibility with encapsulation/DSR scenarios.' - - '**mTLS policy authentication options**: adds `mtls-spiffe` as a CiliumNetworkPolicy - auth mode and related SPIRE integrations for cert rotation/identity delivery.' - - '**CNI chaining improvements**: supports chaining with arbitrary CNI plugins - and changes how/when the CNI config file is managed for more reliable upgrades.' - - '**IPv6 datapath enhancements**: BPF-based IPv6 masquerading and IPv4 BIG - TCP support (plus continued BIG TCP work).' - - "**Operational safety**: operator can taint nodes when Cilium isn\u2019t running\ - \ to prevent scheduling onto unnetworked nodes; CNI conf no longer removed\ - \ on agent shutdown to avoid stuck pod deletions during upgrades." - breaking_changes: - - '**Hard stop for IPsec**: 1.14.0 release notes explicitly warn not to upgrade - when using IPsec; treat this as a blocking upgrade constraint.' - - '**CLI/flags removals**: the deprecated `policy_trace` command is removed; - if you rely on it in runbooks/scripts, update them.' - - '**Hubble metrics change**: the deprecated `pod-short` context option in Hubble - metrics is removed; dashboards/alerts depending on it need updating.' - - '**CNI config management behavioral change**: Cilium now manages/overwrites - the CNI config by default; if you used to manually modify the CNI config file - or rely on other chained plugins, you must adjust (`cni.exclusive=false` and/or - `cni.chainingTarget`) to avoid unexpected overwrites.' - - '**Value type change**: `enableEndpointCRD` Helm value changed from string - to boolean; incorrect type may break templating or behavior.' + chart_updates: [Adds optional new component **kvstoremesh** and corresponding + Helm configuration to improve clustermesh scalability., 'Adds support for + deploying **Envoy (L7 proxy) as an independent DaemonSet**, decoupling it + from the agent for availability/performance/security benefits.', Helm chart + includes additional dashboards / dashboard integrations (Hubble dashboards + and sample dashboards integration)., 'Chart validation tightened: enabling + Ingress/Gateway API while L7 proxy disabled now fails fast (prevents broken + installs).', 'Various Helm cleanups: deprecated values removed/cleaned up; + clustermesh CA configuration deprecated in favor of global CA configuration; + TLS configuration simplified for clustermesh peers.', 'Adds service account + for nodeinit daemonset and other minor chart template fixes (e.g., indentation + fixes).'] + features: ['**Gateway API improvements**: adds TLSRoute support and supports + newer Gateway API versions (v0.6.x/v0.7.0 called out in notes).', '**L2 + announcements**: introduces L2 announcement functionality including gratuitous + ARP (gARP) pod announcements for on-LAN advertisement use cases.', '**WireGuard + enhancements**: adds host-to-host and load balancer traffic encryption capabilities.', + '**High-scale IPCache mode**: new mode designed for very large clustermeshes + (millions of pods), plus compatibility with encapsulation/DSR scenarios.', + '**mTLS policy authentication options**: adds `mtls-spiffe` as a CiliumNetworkPolicy + auth mode and related SPIRE integrations for cert rotation/identity delivery.', + '**CNI chaining improvements**: supports chaining with arbitrary CNI plugins + and changes how/when the CNI config file is managed for more reliable upgrades.', + '**IPv6 datapath enhancements**: BPF-based IPv6 masquerading and IPv4 BIG + TCP support (plus continued BIG TCP work).', "**Operational safety**: operator\ + \ can taint nodes when Cilium isn\u2019t running to prevent scheduling onto\ + \ unnetworked nodes; CNI conf no longer removed on agent shutdown to avoid\ + \ stuck pod deletions during upgrades."] + breaking_changes: ['**Hard stop for IPsec**: 1.14.0 release notes explicitly + warn not to upgrade when using IPsec; treat this as a blocking upgrade constraint.', + '**CLI/flags removals**: the deprecated `policy_trace` command is removed; + if you rely on it in runbooks/scripts, update them.', '**Hubble metrics + change**: the deprecated `pod-short` context option in Hubble metrics is + removed; dashboards/alerts depending on it need updating.', '**CNI config + management behavioral change**: Cilium now manages/overwrites the CNI config + by default; if you used to manually modify the CNI config file or rely on + other chained plugins, you must adjust (`cni.exclusive=false` and/or `cni.chainingTarget`) + to avoid unexpected overwrites.', '**Value type change**: `enableEndpointCRD` + Helm value changed from string to boolean; incorrect type may break templating + or behavior.'] chart_version: 1.14.0 - images: - - quay.io/cilium/cilium:v1.14.0@sha256:5a94b561f4651fcfd85970a50bc78b201cfbd6e2ab1a03848eab25a82832653a - - quay.io/cilium/operator-generic:v1.14.0@sha256:3014d4bcb8352f0ddef90fa3b5eb1bbf179b91024813a90a0066eb4517ba93c9 + images: ['quay.io/cilium/cilium:v1.14.0@sha256:5a94b561f4651fcfd85970a50bc78b201cfbd6e2ab1a03848eab25a82832653a', + 'quay.io/cilium/operator-generic:v1.14.0@sha256:3014d4bcb8352f0ddef90fa3b5eb1bbf179b91024813a90a0066eb4517ba93c9'] eolAt: '2025-02-04' - version: 1.13.16 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Improved observability tooling: bugtool can now collect Hubble metrics, making - it easier to capture flow/metrics context during incident triage.' - - 'Security and dependency refresh: includes fixes for published vulnerabilities - (Envoy-related) and bumps core dependencies (Envoy version, Go toolchain used - in components).' - - "Reliability/performance improvements across datapath and control-plane edges:\ - \ better handling of BPF service map retries, fewer noisy \u201Cstale identity\ - \ observed\u201D messages, and multiple fixes in DNS proxying, IPAM, and Envoy/xDS\ - \ behavior." + features: ['Improved observability tooling: bugtool can now collect Hubble metrics, + making it easier to capture flow/metrics context during incident triage.', + 'Security and dependency refresh: includes fixes for published vulnerabilities + (Envoy-related) and bumps core dependencies (Envoy version, Go toolchain + used in components).', "Reliability/performance improvements across datapath\ + \ and control-plane edges: better handling of BPF service map retries, fewer\ + \ noisy \u201Cstale identity observed\u201D messages, and multiple fixes\ + \ in DNS proxying, IPAM, and Envoy/xDS behavior."] breaking_changes: [] chart_version: 1.13.16 - images: - - quay.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629 - - quay.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b + images: ['quay.io/cilium/cilium:v1.13.16@sha256:f1f26a973419ba449a47a08e8c4c8e280d8941bb4fd77d1e992e2721425c0629', + 'quay.io/cilium/operator-generic:v1.13.16@sha256:a2711d5b891da9fd66c2116b77782b58a1a428eb4abdab2dd3ac1221937d846b'] eolAt: '2024-07-24' - version: 1.13.11 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Improved observability signal-to-noise: reduces \u201Cstale identity observed\u201D\ - \ warnings (and further reduces related Hubble debug noise), making logs/alerts\ - \ less chatty." - - 'DNS proxy enhancement: optional transparent mode (--dnsproxy-enable-transparent-mode) - allows the DNS proxy to preserve the original pod source IP when talking to - upstream DNS servers.' - - 'Performance improvement/fix for heavy-load datapath: further fixes to prevent - pod-to-pod throughput drops when tunneling and IPsec are both enabled, including - reducing trace/monitor event volume when aggregation is enabled.' + features: ["Improved observability signal-to-noise: reduces \u201Cstale identity\ + \ observed\u201D warnings (and further reduces related Hubble debug noise),\ + \ making logs/alerts less chatty.", 'DNS proxy enhancement: optional transparent + mode (--dnsproxy-enable-transparent-mode) allows the DNS proxy to preserve + the original pod source IP when talking to upstream DNS servers.', 'Performance + improvement/fix for heavy-load datapath: further fixes to prevent pod-to-pod + throughput drops when tunneling and IPsec are both enabled, including reducing + trace/monitor event volume when aggregation is enabled.'] breaking_changes: [] chart_version: 1.13.11 - images: - - quay.io/cilium/cilium:v1.13.11@sha256:3b117c7a6be212e2723813b44b909c757b76943cb0e9fdd0ec2aa4475bfcadb5 - - quay.io/cilium/operator-generic:v1.13.11@sha256:730e2209b8777f1525186c602f77d5f22259ec4f1f6a2e923f4c03809ab7b0b1 + images: ['quay.io/cilium/cilium:v1.13.11@sha256:3b117c7a6be212e2723813b44b909c757b76943cb0e9fdd0ec2aa4475bfcadb5', + 'quay.io/cilium/operator-generic:v1.13.11@sha256:730e2209b8777f1525186c602f77d5f22259ec4f1f6a2e923f4c03809ab7b0b1'] eolAt: '2024-07-24' - version: 1.13.7 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -16758,29 +14101,21 @@ addons: - **cert-manager users:** Helm now **mandates issuer configuration** when\ \ using cert-manager to generate certificates (1.13.2 bugfix note). Verify\ \ your values include the required issuer settings if you rely on cert-manager.\n" - chart_updates: - - No explicit Helm chart template/structure changes were included in the provided - notes beyond the cert-manager issuer requirement and the general reminder - to use the matching chart version. - features: - - 'Better observability for NAT map allocation drops: Cilium now reports the - kernel error code when drops occur due to failures creating NAT map entries - (1.13.7).' - - 'BGP operations visibility: `cilium bgp peers` now shows operational state - of BGP peers (1.13.2).' - - 'Host routing/fast-forward support expanded: fast-forward (BPF host routing) - can work on L2-less devices (1.13.2).' + chart_updates: [No explicit Helm chart template/structure changes were included + in the provided notes beyond the cert-manager issuer requirement and the + general reminder to use the matching chart version.] + features: ['Better observability for NAT map allocation drops: Cilium now reports + the kernel error code when drops occur due to failures creating NAT map + entries (1.13.7).', 'BGP operations visibility: `cilium bgp peers` now shows + operational state of BGP peers (1.13.2).', 'Host routing/fast-forward support + expanded: fast-forward (BPF host routing) can work on L2-less devices (1.13.2).'] breaking_changes: [] chart_version: 1.13.7 - images: - - quay.io/cilium/cilium:v1.13.7@sha256:3b084617febd708aa9d88de2472c6faf9aee71884112725e8511bca628ce5cf1 - - quay.io/cilium/operator-generic:v1.13.7@sha256:0ec1bc5d9ecc444a890aaa2e0f397e77d15f1832910f1c20be3adc535688baba + images: ['quay.io/cilium/cilium:v1.13.7@sha256:3b084617febd708aa9d88de2472c6faf9aee71884112725e8511bca628ce5cf1', + 'quay.io/cilium/operator-generic:v1.13.7@sha256:0ec1bc5d9ecc444a890aaa2e0f397e77d15f1832910f1c20be3adc535688baba'] eolAt: '2024-07-24' - version: 1.13.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -16806,47 +14141,34 @@ addons: \ was deprecated in favor of `CiliumEgressGatewayPolicy`.\n - In 1.13, **support\ \ for `CiliumEgressNATPolicy` is dropped**. You must migrate manifests before\ \ upgrading.\n" - chart_updates: - - Ingress/Gateway API improvements including shared LoadBalancer mode and expanded - Service configuration for Ingress. - - Helm validations added for ingress controller values (bad combinations may - block the upgrade). - - Optional reduction of Linux capabilities and more securityContext configurability - (including SELinux). - - Support for adding extra containers to cilium-agent DaemonSet via values. - - Defaults updated for Hubble UI images (v0.10.0). - features: - - LB-IPAM (LoadBalancer IP address management) to allocate/assign LoadBalancer - IPs without an external controller. - - BGP Control Plane can announce Kubernetes LoadBalancer services (useful for - on-prem/BGP-based LBs). - - Gateway API support updated (v0.5.1) and Ingress shared LoadBalancer mode - added. - - CiliumNetworkPolicy adds TLS SNI enforcement and expands TLS origination/termination - capabilities. - - Per-node configuration overrides via new `CiliumNodeConfig` CRD for label-selected - node-specific tuning. - - 'Improved observability: socket-LB tracing, TraceID support in Hubble flows/metrics, - and additional Hubble metrics contexts.' - breaking_changes: - - Linux minimum version bumped to **4.19.57** (or equivalent); older kernels - are unsupported and must be upgraded before Cilium 1.13. - - 'Egress Gateway: `CiliumEgressNATPolicy` support removed; clusters using it - must migrate to `CiliumEgressGatewayPolicy` prior to upgrade.' - - IPVLAN support removed (it was deprecated earlier); environments relying on - IPVLAN datapath must switch to a supported mode. - - SockOps deprecated (plan to avoid depending on it long-term); expect future - removal and validate if any workload depends on sockops-based features. + chart_updates: [Ingress/Gateway API improvements including shared LoadBalancer + mode and expanded Service configuration for Ingress., Helm validations added + for ingress controller values (bad combinations may block the upgrade)., + Optional reduction of Linux capabilities and more securityContext configurability + (including SELinux)., Support for adding extra containers to cilium-agent + DaemonSet via values., Defaults updated for Hubble UI images (v0.10.0).] + features: [LB-IPAM (LoadBalancer IP address management) to allocate/assign LoadBalancer + IPs without an external controller., BGP Control Plane can announce Kubernetes + LoadBalancer services (useful for on-prem/BGP-based LBs)., Gateway API support + updated (v0.5.1) and Ingress shared LoadBalancer mode added., CiliumNetworkPolicy + adds TLS SNI enforcement and expands TLS origination/termination capabilities., + Per-node configuration overrides via new `CiliumNodeConfig` CRD for label-selected + node-specific tuning., 'Improved observability: socket-LB tracing, TraceID + support in Hubble flows/metrics, and additional Hubble metrics contexts.'] + breaking_changes: [Linux minimum version bumped to **4.19.57** (or equivalent); + older kernels are unsupported and must be upgraded before Cilium 1.13., + 'Egress Gateway: `CiliumEgressNATPolicy` support removed; clusters using it + must migrate to `CiliumEgressGatewayPolicy` prior to upgrade.', IPVLAN support + removed (it was deprecated earlier); environments relying on IPVLAN datapath + must switch to a supported mode., SockOps deprecated (plan to avoid depending + on it long-term); expect future removal and validate if any workload depends + on sockops-based features.] chart_version: 1.13.0 - images: - - quay.io/cilium/cilium:v1.13.0@sha256:6544a3441b086a2e09005d3e21d1a4afb216fae19c5a60b35793c8a9438f8f68 - - quay.io/cilium/operator-generic:v1.13.0@sha256:4b58d5b33e53378355f6e8ceb525ccf938b7b6f5384b35373f1f46787467ebf5 + images: ['quay.io/cilium/cilium:v1.13.0@sha256:6544a3441b086a2e09005d3e21d1a4afb216fae19c5a60b35793c8a9438f8f68', + 'quay.io/cilium/operator-generic:v1.13.0@sha256:4b58d5b33e53378355f6e8ceb525ccf938b7b6f5384b35373f1f46787467ebf5'] eolAt: '2024-07-24' - version: 1.12.18 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -16861,45 +14183,34 @@ addons: ' chart_updates: [] - features: - - 'DNS proxy: new transparent mode (`--dnsproxy-enable-transparent-mode`) allows - the DNS proxy to use the original pod IP as the source when talking to upstream - DNS servers.' - - 'Operability: you can now configure resource requests/limits for the cgroups - automount initContainer in the Cilium agent DaemonSet (helps with strict PodSecurity/ResourceQuota - environments).' + features: ['DNS proxy: new transparent mode (`--dnsproxy-enable-transparent-mode`) + allows the DNS proxy to use the original pod IP as the source when talking + to upstream DNS servers.', 'Operability: you can now configure resource + requests/limits for the cgroups automount initContainer in the Cilium agent + DaemonSet (helps with strict PodSecurity/ResourceQuota environments).'] breaking_changes: [] chart_version: 1.12.18 - images: - - quay.io/cilium/cilium:v1.12.18@sha256:71218d52b2b9a63525e31e9be716810605696cbc02008e658953212f638d6b6b - - quay.io/cilium/operator-generic:v1.12.18@sha256:ac9b8a95d6faddacc1bca4145562c5143543dfbbc41b244383b52b8be83238ab + images: ['quay.io/cilium/cilium:v1.12.18@sha256:71218d52b2b9a63525e31e9be716810605696cbc02008e658953212f638d6b6b', + 'quay.io/cilium/operator-generic:v1.12.18@sha256:ac9b8a95d6faddacc1bca4145562c5143543dfbbc41b244383b52b8be83238ab'] - version: 1.12.14 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "No Helm chart changelog was provided in the notes you pasted, so I can\u2019\ - t list exact chart/values changes for 1.12.9\u21921.12.14 from source material\ - \ here." - - 'From the v1.12.9 release notes: when updating to 1.12.9 you must also use - the corresponding new Helm chart version (implies chart/version coupling; - verify chart version for 1.12.14 in the Cilium Helm chart release notes).' + chart_updates: ["No Helm chart changelog was provided in the notes you pasted,\ + \ so I can\u2019t list exact chart/values changes for 1.12.9\u21921.12.14\ + \ from source material here.", 'From the v1.12.9 release notes: when updating + to 1.12.9 you must also use the corresponding new Helm chart version (implies + chart/version coupling; verify chart version for 1.12.14 in the Cilium Helm + chart release notes).'] features: [] breaking_changes: [] chart_version: 1.12.14 - images: - - quay.io/cilium/cilium:v1.12.14@sha256:a54b28a5c15e14f3491c772ca7cfa86266a2b1efb85326bc1ab6c95b91aeaa77 - - quay.io/cilium/operator-generic:v1.12.14@sha256:b9ce66384c74f79a2982ef3a4602f649d49e9b8b79b58db5faa344c7451cb7c9 + images: ['quay.io/cilium/cilium:v1.12.14@sha256:a54b28a5c15e14f3491c772ca7cfa86266a2b1efb85326bc1ab6c95b91aeaa77', + 'quay.io/cilium/operator-generic:v1.12.14@sha256:b9ce66384c74f79a2982ef3a4602f649d49e9b8b79b58db5faa344c7451cb7c9'] - version: 1.12.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -16932,48 +14243,36 @@ addons: \ wider **cilium-cli Helm-based install/upgrade** support. Decide whether\ \ you stick with your existing Helm pipeline or standardize on cilium-cli\ \ for validation/preflight.\n" - chart_updates: - - Integrated Ingress Controller shipped and corresponding Helm templates/IngressClass - support added. - - Chart now applies Linux nodeSelectors to nodeinit and preflight components - (important for mixed OS clusters). - - Prometheus metrics ports default changed to reserved Cilium ports (update - scrape configs). - - Helm chart gained additional values for bpf root, Hubble Relay/UI service - exposure (type/nodePort), and Hubble securityContexts. - - Chart fixes around resource generation (e.g., PodDisruptionBudgets) and several - template/value alignment cleanups. - features: - - Integrated Cilium Ingress Controller (no separate ingress controller needed) - with optional Helm-created IngressClass. - - Cilium Service Mesh support including CiliumEnvoyConfig CRD to manage Envoy - behavior via Kubernetes resources. - - Egress Gateway promoted to stable and new Egress Gateway CRD introduced for - configuration. - - BGP control plane backed by GoBGP plus IPv6-related routing/BGP enhancements. - - NAT46/64 support for Services and bandwidth manager improvements including - optional BBR congestion control. - breaking_changes: - - 'Egress Gateway CRD migration: new `CiliumEgressGatewayPolicy` CRD added and - the older `CiliumEgressNATPolicy` is deprecated; plan to migrate manifests.' - - "DaemonSet no longer runs in privileged mode; verify your cluster\u2019s security\ - \ policies/PSPs/OPA/Gatekeeper rules allow required capabilities and mounts." - - Default Prometheus metrics ports changed; any hardcoded scrapes, firewall - rules, or NetworkPolicies must be updated. - - 'Config rename: `bpf.hostRouting` renamed to `bpf.hostLegacyRouting`; update - any custom CiliumConfig/values referencing the old name.' - - Deprecated options removed (e.g., deprecated `native-routing-cidr` option - and prefilter-* options); if you still use old flags, the agent may fail to - start after upgrade. + chart_updates: [Integrated Ingress Controller shipped and corresponding Helm + templates/IngressClass support added., Chart now applies Linux nodeSelectors + to nodeinit and preflight components (important for mixed OS clusters)., + Prometheus metrics ports default changed to reserved Cilium ports (update + scrape configs)., 'Helm chart gained additional values for bpf root, Hubble + Relay/UI service exposure (type/nodePort), and Hubble securityContexts.', + 'Chart fixes around resource generation (e.g., PodDisruptionBudgets) and several + template/value alignment cleanups.'] + features: [Integrated Cilium Ingress Controller (no separate ingress controller + needed) with optional Helm-created IngressClass., Cilium Service Mesh support + including CiliumEnvoyConfig CRD to manage Envoy behavior via Kubernetes + resources., Egress Gateway promoted to stable and new Egress Gateway CRD + introduced for configuration., BGP control plane backed by GoBGP plus IPv6-related + routing/BGP enhancements., NAT46/64 support for Services and bandwidth manager + improvements including optional BBR congestion control.] + breaking_changes: ['Egress Gateway CRD migration: new `CiliumEgressGatewayPolicy` + CRD added and the older `CiliumEgressNATPolicy` is deprecated; plan to migrate + manifests.', "DaemonSet no longer runs in privileged mode; verify your cluster\u2019\ + s security policies/PSPs/OPA/Gatekeeper rules allow required capabilities\ + \ and mounts.", 'Default Prometheus metrics ports changed; any hardcoded + scrapes, firewall rules, or NetworkPolicies must be updated.', 'Config rename: + `bpf.hostRouting` renamed to `bpf.hostLegacyRouting`; update any custom + CiliumConfig/values referencing the old name.', 'Deprecated options removed + (e.g., deprecated `native-routing-cidr` option and prefilter-* options); + if you still use old flags, the agent may fail to start after upgrade.'] chart_version: 1.12.0 - images: - - quay.io/cilium/cilium:v1.12.0@sha256:079baa4fa1b9fe638f96084f4e0297c84dd4fb215d29d2321dcbe54273f63ade - - quay.io/cilium/operator-generic:v1.12.0@sha256:bb2a42eda766e5d4a87ee8a5433f089db81b72dd04acf6b59fcbb445a95f9410 + images: ['quay.io/cilium/cilium:v1.12.0@sha256:079baa4fa1b9fe638f96084f4e0297c84dd4fb215d29d2321dcbe54273f63ade', + 'quay.io/cilium/operator-generic:v1.12.0@sha256:bb2a42eda766e5d4a87ee8a5433f089db81b72dd04acf6b59fcbb445a95f9410'] - version: 1.11.6 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -16995,41 +14294,33 @@ addons: \ ServiceMonitor customization:** v1.11.2 adds Helm values for **custom ServiceMonitor\ \ annotations**. If you need to integrate with Prometheus Operator/managed\ \ monitoring, you may now be able to set these via values instead of post-rendering.\n" - chart_updates: - - 'Envoy (Cilium host proxy) version bump across the patch series: v1.21.1 noted - in v1.11.2, and v1.21.3 in v1.11.6 to address multiple CVEs.' - - Hubble UI image update to v0.9.0 and removal of the extra Envoy proxy container - for the UI (could change resource footprint and what pods/containers you see). - - Default agent health check port changed to avoid conflicts (verify any NetworkPolicies, - firewalls, or health-check scraping assumptions). - - Fix/repair deprecated Kubernetes priority scheduling annotation to ensure - CNI agent is scheduled at high priority on newer Kubernetes versions. - features: - - 'Security: Envoy updated to v1.21.3 in v1.11.6 to address moderate/high/critical - CVEs (host proxy hardening).' - - 'FQDN/DNS scalability: concurrency limiting for DNS message processing plus - multiple optimizations to reduce CPU/memory under high FQDN policy load.' - - 'Observability/metrics: new/expanded metrics around identities and FQDN datapath - timeouts; improved DNS proxy error metrics and active FQDN connection metrics.' - - 'Ops tooling: cilium-bugtool includes more tc (traffic control) data and structured - node/health output.' - breaking_changes: - - 'Operational behavior change called out in v1.11.2: **GKE users should change - the node taint effect from `NoSchedule` to `NoExecute`** for `node.cilium.io/agent-not-ready=true`. - This can affect eviction behavior during agent-not-ready windows.' - - 'Potentially user-visible default changes: **agent health check port default - changed** and **Hubble peer service default ports changed to 80/443**; if - you had network policies, firewall rules, or custom scraping/health checks - tied to prior defaults, validate and adjust.' + chart_updates: ['Envoy (Cilium host proxy) version bump across the patch series: + v1.21.1 noted in v1.11.2, and v1.21.3 in v1.11.6 to address multiple CVEs.', + Hubble UI image update to v0.9.0 and removal of the extra Envoy proxy container + for the UI (could change resource footprint and what pods/containers you + see)., 'Default agent health check port changed to avoid conflicts (verify + any NetworkPolicies, firewalls, or health-check scraping assumptions).', + Fix/repair deprecated Kubernetes priority scheduling annotation to ensure + CNI agent is scheduled at high priority on newer Kubernetes versions.] + features: ['Security: Envoy updated to v1.21.3 in v1.11.6 to address moderate/high/critical + CVEs (host proxy hardening).', 'FQDN/DNS scalability: concurrency limiting + for DNS message processing plus multiple optimizations to reduce CPU/memory + under high FQDN policy load.', 'Observability/metrics: new/expanded metrics + around identities and FQDN datapath timeouts; improved DNS proxy error metrics + and active FQDN connection metrics.', 'Ops tooling: cilium-bugtool includes + more tc (traffic control) data and structured node/health output.'] + breaking_changes: ['Operational behavior change called out in v1.11.2: **GKE + users should change the node taint effect from `NoSchedule` to `NoExecute`** + for `node.cilium.io/agent-not-ready=true`. This can affect eviction behavior + during agent-not-ready windows.', 'Potentially user-visible default changes: + **agent health check port default changed** and **Hubble peer service default + ports changed to 80/443**; if you had network policies, firewall rules, + or custom scraping/health checks tied to prior defaults, validate and adjust.'] chart_version: 1.11.6 - images: - - quay.io/cilium/cilium:v1.11.6@sha256:f7f93c26739b6641a3fa3d76b1e1605b15989f25d06625260099e01c8243f54c - - quay.io/cilium/operator-generic:v1.11.6@sha256:9f6063c7bcaede801a39315ec7c166309f6a6783e98665f6693939cf1701bc17 + images: ['quay.io/cilium/cilium:v1.11.6@sha256:f7f93c26739b6641a3fa3d76b1e1605b15989f25d06625260099e01c8243f54c', + 'quay.io/cilium/operator-generic:v1.11.6@sha256:9f6063c7bcaede801a39315ec7c166309f6a6783e98665f6693939cf1701bc17'] - version: 1.11.2 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -17042,36 +14333,27 @@ addons: \ `--reuse-values` during upgrades (from 1.11.1 notes). For this patch upgrade,\ \ prefer an explicit `values.yaml` (or `helm get values` \u2192 review \u2192\ \ apply) to avoid carrying forward deprecated/incorrect defaults." - chart_updates: - - 'Helm: add values to allow custom ServiceMonitor annotations.' - - 'Helm: minor updates/maintenance (e.g., values.yaml link updates, release - tooling improvements) carried into this patch release.' - features: - - Envoy in the Cilium host proxy is updated to **v1.21.1**, addressing multiple - CVEs (low/moderate/high severity). - - 'Prometheus metrics: expose additional **XFRM (IPsec) statistics**.' - - 'Daemon: allow enabling the **Hubble PCAP recorder** even when not running - in load-balancer mode.' - - 'Config flexibility: `install-no-conntrack-iptables-rules` can be used when - **all masquerading is disabled**.' - breaking_changes: - - '**Operational change for GKE users:** update node taint from `node.cilium.io/agent-not-ready=true:NoSchedule` - to `node.cilium.io/agent-not-ready=true:NoExecute` to avoid scheduling/cleanup - issues when the agent is not ready. This is the most important action item - in 1.11.2.' - - '**Behavioral gotcha after first reboot (GKE/containerd flavors):** after - applying the fix, the *first* node reboot may still see pods get IPs from - the default CNI because `cilium-node-init` runs later; subsequent reboots - should behave correctly.' + chart_updates: ['Helm: add values to allow custom ServiceMonitor annotations.', + 'Helm: minor updates/maintenance (e.g., values.yaml link updates, release + tooling improvements) carried into this patch release.'] + features: ['Envoy in the Cilium host proxy is updated to **v1.21.1**, addressing + multiple CVEs (low/moderate/high severity).', 'Prometheus metrics: expose + additional **XFRM (IPsec) statistics**.', 'Daemon: allow enabling the **Hubble + PCAP recorder** even when not running in load-balancer mode.', 'Config flexibility: + `install-no-conntrack-iptables-rules` can be used when **all masquerading + is disabled**.'] + breaking_changes: ['**Operational change for GKE users:** update node taint + from `node.cilium.io/agent-not-ready=true:NoSchedule` to `node.cilium.io/agent-not-ready=true:NoExecute` + to avoid scheduling/cleanup issues when the agent is not ready. This is + the most important action item in 1.11.2.', '**Behavioral gotcha after first + reboot (GKE/containerd flavors):** after applying the fix, the *first* node + reboot may still see pods get IPs from the default CNI because `cilium-node-init` + runs later; subsequent reboots should behave correctly.'] chart_version: 1.11.2 - images: - - quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60 - - quay.io/cilium/operator-generic:v1.11.2@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7 + images: ['quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60', + 'quay.io/cilium/operator-generic:v1.11.2@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7'] - version: 1.11.1 - kube: - - '1.26' - - '1.25' - - '1.23' + kube: ['1.26', '1.25', '1.23'] requirements: [] incompatibilities: [] summary: @@ -17084,32 +14366,20 @@ addons: \ (doc change but operationally important):** Cilium explicitly warns **against\ \ using Helm `--reuse-values` during upgrades**; prefer a clean values file\ \ and/or `helm get values` + review.\n" - chart_updates: - - Fix Helm template for externalWorkloads. - - Fix Helm chart annotations for CRDs installed by Cilium. - features: - - No new user-facing features in 1.11.1; this is primarily a patch release focused - on stability and bugfixes. - - Underlying container images include upstream OS updates (security/bugfix refresh). - breaking_changes: - - No explicit breaking changes called out for 1.11.1 (patch release). However, - behavior may change if you rely on buggy prior behavior in areas fixed here - (FQDN policy, egress gateway, IPAM/IP release handshake, kube-proxy replacement - init/finalization). + chart_updates: [Fix Helm template for externalWorkloads., Fix Helm chart annotations + for CRDs installed by Cilium.] + features: [No new user-facing features in 1.11.1; this is primarily a patch + release focused on stability and bugfixes., Underlying container images + include upstream OS updates (security/bugfix refresh).] + breaking_changes: ['No explicit breaking changes called out for 1.11.1 (patch + release). However, behavior may change if you rely on buggy prior behavior + in areas fixed here (FQDN policy, egress gateway, IPAM/IP release handshake, + kube-proxy replacement init/finalization).'] chart_version: 1.11.1 - images: - - quay.io/cilium/cilium:v1.11.1@sha256:251ff274acf22fd2067b29a31e9fda94253d2961c061577203621583d7e85bd2 - - quay.io/cilium/operator-generic:v1.11.1@sha256:977240a4783c7be821e215ead515da3093a10f4a7baea9f803511a2c2b44a235 + images: ['quay.io/cilium/cilium:v1.11.1@sha256:251ff274acf22fd2067b29a31e9fda94253d2961c061577203621583d7e85bd2', + 'quay.io/cilium/operator-generic:v1.11.1@sha256:977240a4783c7be821e215ead515da3093a10f4a7baea9f803511a2c2b44a235'] - version: 1.11.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -17153,58 +14423,44 @@ addons: \ release notes; Helm chart version/changelog specifics aren\u2019t included.\ \ Treat the above as \u201Cthings to verify in values.yaml\u201D rather than\ \ an exhaustive Helm diff." - chart_updates: - - "Envoy/Proxy components updated across the stack; note that 1.10.8 updated\ - \ the host proxy to Envoy 1.21.1 for CVEs, while 1.11.0\u2019s listed Envoy\ - \ integration version is 1.18.4 (verify which applies to your deployed components\ - \ and images)." - - Helm chart cleanup and restructuring work is referenced (`cleanup helm chart`, - `Restructure helm chart into components`), which can change rendered object - names/labels and the shape of values. - - Improved device auto-detection (route-based) and expanded multi-device support - (notably for XDP acceleration) can change which interfaces Cilium programs - by default; re-check `devices` / `directRoutingDevice` overrides if you set - them previously. - - CiliumEndpointSlice feature introduced for scalability in CRD-only clusters; - may introduce additional CRDs/resources and changes in control-plane behavior - when enabled. - - Host firewall promoted to stable; if you enable host firewall, ensure your - policies and expectations match the now-stable feature status. - features: - - "OpenTelemetry export for Hubble L3\u2013L7 observability data (traces and\ - \ metrics)." - - New `kube-apiserver` policy entity to simplify modeling policy to/from the - Kubernetes API server. - - "Topology-aware load balancing using Kubernetes service topology hints to\ - \ prefer \u201Cclosest\u201D backends." - - BGP PodCIDR route advertisement support. - - Graceful service backend termination to drain connections when endpoints are - removed/terminated. - - Host firewall promoted to stable for production use. - - Load balancer scalability improvements (supporting >64K backends) and improved - XDP fast-path support for bonded/multi-device setups. - - CiliumEndpointSlice for improved scalability in CRD-only clusters (1000+ nodes - without requiring an etcd kvstore). - breaking_changes: - - 'Default install behavior changes: kube-proxy replacement is **disabled by - default** in 1.11; clusters relying on it must explicitly enable it during/after - upgrade.' - - Some flags/configuration names changed or deprecated (notably egress gateway - flag rename to `enable-ipv4-egress-gateway`, and `nativeRoutingCIDR` deprecation - in favor of `ipv4NativeRoutingCIDR`), which can break upgrades if you pass - old flags via Helm. - - 'Known issue: ToFQDN rules can become ineffective after modifying a policy - selecting a pod; mitigation is to apply all policies then restart the agent - or affected pods.' + chart_updates: ["Envoy/Proxy components updated across the stack; note that\ + \ 1.10.8 updated the host proxy to Envoy 1.21.1 for CVEs, while 1.11.0\u2019\ + s listed Envoy integration version is 1.18.4 (verify which applies to your\ + \ deployed components and images).", 'Helm chart cleanup and restructuring + work is referenced (`cleanup helm chart`, `Restructure helm chart into components`), + which can change rendered object names/labels and the shape of values.', + Improved device auto-detection (route-based) and expanded multi-device support + (notably for XDP acceleration) can change which interfaces Cilium programs + by default; re-check `devices` / `directRoutingDevice` overrides if you + set them previously., CiliumEndpointSlice feature introduced for scalability + in CRD-only clusters; may introduce additional CRDs/resources and changes + in control-plane behavior when enabled., 'Host firewall promoted to stable; + if you enable host firewall, ensure your policies and expectations match + the now-stable feature status.'] + features: ["OpenTelemetry export for Hubble L3\u2013L7 observability data (traces\ + \ and metrics).", New `kube-apiserver` policy entity to simplify modeling + policy to/from the Kubernetes API server., "Topology-aware load balancing\ + \ using Kubernetes service topology hints to prefer \u201Cclosest\u201D\ + \ backends.", BGP PodCIDR route advertisement support., Graceful service + backend termination to drain connections when endpoints are removed/terminated., + Host firewall promoted to stable for production use., Load balancer scalability + improvements (supporting >64K backends) and improved XDP fast-path support + for bonded/multi-device setups., CiliumEndpointSlice for improved scalability + in CRD-only clusters (1000+ nodes without requiring an etcd kvstore).] + breaking_changes: ['Default install behavior changes: kube-proxy replacement + is **disabled by default** in 1.11; clusters relying on it must explicitly + enable it during/after upgrade.', 'Some flags/configuration names changed + or deprecated (notably egress gateway flag rename to `enable-ipv4-egress-gateway`, + and `nativeRoutingCIDR` deprecation in favor of `ipv4NativeRoutingCIDR`), + which can break upgrades if you pass old flags via Helm.', 'Known issue: + ToFQDN rules can become ineffective after modifying a policy selecting a + pod; mitigation is to apply all policies then restart the agent or affected + pods.'] chart_version: 1.11.0 - images: - - quay.io/cilium/cilium:v1.11.0@sha256:ea677508010800214b0b5497055f38ed3bff57963fa2399bcb1c69cf9476453a - - quay.io/cilium/operator-generic:v1.11.0@sha256:b522279577d0d5f1ad7cadaacb7321d1b172d8ae8c8bc816e503c897b420cfe3 + images: ['quay.io/cilium/cilium:v1.11.0@sha256:ea677508010800214b0b5497055f38ed3bff57963fa2399bcb1c69cf9476453a', + 'quay.io/cilium/operator-generic:v1.11.0@sha256:b522279577d0d5f1ad7cadaacb7321d1b172d8ae8c8bc816e503c897b420cfe3'] - version: 1.10.12 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -17220,37 +14476,30 @@ addons: \ introduced for this purpose.\n\n> Note: The provided notes are from application\ \ release notes and include a few `helm:` items; confirm the exact key names\ \ in the chart values for your specific chart version." - chart_updates: - - Envoy sidecar/proxy image for Cilium updated to **v1.21.3** (security CVE - fixes). - - Cilium UI updated to **v0.9.0** images and **drops the Envoy proxy container** - for the UI deployment (pod spec changes). - - Bugtool output expanded (additional `tc` data; structured node/health output). - - 'Clustermesh: `CiliumNode` objects get `ownerReferences` (K8s object lifecycle/GC - behavior change).' - - Kubernetes library versions updated (to v1.21.11 in this patch line). - features: - - 'Improved FQDN scalability under load: concurrency limiting for DNS message - processing and reduced lock contention during bursty DNS traffic.' - - 'New/expanded observability: additional metrics for identity type labels, - active FQDN connections per endpoint, improved DNS proxy error metrics, and - a counter for datapath timeouts due to FQDN IP updates.' - breaking_changes: - - Potential behavior changes due to **default port changes** (agent health check - port; Hubble peer service default ports 80/443). If you have firewalls, NetworkPolicies, - or monitoring scraping the old ports, update them accordingly. - - 'UI deployment change: UI images updated and the **Envoy proxy container removed**; - if you had customizations or assumptions about that container (resources, - security context, sidecar-based routing), re-validate after upgrade.' + chart_updates: [Envoy sidecar/proxy image for Cilium updated to **v1.21.3** + (security CVE fixes)., Cilium UI updated to **v0.9.0** images and **drops + the Envoy proxy container** for the UI deployment (pod spec changes)., Bugtool + output expanded (additional `tc` data; structured node/health output)., + 'Clustermesh: `CiliumNode` objects get `ownerReferences` (K8s object lifecycle/GC + behavior change).', Kubernetes library versions updated (to v1.21.11 in + this patch line).] + features: ['Improved FQDN scalability under load: concurrency limiting for DNS + message processing and reduced lock contention during bursty DNS traffic.', + 'New/expanded observability: additional metrics for identity type labels, + active FQDN connections per endpoint, improved DNS proxy error metrics, + and a counter for datapath timeouts due to FQDN IP updates.'] + breaking_changes: ['Potential behavior changes due to **default port changes** + (agent health check port; Hubble peer service default ports 80/443). If + you have firewalls, NetworkPolicies, or monitoring scraping the old ports, + update them accordingly.', 'UI deployment change: UI images updated and + the **Envoy proxy container removed**; if you had customizations or assumptions + about that container (resources, security context, sidecar-based routing), + re-validate after upgrade.'] chart_version: 1.10.12 - images: - - quay.io/cilium/cilium:v1.10.12@sha256:6a119c4f249d42df0d5654295ac9466da117f9b838ff48b4bc64234f7ab20b80 - - quay.io/cilium/operator-generic:v1.10.12@sha256:35288de36cd1b6fe65e55a9b878100c2ab92ac88ed6a3ab04326e00326cff3f7 + images: ['quay.io/cilium/cilium:v1.10.12@sha256:6a119c4f249d42df0d5654295ac9466da117f9b838ff48b4bc64234f7ab20b80', + 'quay.io/cilium/operator-generic:v1.10.12@sha256:35288de36cd1b6fe65e55a9b878100c2ab92ac88ed6a3ab04326e00326cff3f7'] - version: 1.10.8 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -17261,27 +14510,20 @@ addons: \ Release notes reiterate **avoid `helm upgrade --reuse-values`** for Cilium.\ \ Prefer supplying an explicit values file (or diffing defaults between chart\ \ versions) to avoid silently carrying forward deprecated/changed defaults." - chart_updates: - - Helm chart exposes new knobs for ServiceMonitor annotations (Prometheus Operator - integration). - - 'Installation manifests/images updated: Envoy (host proxy) bumped to v1.21.1; - base images and image digests refreshed for v1.10.8.' - features: - - Prometheus metrics now include **XFRM (IPsec) statistics**, improving visibility - into IPsec/XFRM behavior and troubleshooting. - - Helm chart can now **apply custom annotations to ServiceMonitors**, useful - for Prometheus Operator setups (scrape configs, relabeling, tenant metadata, - etc.). + chart_updates: [Helm chart exposes new knobs for ServiceMonitor annotations + (Prometheus Operator integration)., 'Installation manifests/images updated: + Envoy (host proxy) bumped to v1.21.1; base images and image digests refreshed + for v1.10.8.'] + features: ['Prometheus metrics now include **XFRM (IPsec) statistics**, improving + visibility into IPsec/XFRM behavior and troubleshooting.', 'Helm chart can + now **apply custom annotations to ServiceMonitors**, useful for Prometheus + Operator setups (scrape configs, relabeling, tenant metadata, etc.).'] breaking_changes: [] chart_version: 1.10.8 - images: - - quay.io/cilium/cilium:v1.10.8@sha256:e6147e39a03c685e5f1225c5642e1358dcd4899bbd94e8a043bb4be52cd2f008 - - quay.io/cilium/operator-generic:v1.10.8@sha256:a77dff6103d047d8810ea5e80067b2fade6d099771c8dda197bdba5e4e2f0255 + images: ['quay.io/cilium/cilium:v1.10.8@sha256:e6147e39a03c685e5f1225c5642e1358dcd4899bbd94e8a043bb4be52cd2f008', + 'quay.io/cilium/operator-generic:v1.10.8@sha256:a77dff6103d047d8810ea5e80067b2fade6d099771c8dda197bdba5e4e2f0255'] - version: 1.10.7 - kube: - - '1.26' - - '1.25' - - '1.23' + kube: ['1.26', '1.25', '1.23'] requirements: [] incompatibilities: [] summary: @@ -17308,43 +14550,32 @@ addons: \ service)\n - Support for **external serviceAccounts** (if you manage RBAC\ \ externally)\n\nIf you share your current `values.yaml`, we can map old keys\ \ to new ones precisely." - chart_updates: - - Cilium 1.10 introduced multiple Helm chart refactors that still apply when - upgrading within the 1.10 patch line, including moving/renaming values blocks - (notably encryption and ENI). - - 1.10.7 includes a manifest change adding `mountPropagation` to the `bpf-maps` - volume in the Cilium DaemonSet (important if you rely on BPF map mounts/persistence). - - "1.10.7 refreshes underlying container image digests (agent, operator variants,\ - \ hubble-relay, etc.), so expect new image SHAs even if your values don\u2019\ - t change." - features: - - Standalone load-balancer datapath mode (`--datapath-mode=lb`) for running - Cilium as an L4 LB without full CNI duties. - - WireGuard pod-to-pod encryption integration and Helm consolidation of encryption - configuration options. - - BGP-based LoadBalancer external IP allocation/announcement, plus the egress - gateway feature toggle in Helm for controlled rollout. - - ARM64 support (multi-arch images) enabling Cilium to run on arm64 nodes. - - Kubernetes 1.21 support and raised minimum supported Kubernetes version to - 1.16. - breaking_changes: - - Kubernetes minimum supported version increased to **1.16** (from older 1.9.x - support); clusters below 1.16 cannot upgrade to 1.10.x. - - "Helm values breaking changes: `extraArgs` changed structure (object \u2192\ - \ array) and encryption/IPSec settings were moved under `encryption.*`; upgrades\ - \ that blindly reuse old values can fail or silently misconfigure encryption." + chart_updates: ['Cilium 1.10 introduced multiple Helm chart refactors that still + apply when upgrading within the 1.10 patch line, including moving/renaming + values blocks (notably encryption and ENI).', 1.10.7 includes a manifest + change adding `mountPropagation` to the `bpf-maps` volume in the Cilium + DaemonSet (important if you rely on BPF map mounts/persistence)., "1.10.7\ + \ refreshes underlying container image digests (agent, operator variants,\ + \ hubble-relay, etc.), so expect new image SHAs even if your values don\u2019\ + t change."] + features: [Standalone load-balancer datapath mode (`--datapath-mode=lb`) for + running Cilium as an L4 LB without full CNI duties., WireGuard pod-to-pod + encryption integration and Helm consolidation of encryption configuration + options., 'BGP-based LoadBalancer external IP allocation/announcement, plus + the egress gateway feature toggle in Helm for controlled rollout.', ARM64 + support (multi-arch images) enabling Cilium to run on arm64 nodes., Kubernetes + 1.21 support and raised minimum supported Kubernetes version to 1.16.] + breaking_changes: [Kubernetes minimum supported version increased to **1.16** + (from older 1.9.x support); clusters below 1.16 cannot upgrade to 1.10.x., + "Helm values breaking changes: `extraArgs` changed structure (object \u2192\ + \ array) and encryption/IPSec settings were moved under `encryption.*`;\ + \ upgrades that blindly reuse old values can fail or silently misconfigure\ + \ encryption."] chart_version: 1.10.7 - images: - - quay.io/cilium/cilium:v1.10.7@sha256:e23f55e80e1988db083397987a89967aa204ad6fc32da243b9160fbcea29b0ca - - quay.io/cilium/operator-generic:v1.10.7@sha256:d0b491d8d8cb45862ed7f0410f65e7c141832f0f95262643fa5ff1edfcddcafe + images: ['quay.io/cilium/cilium:v1.10.7@sha256:e23f55e80e1988db083397987a89967aa204ad6fc32da243b9160fbcea29b0ca', + 'quay.io/cilium/operator-generic:v1.10.7@sha256:d0b491d8d8cb45862ed7f0410f65e7c141832f0f95262643fa5ff1edfcddcafe'] - version: 1.10.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: @@ -17372,97 +14603,68 @@ addons: \ using IAM roles for service accounts on `cilium-operator`.\n\n- **TLS secret\ \ content**:\n - Helm adds `ca.crt` to TLS secrets (relevant if you manage/override\ \ those secrets).\n" - chart_updates: - - 'Helm chart refactors for 1.10: encryption values consolidation and IPsec - values moved under `encryption.ipsec`.' - - Helm `extraArgs` values schema changed from map/object to array/list form. - - Helm added support for pinning images via digest flags. - - Helm added options for egress gateway, k8s event handover, proxy Prometheus - service toggle, EndpointStatus, and expanded ServiceAccount controls (including - external SAs). - - Helm reorganized/expanded ENI configuration into a top-level `eni` block and - added `eni.iamRole` for IRSA-style setups. - - Helm TLS secrets now include `ca.crt`. - features: - - Standalone load balancer datapath mode via `--datapath-mode=lb` (run cilium-agent - as an LB without full CNI). - - WireGuard integration for pod-to-pod encryption, including support for managed - Kubernetes environments. - - Service LoadBalancer external IP allocation and announcement via BGP. - - Egress Gateway support (control plane + datapath), exposed via a Helm option. - - NodePort BPF support on L2-less devices (e.g., WireGuard/tun). - - ARM64 support for building and installing Cilium. - - 'Kubernetes support updated: adds support for K8s 1.21 and raises minimum - supported K8s to 1.16.' - breaking_changes: - - Minimum supported Kubernetes version is now **1.16** (clusters older than - 1.16 are unsupported). - - '`kube-proxy-replacement` is **disabled by default** for new installs (if - you relied on kube-proxy replacement previously, you must explicitly enable/configure - it).' - - "Helm values breaking change: `extraArgs` schema changed (map/object \u279C\ - \ array/list), requiring `values.yaml` updates." - - 'Helm values breaking change: IPsec/WireGuard encryption options were reorganized - (IPsec options moved under `encryption.ipsec`).' - - Managed etcd mode is deprecated (plan migration away if you are using Cilium-managed - etcd). - - Legacy flannel integration was removed (clusters depending on it must use - supported CNI/chaining modes). + chart_updates: ['Helm chart refactors for 1.10: encryption values consolidation + and IPsec values moved under `encryption.ipsec`.', Helm `extraArgs` values + schema changed from map/object to array/list form., Helm added support for + pinning images via digest flags., 'Helm added options for egress gateway, + k8s event handover, proxy Prometheus service toggle, EndpointStatus, and + expanded ServiceAccount controls (including external SAs).', Helm reorganized/expanded + ENI configuration into a top-level `eni` block and added `eni.iamRole` for + IRSA-style setups., Helm TLS secrets now include `ca.crt`.] + features: [Standalone load balancer datapath mode via `--datapath-mode=lb` (run + cilium-agent as an LB without full CNI)., 'WireGuard integration for pod-to-pod + encryption, including support for managed Kubernetes environments.', Service + LoadBalancer external IP allocation and announcement via BGP., 'Egress Gateway + support (control plane + datapath), exposed via a Helm option.', 'NodePort + BPF support on L2-less devices (e.g., WireGuard/tun).', ARM64 support for + building and installing Cilium., 'Kubernetes support updated: adds support + for K8s 1.21 and raises minimum supported K8s to 1.16.'] + breaking_changes: [Minimum supported Kubernetes version is now **1.16** (clusters + older than 1.16 are unsupported)., '`kube-proxy-replacement` is **disabled + by default** for new installs (if you relied on kube-proxy replacement previously, + you must explicitly enable/configure it).', "Helm values breaking change:\ + \ `extraArgs` schema changed (map/object \u279C array/list), requiring `values.yaml`\ + \ updates.", 'Helm values breaking change: IPsec/WireGuard encryption options + were reorganized (IPsec options moved under `encryption.ipsec`).', Managed + etcd mode is deprecated (plan migration away if you are using Cilium-managed + etcd)., Legacy flannel integration was removed (clusters depending on it + must use supported CNI/chaining modes).] chart_version: 1.10.0 - images: - - quay.io/cilium/cilium:v1.10.0@sha256:587627d909ffe0418c0bd907516496844867a21812946af82096d367760e4c1e - - quay.io/cilium/operator-generic:v1.10.0@sha256:65143311a62a95dbe23c69ff2f624e0fdf030eb225e6375d889da66a955dd828 + images: ['quay.io/cilium/cilium:v1.10.0@sha256:587627d909ffe0418c0bd907516496844867a21812946af82096d367760e4c1e', + 'quay.io/cilium/operator-generic:v1.10.0@sha256:65143311a62a95dbe23c69ff2f624e0fdf030eb225e6375d889da66a955dd828'] - version: 1.9.17 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Envoy (Cilium host proxy) is updated across the patch range (v1.21.1 in 1.9.13; - v1.21.3 by 1.9.17) to address multiple CVEs. - - Improved DNS proxy error metrics/observability in 1.9.17. + features: [Envoy (Cilium host proxy) is updated across the patch range (v1.21.1 + in 1.9.13; v1.21.3 by 1.9.17) to address multiple CVEs., Improved DNS proxy + error metrics/observability in 1.9.17.] breaking_changes: [] chart_version: 1.9.17 - images: - - quay.io/cilium/cilium:v1.9.17 - - quay.io/cilium/operator-generic:v1.9.17 + images: ['quay.io/cilium/cilium:v1.9.17', 'quay.io/cilium/operator-generic:v1.9.17'] - version: 1.9.13 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart changelog was provided in the notes; only application (Cilium) - release notes were included. - - Expect container image tags/digests to change to v1.9.13 for cilium, operator, - hubble-relay, clustermesh-apiserver, etc. If you pin digests, update them - accordingly. - - Envoy (Cilium host proxy) is updated; if you run L7 policies/ingress with - the host proxy, plan for a rolling restart and validate Envoy config compatibility. - features: - - 'Security update: Cilium host proxy (Envoy) updated to v1.21.1 to address - multiple CVEs.' - - Operational reliability improvements via several bug fixes affecting networking - and node lifecycle edge-cases. + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [No Helm chart changelog was provided in the notes; only application + (Cilium) release notes were included., 'Expect container image tags/digests + to change to v1.9.13 for cilium, operator, hubble-relay, clustermesh-apiserver, + etc. If you pin digests, update them accordingly.', 'Envoy (Cilium host + proxy) is updated; if you run L7 policies/ingress with the host proxy, plan + for a rolling restart and validate Envoy config compatibility.'] + features: ['Security update: Cilium host proxy (Envoy) updated to v1.21.1 to + address multiple CVEs.', Operational reliability improvements via several + bug fixes affecting networking and node lifecycle edge-cases.] breaking_changes: [] chart_version: 1.9.13 - images: - - quay.io/cilium/cilium:v1.9.13 - - quay.io/cilium/operator-generic:v1.9.13 + images: ['quay.io/cilium/cilium:v1.9.13', 'quay.io/cilium/operator-generic:v1.9.13'] - version: 1.9.12 - kube: - - '1.26' - - '1.25' - - '1.23' + kube: ['1.26', '1.25', '1.23'] requirements: [] incompatibilities: [] summary: @@ -17483,57 +14685,37 @@ addons: \ LB settings).\n- The installation docs mention **hubble-ui image reference\ \ fixes** and repository changes (ensure your Helm values don\u2019t pin old\ \ hubble-ui image repos/tags).\n" - chart_updates: - - '1.9.12: Updates underlying container base images and image digests; includes - a fix for hubble-ui-backend image deployment and hubble-ui image reference - corrections.' - - '1.9.0: Helm charts were fully restructured into a single `cilium` chart (no - subcharts) with many values re-scoped; Helm 3 minimum enforced and Helm 2 - dropped.' - - '1.9.0: Chart removed PodSecurityPolicy templates.' - - '1.9.0: Operator/Agent behavior around CRDs changed: operator handles CRD - operations and agent waits for CRDs to be available.' - features: - - (1.9.0) Deny policies added (policy can explicitly deny traffic, not just - allow). - - (1.9.0) Maglev consistent hashing support for kube-proxy replacement Services - (NodePort/LoadBalancer/externalIPs). - - (1.9.0) Cilium operator HA mode. - - (1.9.0) Beta support for external workloads (e.g., VMs) and Services for those - workloads. - - (1.9.0) Various observability/Hubble improvements including (m)TLS support - and additional flow filtering/metrics. - breaking_changes: - - (1.9.0) Helm chart restructuring (single chart, values re-scoped) can break - upgrades if you reuse old `values.yaml` without mapping renamed/moved keys. - - (1.9.0) Helm 2 support removed; requires Helm 3. - - (1.9.0) PodSecurityPolicy manifests removed; clusters relying on PSP-based - admission need an alternative (or accept changed security enforcement). - - (1.9.0) Removal/deprecation of several agent/operator options and DNS poller - removal may break automation/scripts that referenced those flags or behavior. - - (1.9.0) `blacklist-conflicting-routes` agent option removed; routing conflicts - with PodCIDR must now be handled by the user/operator outside Cilium. + chart_updates: ['1.9.12: Updates underlying container base images and image + digests; includes a fix for hubble-ui-backend image deployment and hubble-ui + image reference corrections.', '1.9.0: Helm charts were fully restructured + into a single `cilium` chart (no subcharts) with many values re-scoped; + Helm 3 minimum enforced and Helm 2 dropped.', '1.9.0: Chart removed PodSecurityPolicy + templates.', '1.9.0: Operator/Agent behavior around CRDs changed: operator + handles CRD operations and agent waits for CRDs to be available.'] + features: ['(1.9.0) Deny policies added (policy can explicitly deny traffic, + not just allow).', (1.9.0) Maglev consistent hashing support for kube-proxy + replacement Services (NodePort/LoadBalancer/externalIPs)., (1.9.0) Cilium + operator HA mode., '(1.9.0) Beta support for external workloads (e.g., VMs) + and Services for those workloads.', (1.9.0) Various observability/Hubble + improvements including (m)TLS support and additional flow filtering/metrics.] + breaking_changes: ['(1.9.0) Helm chart restructuring (single chart, values re-scoped) + can break upgrades if you reuse old `values.yaml` without mapping renamed/moved + keys.', (1.9.0) Helm 2 support removed; requires Helm 3., (1.9.0) PodSecurityPolicy + manifests removed; clusters relying on PSP-based admission need an alternative + (or accept changed security enforcement)., (1.9.0) Removal/deprecation of + several agent/operator options and DNS poller removal may break automation/scripts + that referenced those flags or behavior., (1.9.0) `blacklist-conflicting-routes` + agent option removed; routing conflicts with PodCIDR must now be handled + by the user/operator outside Cilium.] chart_version: 1.9.12 - images: - - quay.io/cilium/cilium:v1.9.12 - - quay.io/cilium/operator-generic:v1.9.12 + images: ['quay.io/cilium/cilium:v1.9.12', 'quay.io/cilium/operator-generic:v1.9.12'] - version: 1.9.0 - kube: - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' + kube: ['1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', '1.12'] requirements: [] incompatibilities: [] summary: null chart_version: 1.9.0 - images: - - quay.io/cilium/cilium:v1.9.0 - - quay.io/cilium/operator-generic:v1.9.0 + images: ['quay.io/cilium/cilium:v1.9.0', 'quay.io/cilium/operator-generic:v1.9.0'] name: cilium - icon: https://avatars.githubusercontent.com/u/54918165?s=48&v=4 git_url: https://github.com/projectcontour/contour @@ -17542,567 +14724,371 @@ addons: eolApiSlug: contour versions: - version: 1.32.1 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Envoy dependency bumped from v1.34.1 to v1.34.4, bringing in upstream fixes - and changes from Envoy 1.34.4. - - Go toolchain/runtime bumped from v1.24.3 to v1.24.6. + features: ['Envoy dependency bumped from v1.34.1 to v1.34.4, bringing in upstream + fixes and changes from Envoy 1.34.4.', Go toolchain/runtime bumped from + v1.24.3 to v1.24.6.] breaking_changes: [] chart_version: 21.1.4 - images: - - docker.io/bitnami/contour:1.32.1-debian-12-r0 - - docker.io/bitnami/envoy:1.34.5-debian-12-r0 + images: ['docker.io/bitnami/contour:1.32.1-debian-12-r0', 'docker.io/bitnami/envoy:1.34.5-debian-12-r0'] - version: 1.32.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Improved performance in clusters with many endpoints by switching EDS caching - to go-control-plane LinearCache. - - "Bumped supported/tested Kubernetes versions to 1.31\u20131.33 and updated\ - \ CI/e2e kind node image accordingly." - - 'Updated bundled dependencies: Envoy to v1.34.1 and Go to 1.24.3.' - - Fixed the `contour` CLI xDS discovery behavior so subsequent DiscoveryRequests - include the requested resource names, not only the first request. + features: [Improved performance in clusters with many endpoints by switching + EDS caching to go-control-plane LinearCache., "Bumped supported/tested Kubernetes\ + \ versions to 1.31\u20131.33 and updated CI/e2e kind node image accordingly.", + 'Updated bundled dependencies: Envoy to v1.34.1 and Go to 1.24.3.', 'Fixed + the `contour` CLI xDS discovery behavior so subsequent DiscoveryRequests + include the requested resource names, not only the first request.'] breaking_changes: [] chart_version: 21.1.2 - images: - - docker.io/bitnami/contour:1.32.0-debian-12-r8 - - docker.io/bitnami/envoy:1.34.4-debian-12-r0 + images: ['docker.io/bitnami/contour:1.32.0-debian-12-r8', 'docker.io/bitnami/envoy:1.34.4-debian-12-r0'] - version: 1.31.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "External authorization enhancements: you can now disable Global ExtAuth by\ - \ default and selectively re-enable it at vhost/route level; additionally,\ - \ ExtAuth is no longer enforced on HTTP\u2192HTTPS redirect responses (avoids\ - \ 401s on redirect)." - - "Envoy overload protections: new bootstrap flag `overload-downstream-max-conn`\ - \ enables Envoy\u2019s global downstream connection limit; admin listeners\ - \ ignore the global limit so stats/admin remain reachable, and there\u2019\ - s a new health-check config option to make readiness/liveness respect overload\ - \ rejection behavior." - - Gateway API compatibility bumped to v1.2.1. - - 'Operational/config additions: configurable HTTP compression algorithm (gzip/brotli/zstd/disabled), - new `strip-trailing-host-dot` request handling option, support for Service - `appProtocol` http/https, expanded retryOn conditions, and more redirect status - codes (303/307/308) for requestRedirectPolicy.' - - "Dependency/platform updates: Envoy updated to v1.34.0; Go updated to 1.24.2;\ - \ tested Kubernetes versions now 1.30\u20131.32; plus bugfixes for follower\ - \ readiness and memory leak." - breaking_changes: - - "Removal: legacy `contour` xDS server implementation removed; go-control-plane\ - \ xDS server is now the only supported option. Corresponding config fields\ - \ that selected xDS server type have been removed\u2014configs referencing\ - \ them must be cleaned up before/while upgrading." - - 'Removal: `useEndpointSlices` feature flag and remaining Endpoints-path code - removed. Any setups that explicitly forced Endpoints API (or relied on disabling - EndpointSlice mirroring) must be updated; Contour now always uses EndpointSlices.' + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["External authorization enhancements: you can now disable Global\ + \ ExtAuth by default and selectively re-enable it at vhost/route level;\ + \ additionally, ExtAuth is no longer enforced on HTTP\u2192HTTPS redirect\ + \ responses (avoids 401s on redirect).", "Envoy overload protections: new\ + \ bootstrap flag `overload-downstream-max-conn` enables Envoy\u2019s global\ + \ downstream connection limit; admin listeners ignore the global limit so\ + \ stats/admin remain reachable, and there\u2019s a new health-check config\ + \ option to make readiness/liveness respect overload rejection behavior.", + Gateway API compatibility bumped to v1.2.1., 'Operational/config additions: + configurable HTTP compression algorithm (gzip/brotli/zstd/disabled), new + `strip-trailing-host-dot` request handling option, support for Service `appProtocol` + http/https, expanded retryOn conditions, and more redirect status codes + (303/307/308) for requestRedirectPolicy.', "Dependency/platform updates:\ + \ Envoy updated to v1.34.0; Go updated to 1.24.2; tested Kubernetes versions\ + \ now 1.30\u20131.32; plus bugfixes for follower readiness and memory leak."] + breaking_changes: ["Removal: legacy `contour` xDS server implementation removed;\ + \ go-control-plane xDS server is now the only supported option. Corresponding\ + \ config fields that selected xDS server type have been removed\u2014configs\ + \ referencing them must be cleaned up before/while upgrading.", 'Removal: + `useEndpointSlices` feature flag and remaining Endpoints-path code removed. + Any setups that explicitly forced Endpoints API (or relied on disabling + EndpointSlice mirroring) must be updated; Contour now always uses EndpointSlices.'] chart_version: 20.0.1 - images: - - docker.io/bitnami/contour:1.31.0-debian-12-r2 - - docker.io/bitnami/envoy:1.34.1-debian-12-r0 + images: ['docker.io/bitnami/contour:1.31.0-debian-12-r2', 'docker.io/bitnami/envoy:1.34.1-debian-12-r0'] - version: 1.30.0 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Gateway API: Implement Listener/Route hostname isolation so requests are - routed to the most specific matching Listener and its attached routes.' - - Monitoring examples updated to expose Envoy metrics on port 8002 and to use - Prometheus Operator `PodMonitor` resources (instead of `prometheus.io/*` annotations). - - Gateway API compatibility updated to v1.1.0 (includes GRPCRoute now GA/v1). - - Circuit breaker configuration added for Extension Services, with PerHostMaxConnections - also configurable globally. - - Fallback certificate handling now applies global external auth (Global ExtAuth) - filters. - - 'Gateway API: GRPCRoute match conflict handling now mirrors HTTPRoute behavior - (oldest wins, then alphabetical; sets Accepted/PartiallyInvalid conditions).' - breaking_changes: - - Gateway API v1.1.0 includes breaking changes to `BackendTLSPolicy`, moving - it to `v1alpha3`; users must uninstall v1alpha2 CRD before installing the - new one. - - 'Deprecated: sample manifests and Gateway provisioner no longer add `prometheus.io/*` - scrape annotations; monitoring should move to `PodMonitor`/Prometheus Operator - flow.' - - 'Deprecated: xDS server type fields in the config file and ContourConfiguration - CRD are now deprecated and planned for removal in 1.31 (along with the legacy - `contour` xDS implementation).' + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Gateway API: Implement Listener/Route hostname isolation so requests + are routed to the most specific matching Listener and its attached routes.', + Monitoring examples updated to expose Envoy metrics on port 8002 and to use + Prometheus Operator `PodMonitor` resources (instead of `prometheus.io/*` + annotations)., Gateway API compatibility updated to v1.1.0 (includes GRPCRoute + now GA/v1)., 'Circuit breaker configuration added for Extension Services, + with PerHostMaxConnections also configurable globally.', Fallback certificate + handling now applies global external auth (Global ExtAuth) filters., 'Gateway + API: GRPCRoute match conflict handling now mirrors HTTPRoute behavior (oldest + wins, then alphabetical; sets Accepted/PartiallyInvalid conditions).'] + breaking_changes: ['Gateway API v1.1.0 includes breaking changes to `BackendTLSPolicy`, + moving it to `v1alpha3`; users must uninstall v1alpha2 CRD before installing + the new one.', 'Deprecated: sample manifests and Gateway provisioner no + longer add `prometheus.io/*` scrape annotations; monitoring should move + to `PodMonitor`/Prometheus Operator flow.', 'Deprecated: xDS server type + fields in the config file and ContourConfiguration CRD are now deprecated + and planned for removal in 1.31 (along with the legacy `contour` xDS implementation).'] chart_version: 19.2.1 - images: - - docker.io/bitnami/contour:1.30.0-debian-12-r6 - - docker.io/bitnami/envoy:1.31.2-debian-12-r0 + images: ['docker.io/bitnami/contour:1.30.0-debian-12-r6', 'docker.io/bitnami/envoy:1.31.2-debian-12-r0'] eolAt: '2025-09-08' - version: 1.29.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 18.2.3 - images: - - docker.io/bitnami/contour:1.29.0-debian-12-r1 - - docker.io/bitnami/envoy:1.29.5-debian-12-r0 + images: ['docker.io/bitnami/contour:1.29.0-debian-12-r1', 'docker.io/bitnami/envoy:1.29.5-debian-12-r0'] eolAt: '2025-05-15' - version: 1.28.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null eolAt: '2025-05-06' - version: 1.27.0 - kube: - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Fixes path match sorting for Prefix/Regex routes so longer patterns are ordered - first (then lexicographic for ties), improving match specificity consistency - across HTTPProxy inclusion, Ingress, and Gateway API. - - 'Routes can disable an inherited virtualhost global rate limit policy via - `rateLimitPolicy.global.disabled: true` at the route level.' - - Contour waits for informer cache sync *and* handler processing before starting - DAG rebuild and serving XDS, improving startup correctness. - - HTTPProxy supports dynamic Host header rewrites using request header variables - (route-level only). - - Optional EndpointSlice support added behind `useEndpointSlices` feature flag - (off by default). - - 'Adds listener config knobs for HTTP/2 DoS mitigation/tuning: `listener.max-requests-per-io-cycle` - and `listener.http2-max-concurrent-streams`.' - - Gateway provisioner can run in/out of cluster via `--incluster`/`--kubeconfig` - flags and supports `overloadMaxHeapSize` for Envoy overload manager bootstrap - config. - - Gateway API listener `ResolvedRefs` condition now defaults to true; webhook - removed from example manifests since Gateway API validation uses CEL. - - 'Build/runtime dependency bumps: Go 1.21.3 and Envoy 1.28.0.' - breaking_changes: - - Route ordering may change for some combinations of Prefix/Regex path matches - due to the new sorting algorithm; this can alter which route matches first - in large/complex routing tables. Validate route order and behavior before/after - upgrade. + kube: ['1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Fixes path match sorting for Prefix/Regex routes so longer patterns + are ordered first (then lexicographic for ties), improving match specificity + consistency across HTTPProxy inclusion, Ingress, and Gateway API.', 'Routes + can disable an inherited virtualhost global rate limit policy via `rateLimitPolicy.global.disabled: + true` at the route level.', 'Contour waits for informer cache sync *and* + handler processing before starting DAG rebuild and serving XDS, improving + startup correctness.', HTTPProxy supports dynamic Host header rewrites using + request header variables (route-level only)., Optional EndpointSlice support + added behind `useEndpointSlices` feature flag (off by default)., 'Adds listener + config knobs for HTTP/2 DoS mitigation/tuning: `listener.max-requests-per-io-cycle` + and `listener.http2-max-concurrent-streams`.', Gateway provisioner can run + in/out of cluster via `--incluster`/`--kubeconfig` flags and supports `overloadMaxHeapSize` + for Envoy overload manager bootstrap config., Gateway API listener `ResolvedRefs` + condition now defaults to true; webhook removed from example manifests since + Gateway API validation uses CEL., 'Build/runtime dependency bumps: Go 1.21.3 + and Envoy 1.28.0.'] + breaking_changes: [Route ordering may change for some combinations of Prefix/Regex + path matches due to the new sorting algorithm; this can alter which route + matches first in large/complex routing tables. Validate route order and + behavior before/after upgrade.] chart_version: 15.4.0 - images: - - docker.io/bitnami/contour:1.27.0-debian-11-r9 - - docker.io/bitnami/envoy:1.27.2-debian-11-r8 + images: ['docker.io/bitnami/contour:1.27.0-debian-11-r9', 'docker.io/bitnami/envoy:1.27.2-debian-11-r8'] eolAt: '2024-07-31' - version: 1.26.0 - kube: - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Gateway API: Gateway listeners can now be configured on more than two ports - (multiple HTTP and multiple HTTPS/TLS listeners). If using the Contour Gateway - Provisioner, the Envoy Service will automatically expose ports for all valid - listeners.' - - 'Gateway API: TCPRoute is now supported for simple TCP forwarding on a listener - port, and TLS termination is supported with TLSRoute (SNI-based routing) or - TCPRoute (single backend).' - - 'Gateway API: Updated support to Gateway API v0.8.0, including status/conformance - refinements and CRD validation changes.' - - 'HTTPProxy: New regex-based path matching and regex header matching conditions - are supported in routes/includes.' - - 'Rate limiting: You can define a default global rate limit policy in Contour - config that applies to all HTTPProxies unless they opt out.' - - "Observability/ops: New xDS metrics about status update count/duration and\ - \ additional controller-runtime metrics are exposed; access logs can now include\ - \ route source (kind/namespace/name) and have a new \u201Ccritical\u201D level\ - \ (>=500 only)." - breaking_changes: - - 'Routing behavior change: Contour no longer strips the port from the downstream - Host header before proxying to backends; backends will now see the Host header - including the port if one was present.' - - 'Gateway/HTTP route precedence change: routes that match HTTP method now take - precedence over routes with header/query matches (aligns with Gateway API - v0.7.1+), which can change which backend receives requests in overlapping-rule - scenarios.' - - If you use static provisioning for Gateway (manually managed Envoy Service), - you must now keep the Service ports in sync with all Gateway listeners because - Contour supports many listener ports; previously some configurations may have - assumed only one HTTP and one HTTPS port. + kube: ['1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Gateway API: Gateway listeners can now be configured on more than + two ports (multiple HTTP and multiple HTTPS/TLS listeners). If using the + Contour Gateway Provisioner, the Envoy Service will automatically expose + ports for all valid listeners.', 'Gateway API: TCPRoute is now supported + for simple TCP forwarding on a listener port, and TLS termination is supported + with TLSRoute (SNI-based routing) or TCPRoute (single backend).', 'Gateway + API: Updated support to Gateway API v0.8.0, including status/conformance + refinements and CRD validation changes.', 'HTTPProxy: New regex-based path + matching and regex header matching conditions are supported in routes/includes.', + 'Rate limiting: You can define a default global rate limit policy in Contour + config that applies to all HTTPProxies unless they opt out.', "Observability/ops:\ + \ New xDS metrics about status update count/duration and additional controller-runtime\ + \ metrics are exposed; access logs can now include route source (kind/namespace/name)\ + \ and have a new \u201Ccritical\u201D level (>=500 only)."] + breaking_changes: ['Routing behavior change: Contour no longer strips the port + from the downstream Host header before proxying to backends; backends will + now see the Host header including the port if one was present.', 'Gateway/HTTP + route precedence change: routes that match HTTP method now take precedence + over routes with header/query matches (aligns with Gateway API v0.7.1+), + which can change which backend receives requests in overlapping-rule scenarios.', + 'If you use static provisioning for Gateway (manually managed Envoy Service), + you must now keep the Service ports in sync with all Gateway listeners because + Contour supports many listener ports; previously some configurations may + have assumed only one HTTP and one HTTPS port.'] chart_version: 13.1.4 - images: - - docker.io/bitnami/contour:1.26.0-debian-11-r17 - - docker.io/bitnami/envoy:1.26.5-debian-11-r0 + images: ['docker.io/bitnami/contour:1.26.0-debian-11-r17', 'docker.io/bitnami/envoy:1.26.5-debian-11-r0'] eolAt: '2024-05-07' - version: 1.25.0 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null chart_version: 12.2.2 - images: - - docker.io/bitnami/contour:1.25.0-debian-11-r73 - - docker.io/bitnami/envoy:1.26.3-debian-11-r10 + images: ['docker.io/bitnami/contour:1.25.0-debian-11-r73', 'docker.io/bitnami/envoy:1.26.3-debian-11-r10'] eolAt: '2024-02-12' - version: 1.24.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: null eolAt: '2023-10-30' - version: 1.23.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "Overload Manager can be enabled to protect Envoy from OOM-related disruptions\ - \ by shedding load when heap usage is too high; it\u2019s off by default and\ - \ must be explicitly configured." - - "HTTPProxy now supports JWT verification via Envoy\u2019s jwt_authn filter,\ - \ with JWTProviders defined on the root HTTPProxy and applied per-route (with\ - \ optional defaults and opt-outs)." - - Slow start mode is available to gradually ramp traffic to newly added/upscaled - endpoints, reducing cold-start overload (useful for JVM apps). - - HTTPProxy CORS policy can now use regex matching for Allowed Origins, enabling - more flexible Origin header handling. - - "Gateway API updates: conformance/behavior improvements (e.g., rule precedence\ - \ is list order), more efficient status handling (status-only changes don\u2019\ - t trigger xDS), and version bump to Gateway API v0.5.1." - - 'Operational configurability via ContourDeployment: configurable Contour and - Kubernetes client log levels, pod annotations/labels, resource requirements, - and extra volumes/volumeMounts for Envoy pods.' - breaking_changes: - - "Supported Kubernetes versions shift: v1.23.x is tested against Kubernetes\ - \ 1.23\u20131.25 (drops 1.22). Ensure your cluster version is within this\ - \ range before upgrading." - - Envoy version moves forward (v1.22 used Envoy 1.23; v1.23 uses Envoy 1.24). - Validate any Envoy-specific config/custom filters and observe for behavior/log-format - changes tied to the new Envoy release. - - Gateway API behavior is more strictly conformant (e.g., HTTPRoute rule precedence - by list order); if you relied on previous non-conformant matching/attachment - quirks, re-test routing outcomes after upgrade. + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["Overload Manager can be enabled to protect Envoy from OOM-related\ + \ disruptions by shedding load when heap usage is too high; it\u2019s off\ + \ by default and must be explicitly configured.", "HTTPProxy now supports\ + \ JWT verification via Envoy\u2019s jwt_authn filter, with JWTProviders\ + \ defined on the root HTTPProxy and applied per-route (with optional defaults\ + \ and opt-outs).", 'Slow start mode is available to gradually ramp traffic + to newly added/upscaled endpoints, reducing cold-start overload (useful + for JVM apps).', 'HTTPProxy CORS policy can now use regex matching for Allowed + Origins, enabling more flexible Origin header handling.', "Gateway API updates:\ + \ conformance/behavior improvements (e.g., rule precedence is list order),\ + \ more efficient status handling (status-only changes don\u2019t trigger\ + \ xDS), and version bump to Gateway API v0.5.1.", 'Operational configurability + via ContourDeployment: configurable Contour and Kubernetes client log levels, + pod annotations/labels, resource requirements, and extra volumes/volumeMounts + for Envoy pods.'] + breaking_changes: ["Supported Kubernetes versions shift: v1.23.x is tested against\ + \ Kubernetes 1.23\u20131.25 (drops 1.22). Ensure your cluster version is\ + \ within this range before upgrading.", Envoy version moves forward (v1.22 + used Envoy 1.23; v1.23 uses Envoy 1.24). Validate any Envoy-specific config/custom + filters and observe for behavior/log-format changes tied to the new Envoy + release., 'Gateway API behavior is more strictly conformant (e.g., HTTPRoute + rule precedence by list order); if you relied on previous non-conformant + matching/attachment quirks, re-test routing outcomes after upgrade.'] chart_version: 10.1.1 - images: - - docker.io/bitnami/contour:1.23.0-debian-11-r10 - - docker.io/bitnami/envoy:1.24.0-debian-11-r11 + images: ['docker.io/bitnami/contour:1.23.0-debian-11-r10', 'docker.io/bitnami/envoy:1.24.0-debian-11-r11'] - version: 1.22.0 - kube: - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Upgrade Contour from v1.21.x to v1.22.0 (includes Envoy bump to 1.23.0 and - Gateway API bump to v0.5.0). - - 'Gateway API resources/conformance behavior changes: stricter TLS mode enforcement - for HTTPS vs TLS listeners, updated route/backend error handling and status - conditions to match upstream spec, and new support for ReferenceGrant alongside - deprecated ReferencePolicy.' - - "ContourConfiguration schema change: field rename `spec.envoy.logging.jsonFields`\ - \ \u2192 `spec.envoy.logging.accessLogJSONFields`; removes unused `DebugLogLevel`/`KubernetesDebugLogLevel`\ - \ fields (must be configured via CLI flags)." - - 'Behavioral defaults/operational tweaks: `contour envoy shutdown --check-delay` - default is now 0s (faster termination when idle).' - - "Compatibility window changes: supported/tested Kubernetes versions now 1.22\u2013\ - 1.24 (1.21 dropped)." - features: - - Gateway API updated to v0.5.0 (v1alpha2 and v1beta1) with full v0.5.0 conformance - test pass. - - HTTPProxy routes can now return direct responses via `directResponsePolicy` - (requires `statusCode`, optional `body`) as an alternative to service/redirect. - - Client certificate validation can optionally check revocation via CRL provided - in an Opaque Secret referenced by `httpproxy.spec.virtualhost.tls.clientValidation.crlSecret`. - - Gateway API now supports exact HTTP query parameter matching, plus rule-level - RequestMirror filter support (Gateway API mode). - - Envoy upgraded to 1.23.0, enabling newer access log operators and related - logging template keywords. - breaking_changes: - - If you use the ContourConfiguration CRD field `spec.envoy.logging.jsonFields`, - it has been renamed to `spec.envoy.logging.accessLogJSONFields` and must be - updated before/with the upgrade. - - "Gateway API: ReferencePolicy is deprecated (ReferenceGrant preferred) and\ - \ will be removed in the next Contour release\u2014plan migration now to avoid\ - \ a future breaking upgrade." - - 'Gateway API: stricter enforcement of TLS modes for listener protocols (HTTPS - must be Terminate; TLS must be Passthrough) may cause previously-accepted - configs to become invalid/unready.' - - "Kubernetes version support shifted to 1.22\u20131.24; clusters on 1.21 are\ - \ no longer in the tested/supported window for v1.22.0." + kube: ['1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Upgrade Contour from v1.21.x to v1.22.0 (includes Envoy bump + to 1.23.0 and Gateway API bump to v0.5.0)., 'Gateway API resources/conformance + behavior changes: stricter TLS mode enforcement for HTTPS vs TLS listeners, + updated route/backend error handling and status conditions to match upstream + spec, and new support for ReferenceGrant alongside deprecated ReferencePolicy.', + "ContourConfiguration schema change: field rename `spec.envoy.logging.jsonFields`\ + \ \u2192 `spec.envoy.logging.accessLogJSONFields`; removes unused `DebugLogLevel`/`KubernetesDebugLogLevel`\ + \ fields (must be configured via CLI flags).", 'Behavioral defaults/operational + tweaks: `contour envoy shutdown --check-delay` default is now 0s (faster + termination when idle).', "Compatibility window changes: supported/tested\ + \ Kubernetes versions now 1.22\u20131.24 (1.21 dropped)."] + features: [Gateway API updated to v0.5.0 (v1alpha2 and v1beta1) with full v0.5.0 + conformance test pass., 'HTTPProxy routes can now return direct responses + via `directResponsePolicy` (requires `statusCode`, optional `body`) as an + alternative to service/redirect.', Client certificate validation can optionally + check revocation via CRL provided in an Opaque Secret referenced by `httpproxy.spec.virtualhost.tls.clientValidation.crlSecret`., + 'Gateway API now supports exact HTTP query parameter matching, plus rule-level + RequestMirror filter support (Gateway API mode).', 'Envoy upgraded to 1.23.0, + enabling newer access log operators and related logging template keywords.'] + breaking_changes: ['If you use the ContourConfiguration CRD field `spec.envoy.logging.jsonFields`, + it has been renamed to `spec.envoy.logging.accessLogJSONFields` and must + be updated before/with the upgrade.', "Gateway API: ReferencePolicy is deprecated\ + \ (ReferenceGrant preferred) and will be removed in the next Contour release\u2014\ + plan migration now to avoid a future breaking upgrade.", 'Gateway API: stricter + enforcement of TLS modes for listener protocols (HTTPS must be Terminate; + TLS must be Passthrough) may cause previously-accepted configs to become + invalid/unready.', "Kubernetes version support shifted to 1.22\u20131.24;\ + \ clusters on 1.21 are no longer in the tested/supported window for v1.22.0."] chart_version: 9.1.1 - images: - - docker.io/bitnami/contour:1.22.0-debian-11-r4 - - docker.io/bitnami/envoy:1.23.0-debian-11-r8 + images: ['docker.io/bitnami/contour:1.22.0-debian-11-r4', 'docker.io/bitnami/envoy:1.23.0-debian-11-r8'] - version: 1.21.0 - kube: - - '1.23' - - '1.22' - - '1.21' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Leader election RBAC in the example manifests was refactored: rules for leader-election - resources moved from a ClusterRole to a namespace-scoped Role plus RoleBinding - (and now also needs access to Events and Leases). If your Helm chart templates - or values override RBAC, review and align them with v1.21.0 expectations (especially - if Contour runs outside the default namespace or you set a custom leader-election - namespace).' - - Contour leader election now uses only Lease objects; any chart flags/args - or RBAC must include coordination.k8s.io Lease permissions and related Events - access as per updated manifests. - - Container images are now published exclusively on GHCR; Helm values that reference - image repositories must switch from Docker Hub to ghcr.io/projectcontour/contour - (and ghcr.io/projectcontour/envoy for Envoy where applicable). - - Leader-election configuration via configuration file was removed; charts that - mount a config file and previously set leader election there must move those - settings to command-line flags/args. - - 'Gateway API ecosystem updates: Gateway API bumped to v0.4.3 and example YAML - includes the validating webhook; if your chart installs Gateway API resources/webhook, - reconcile versions and webhook deployment expectations.' - - If you use/ship certgen jobs/manifests, note the new optional --name-prefix - flag for contour certgen and that gateway-provisioner no longer relies on - a certgen job (generates xDS certs directly). - features: - - Configurable HTTP/HTTPS access log verbosity via accesslog-level / spec.envoy.logging.accessLogLevel - (info/error/disabled). - - New optional Contour Gateway provisioner (contour gateway-provisioner) to - dynamically provision Contour+Envoy per Gateway for Gateway API conformance. - - 'Gateway API enhancements: can target a specific Gateway via gatewayRef; better - listener/route condition handling; support requested addresses via spec.addresses.' - - 'New load-balancing option: hash based on a query parameter for HTTPProxy - backends.' - - 'Operational/config additions: upstream TCP connection timeout configurable; - option to disable Envoy merge_slashes; JSON log format via --log-format=json; - new HTTPProxy idleConnection timeout field.' - breaking_changes: - - Leader election config in the configuration file has been removed; must be - configured via CLI flags now. - - Leader election coordination now uses only Lease objects and upgrading to - v1.21.0 explicitly requires having upgraded to v1.20.0 first for migration. - - Default deployment RBAC for leader election resources changed from ClusterRole - to namespace-scoped Role/RoleBinding; installs that relied on cluster-wide - ConfigMap permissions must be updated accordingly. - - Contour images are no longer pushed to Docker Hub; image pulls must be updated - to GHCR. + kube: ['1.23', '1.22', '1.21'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Leader election RBAC in the example manifests was refactored: + rules for leader-election resources moved from a ClusterRole to a namespace-scoped + Role plus RoleBinding (and now also needs access to Events and Leases). + If your Helm chart templates or values override RBAC, review and align them + with v1.21.0 expectations (especially if Contour runs outside the default + namespace or you set a custom leader-election namespace).', Contour leader + election now uses only Lease objects; any chart flags/args or RBAC must + include coordination.k8s.io Lease permissions and related Events access + as per updated manifests., Container images are now published exclusively + on GHCR; Helm values that reference image repositories must switch from + Docker Hub to ghcr.io/projectcontour/contour (and ghcr.io/projectcontour/envoy + for Envoy where applicable)., Leader-election configuration via configuration + file was removed; charts that mount a config file and previously set leader + election there must move those settings to command-line flags/args., 'Gateway + API ecosystem updates: Gateway API bumped to v0.4.3 and example YAML includes + the validating webhook; if your chart installs Gateway API resources/webhook, + reconcile versions and webhook deployment expectations.', 'If you use/ship + certgen jobs/manifests, note the new optional --name-prefix flag for contour + certgen and that gateway-provisioner no longer relies on a certgen job (generates + xDS certs directly).'] + features: [Configurable HTTP/HTTPS access log verbosity via accesslog-level + / spec.envoy.logging.accessLogLevel (info/error/disabled)., New optional + Contour Gateway provisioner (contour gateway-provisioner) to dynamically + provision Contour+Envoy per Gateway for Gateway API conformance., 'Gateway + API enhancements: can target a specific Gateway via gatewayRef; better listener/route + condition handling; support requested addresses via spec.addresses.', 'New + load-balancing option: hash based on a query parameter for HTTPProxy backends.', + 'Operational/config additions: upstream TCP connection timeout configurable; + option to disable Envoy merge_slashes; JSON log format via --log-format=json; + new HTTPProxy idleConnection timeout field.'] + breaking_changes: [Leader election config in the configuration file has been + removed; must be configured via CLI flags now., Leader election coordination + now uses only Lease objects and upgrading to v1.21.0 explicitly requires + having upgraded to v1.20.0 first for migration., Default deployment RBAC + for leader election resources changed from ClusterRole to namespace-scoped + Role/RoleBinding; installs that relied on cluster-wide ConfigMap permissions + must be updated accordingly., Contour images are no longer pushed to Docker + Hub; image pulls must be updated to GHCR.] chart_version: 8.0.0 - images: - - docker.io/bitnami/contour:1.21.0-debian-11-r0 - - docker.io/bitnami/envoy:1.22.1-debian-11-r0 + images: ['docker.io/bitnami/contour:1.21.0-debian-11-r0', 'docker.io/bitnami/envoy:1.22.1-debian-11-r0'] - version: 1.20.1 - kube: - - '1.23' - - '1.22' - - '1.21' + kube: ['1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null chart_version: 7.10.2 - images: - - docker.io/bitnami/contour:1.20.1-debian-11-r0 - - docker.io/bitnami/envoy:1.21.2-debian-11-r0 + images: ['docker.io/bitnami/contour:1.20.1-debian-11-r0', 'docker.io/bitnami/envoy:1.21.2-debian-11-r0'] name: contour - icon: https://avatars.githubusercontent.com/u/21110084?s=200&v=4 release_url: https://github.com/coredns/coredns/releases/tag/{vsn} helm_repository_url: https://coredns.github.io/helm versions: - version: 1.12.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' + kube: ['1.36', '1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 1.42.2 - images: - - coredns/coredns:1.12.0 + images: ['coredns/coredns:1.12.0'] - version: 1.11.3 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 1.36.1 - images: - - coredns/coredns:1.11.3 + images: ['coredns/coredns:1.11.3'] - version: 1.11.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null chart_version: 1.31.0 images: [] - version: 1.10.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 1.24.5 - images: - - coredns/coredns:1.10.1 + images: ['coredns/coredns:1.10.1'] - version: 1.9.3 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null chart_version: 1.19.6 - images: - - coredns/coredns:1.9.3 + images: ['coredns/coredns:1.9.3'] - version: 1.8.6 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 1.16.6 - images: - - coredns/coredns:1.8.6 + images: ['coredns/coredns:1.8.6'] - version: 1.8.4 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null chart_version: 1.16.4 - images: - - coredns/coredns:1.8.4 + images: ['coredns/coredns:1.8.4'] - version: 1.8.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null chart_version: 1.15.1 - images: - - coredns/coredns:1.8.0 - name: coredns + images: ['coredns/coredns:1.8.0'] - icon: https://avatars.githubusercontent.com/u/112438027?s=200&v=4 git_url: https://github.com/cloudnative-pg/cloudnative-pg release_url: https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v{vsn} @@ -18110,470 +15096,351 @@ addons: chart_name: cloudnative-pg versions: - version: 1.28.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Quorum-based failover is now a stable API (`spec.postgresql.synchronous.failoverQuorum`), - replacing the previous alpha annotation approach. - - New declarative Foreign Data Wrapper management via the `Database` CRD (`.spec.fdws` - and `.spec.servers`) to manage FDW extensions and foreign servers. - - 'Security and ops improvements: pod-level `securityContext`/`containerSecurityContext`, - optional TLS for operator metrics, fine-grained custom TLS for PgBouncer, - and a caching layer for user-defined monitoring queries.' - - 'Operational resilience improvements: better probe behavior during transient - API-server issues and faster replica network drop detection via a reduced - default `tcp_user_timeout`.' - breaking_changes: - - Default PostgreSQL image version changes (to PostgreSQL 18.1 system-trixie - by default); upgrading may change the default major version if you were relying - on defaults rather than pinning images. - - "Kubernetes/PostgreSQL support matrix changes: Kubernetes 1.31 and PostgreSQL\ - \ 13 are no longer listed as supported in 1.28 (ensure you\u2019re on K8s\ - \ 1.32+ and PG 14+)." - - Quorum-based failover configuration moved from `alpha.cnpg.io/failoverQuorum` - annotation to the stable `spec.postgresql.synchronous.failoverQuorum` field - (update manifests accordingly if you used the alpha feature). + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Quorum-based failover is now a stable API (`spec.postgresql.synchronous.failoverQuorum`), + replacing the previous alpha annotation approach.', New declarative Foreign + Data Wrapper management via the `Database` CRD (`.spec.fdws` and `.spec.servers`) + to manage FDW extensions and foreign servers., 'Security and ops improvements: + pod-level `securityContext`/`containerSecurityContext`, optional TLS for + operator metrics, fine-grained custom TLS for PgBouncer, and a caching layer + for user-defined monitoring queries.', 'Operational resilience improvements: + better probe behavior during transient API-server issues and faster replica + network drop detection via a reduced default `tcp_user_timeout`.'] + breaking_changes: [Default PostgreSQL image version changes (to PostgreSQL 18.1 + system-trixie by default); upgrading may change the default major version + if you were relying on defaults rather than pinning images., "Kubernetes/PostgreSQL\ + \ support matrix changes: Kubernetes 1.31 and PostgreSQL 13 are no longer\ + \ listed as supported in 1.28 (ensure you\u2019re on K8s 1.32+ and PG 14+).", + Quorum-based failover configuration moved from `alpha.cnpg.io/failoverQuorum` + annotation to the stable `spec.postgresql.synchronous.failoverQuorum` field + (update manifests accordingly if you used the alpha feature).] chart_version: 0.27.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.28.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.28.0'] - version: 1.27.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Dynamic loading of PostgreSQL extensions via `.spec.postgresql.extensions`, - mounting extension images as read-only volumes in instance pods. - - HA logical decoding slot sync via `spec.replicationSlots.highAvailability.synchronizeLogicalDecoding` - so logical subscribers keep working after failover. - - Primary Isolation Check promoted to stable; adds `.spec.probes.liveness.isolationCheck` - and updates liveness behavior to shut down an isolated primary within `livenessProbeTimeout`. - - Experimental failover quorum (quorum-based failover) available via `alpha.cnpg.io/failoverQuorum` - annotation. - - New `fqdn-uri` and `fqdn-jdbc-uri` entries in user secrets for FQDN-based - connection strings. - - 'CNPG-I: adds Postgres interface support and instance webserver metrics capabilities.' - breaking_changes: - - 'Liveness probe default behavior changed: an isolated primary is now forcibly - shut down within `livenessProbeTimeout` (default 30s). This can change failure - modes and may cause quicker primary pod termination in certain network-partition - scenarios.' - - "`Backup.spec` is now immutable after creation; any workflows that \u201C\ - edit\u201D existing Backup objects must switch to creating new Backup resources\ - \ instead." + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Dynamic loading of PostgreSQL extensions via `.spec.postgresql.extensions`, + mounting extension images as read-only volumes in instance pods.', HA logical + decoding slot sync via `spec.replicationSlots.highAvailability.synchronizeLogicalDecoding` + so logical subscribers keep working after failover., Primary Isolation Check + promoted to stable; adds `.spec.probes.liveness.isolationCheck` and updates + liveness behavior to shut down an isolated primary within `livenessProbeTimeout`., + Experimental failover quorum (quorum-based failover) available via `alpha.cnpg.io/failoverQuorum` + annotation., New `fqdn-uri` and `fqdn-jdbc-uri` entries in user secrets + for FQDN-based connection strings., 'CNPG-I: adds Postgres interface support + and instance webserver metrics capabilities.'] + breaking_changes: ['Liveness probe default behavior changed: an isolated primary + is now forcibly shut down within `livenessProbeTimeout` (default 30s). This + can change failure modes and may cause quicker primary pod termination in + certain network-partition scenarios.', "`Backup.spec` is now immutable after\ + \ creation; any workflows that \u201Cedit\u201D existing Backup objects\ + \ must switch to creating new Backup resources instead."] chart_version: 0.26.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.27.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.27.0'] - version: 1.26.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Offline, declarative in-place major PostgreSQL upgrades using pg_upgrade (cluster - pods shut down; precheck job; declarative rollback). - - Improved replica startup/readiness probe behavior with better control tied - to streaming lag. - - Database CRD expanded with declarative management of extensions and schemas. - breaking_changes: - - Native Barman Cloud support is deprecated (still works in 1.26, removed in - 1.28); start migrating clusters to the Barman Cloud Plugin, and expect webhook - warnings when using in-tree barmanObjectStore/retentionPolicy fields. - - Operator drops support for Barman <=3.4 capability detection; if your operand - image is very old (pre-Apr 2023), upgrade the operand before upgrading the - operator. - - "kubectl cnpg hibernate commands switched from imperative to declarative shortcuts;\ - \ hibernate status removed\u2014do not upgrade plugin/operator unless you\u2019\ - re ready to adopt declarative hibernation." + kube: ['1.33', '1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Offline, declarative in-place major PostgreSQL upgrades using pg_upgrade + (cluster pods shut down; precheck job; declarative rollback).', Improved + replica startup/readiness probe behavior with better control tied to streaming + lag., Database CRD expanded with declarative management of extensions and + schemas.] + breaking_changes: ['Native Barman Cloud support is deprecated (still works in + 1.26, removed in 1.28); start migrating clusters to the Barman Cloud Plugin, + and expect webhook warnings when using in-tree barmanObjectStore/retentionPolicy + fields.', 'Operator drops support for Barman <=3.4 capability detection; + if your operand image is very old (pre-Apr 2023), upgrade the operand before + upgrading the operator.', "kubectl cnpg hibernate commands switched from\ + \ imperative to declarative shortcuts; hibernate status removed\u2014do\ + \ not upgrade plugin/operator unless you\u2019re ready to adopt declarative\ + \ hibernation."] chart_version: 0.24.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.26.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.26.0'] - version: 1.25.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Declarative database management via new `Database` CRD to create/manage PostgreSQL - databases within a Cluster. - - Declarative logical replication via new `Publication` and `Subscription` CRDs, - easing replication setup and online migrations. - - Experimental CNPG-I plugin interface to extend CloudNativePG via third-party - plugins (e.g., Barman Cloud plugin) without modifying the operator. - breaking_changes: - - 'Support matrix changes: PostgreSQL 12 is dropped; PostgreSQL 17 is now supported - and the default image is PostgreSQL 17.2. Plan upgrades accordingly (major - PG upgrade procedures apply).' - - "Kubernetes support window shifts (now 1.32\u20131.29); Kubernetes 1.28 is\ - \ no longer listed as supported." + features: [Declarative database management via new `Database` CRD to create/manage + PostgreSQL databases within a Cluster., 'Declarative logical replication + via new `Publication` and `Subscription` CRDs, easing replication setup + and online migrations.', 'Experimental CNPG-I plugin interface to extend + CloudNativePG via third-party plugins (e.g., Barman Cloud plugin) without + modifying the operator.'] + breaking_changes: ['Support matrix changes: PostgreSQL 12 is dropped; PostgreSQL + 17 is now supported and the default image is PostgreSQL 17.2. Plan upgrades + accordingly (major PG upgrade procedures apply).', "Kubernetes support window\ + \ shifts (now 1.32\u20131.29); Kubernetes 1.28 is no longer listed as supported."] chart_version: 0.23.1 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0'] - version: 1.24.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator release 1.24.0 includes important resource/labeling behavior changes - (Service/PDB selector label deprecation) and scheduling/anti-affinity default - fix that can trigger a full instance rollout on operator upgrade. - - 'Security hardening and connectivity changes: TLS added between operator and - instance manager; optional TLS for metrics exporter; operator service account - permissions reduced.' - - Behavioral changes around readiness checks, pod spec reconciliation control, - and pooler rollout behavior on operator image upgrades. - features: - - Distributed PostgreSQL topologies (enhanced replica clusters) enabling multi-cluster/hybrid - deployments with declarative primary control and seamless switchover without - rebuilding the former primary. - - Managed services configuration (`managed.services`) to disable default read/read-only - services and to template custom Services (including LoadBalancers) for external - access/DBaaS use cases. - - New synchronous replication API supporting quorum-based and priority-list - strategies with full customization of `synchronous_standby_names`. - - Safety mechanism to stop the cluster on WAL disk space exhaustion to simplify - recovery by resizing storage. - - Delayed replicas via `.spec.replica.minApplyDelay` using PostgreSQL `recovery_min_apply_delay`. - - Post-init SQL can now be provided via multiple ConfigMaps/Secrets using `postInitSQLRefs` - and `postInitTemplateSQLRefs`. - - PostgreSQL 17 support for `allow_alter_system` via `.spec.postgresql.enableAlterSystem`. - - 'Metrics/query improvements: customizable metric/column names and predicate - queries; PgBouncer 1.23 metrics support in Pooler collector.' - - New annotation `reconcilePodSpec` on Cluster/Pooler to control pod restarts - after pod spec changes. - - '`cnpg` plugin improvements including control-plane node install option and - enhanced status output for distributed topology tokens.' - breaking_changes: - - '`role` label in Service and PodDisruptionBudget selectors is deprecated in - favor of `cnpg.io/instanceRole`; any tooling or custom resources depending - on the old selector/label should be updated.' - - Default PodAntiAffinity fix for PostgreSQL pods will trigger a rollout of - all instances when upgrading the operator (even with online upgrades enabled); - plan for controlled disruption/capacity during the upgrade. - - 'Readiness behavior tightened: streaming replicas that never connected to - primary now fail readiness, which may change rollout/alerting behavior in - misconfigured or partitioned environments.' + kube: ['1.31', '1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator release 1.24.0 includes important resource/labeling + behavior changes (Service/PDB selector label deprecation) and scheduling/anti-affinity + default fix that can trigger a full instance rollout on operator upgrade., + 'Security hardening and connectivity changes: TLS added between operator and + instance manager; optional TLS for metrics exporter; operator service account + permissions reduced.', 'Behavioral changes around readiness checks, pod + spec reconciliation control, and pooler rollout behavior on operator image + upgrades.'] + features: [Distributed PostgreSQL topologies (enhanced replica clusters) enabling + multi-cluster/hybrid deployments with declarative primary control and seamless + switchover without rebuilding the former primary., Managed services configuration + (`managed.services`) to disable default read/read-only services and to template + custom Services (including LoadBalancers) for external access/DBaaS use + cases., New synchronous replication API supporting quorum-based and priority-list + strategies with full customization of `synchronous_standby_names`., Safety + mechanism to stop the cluster on WAL disk space exhaustion to simplify recovery + by resizing storage., Delayed replicas via `.spec.replica.minApplyDelay` + using PostgreSQL `recovery_min_apply_delay`., Post-init SQL can now be provided + via multiple ConfigMaps/Secrets using `postInitSQLRefs` and `postInitTemplateSQLRefs`., + PostgreSQL 17 support for `allow_alter_system` via `.spec.postgresql.enableAlterSystem`., + 'Metrics/query improvements: customizable metric/column names and predicate + queries; PgBouncer 1.23 metrics support in Pooler collector.', New annotation + `reconcilePodSpec` on Cluster/Pooler to control pod restarts after pod spec + changes., '`cnpg` plugin improvements including control-plane node install + option and enhanced status output for distributed topology tokens.'] + breaking_changes: ['`role` label in Service and PodDisruptionBudget selectors + is deprecated in favor of `cnpg.io/instanceRole`; any tooling or custom + resources depending on the old selector/label should be updated.', Default + PodAntiAffinity fix for PostgreSQL pods will trigger a rollout of all instances + when upgrading the operator (even with online upgrades enabled); plan for + controlled disruption/capacity during the upgrade., 'Readiness behavior + tightened: streaming replicas that never connected to primary now fail readiness, + which may change rollout/alerting behavior in misconfigured or partitioned + environments.'] chart_version: 0.22.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.24.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.24.0'] - version: 1.23.0 - kube: - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Introduced PostgreSQL Image Catalogs via new `ClusterImageCatalog` and `ImageCatalog` - CRDs; clusters can reference them with `.spec.imageCatalogRef` as an alternative - to `imageName` and a future default. - - Added synchronization of user-defined physical replication slots from primary - to replicas using `replicationSlots.synchronizeReplicas`. - - Added `.spec.enablePDB` to control/disable PodDisruptionBudgets (notably helpful - for single-instance clusters and maintenance evictions). - - Allows transitioning an existing cluster into replica mode to simplify cross-datacenter - switchover operations. - - Connection pooler Service is now customizable (type/labels/annotations). - - Supports configuring PostgreSQL `wal_log_hints` parameter. - - Automatically generated connection URI secrets can use FQDNs. - - Improved restore behavior by cleaning up instance Pods not owned by the Cluster - and adding better error detection for `barman-cloud-wal-restore`. - - '`kubectl cnpg` plugin improvements: better argument handling, status output - includes PDBs, backup progress handling, and `sync-sequences` robustness.' - breaking_changes: - - 'Support policy change: CloudNativePG now focuses on one supported minor release - at a time (instead of two), with 3 months supplementary support for the previous - minor. Plan upgrades accordingly.' + kube: ['1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Introduced PostgreSQL Image Catalogs via new `ClusterImageCatalog` + and `ImageCatalog` CRDs; clusters can reference them with `.spec.imageCatalogRef` + as an alternative to `imageName` and a future default., Added synchronization + of user-defined physical replication slots from primary to replicas using + `replicationSlots.synchronizeReplicas`., Added `.spec.enablePDB` to control/disable + PodDisruptionBudgets (notably helpful for single-instance clusters and maintenance + evictions)., Allows transitioning an existing cluster into replica mode + to simplify cross-datacenter switchover operations., Connection pooler Service + is now customizable (type/labels/annotations)., Supports configuring PostgreSQL + `wal_log_hints` parameter., Automatically generated connection URI secrets + can use FQDNs., Improved restore behavior by cleaning up instance Pods not + owned by the Cluster and adding better error detection for `barman-cloud-wal-restore`., + '`kubectl cnpg` plugin improvements: better argument handling, status output + includes PDBs, backup progress handling, and `sync-sequences` robustness.'] + breaking_changes: ['Support policy change: CloudNativePG now focuses on one + supported minor release at a time (instead of two), with 3 months supplementary + support for the previous minor. Plan upgrades accordingly.'] chart_version: 0.21.1 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.23.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.23.0'] - version: 1.22.0 - kube: - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - '**Declarative tablespaces**: new `.spec.tablespaces` stanza in the `Cluster` - CRD to create/manage tablespaces through the operator lifecycle.' - - '**Temporary tablespaces**: `.spec.tablespaces[*].temporary` lets you designate - a tablespace for temp operations by wiring it into Postgres `temp_tablespaces`.' - - '**Prometheus relabeling support**: you can now set `podMonitorRelabelings` - and `podMonitorMetricRelabelings` under `.spec.monitoring` for both `Cluster` - and `Pooler`.' - - '**Connection pooler scaling to zero**: `Pooler` resources can now be scaled - down to 0 instances, useful for pausing traffic without deleting the resource.' - - '**Red Hat UBI 8 operator images**: new UBI-based images are available, mainly - for OLM-style deployments.' - breaking_changes: - - '**`ALTER SYSTEM` is now disabled by default**: if you relied on the operator - using `ALTER SYSTEM` to apply configuration, you must explicitly re-enable - it following the upgrade documentation.' - - '**PostgreSQL default image bumped to 16.1**: new clusters (and any clusters - that track the default operand image) will move from 16.0 to 16.1; validate - extension/compatibility expectations before rollout.' - - '**TLS defaults tightened for Postgres 12+**: TLSv1.3 is enforced by default, - which can break older clients or environments that require lower protocol - versions unless you override the relevant `ssl_*` GUCs.' + kube: ['1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['**Declarative tablespaces**: new `.spec.tablespaces` stanza in the + `Cluster` CRD to create/manage tablespaces through the operator lifecycle.', + '**Temporary tablespaces**: `.spec.tablespaces[*].temporary` lets you designate + a tablespace for temp operations by wiring it into Postgres `temp_tablespaces`.', + '**Prometheus relabeling support**: you can now set `podMonitorRelabelings` + and `podMonitorMetricRelabelings` under `.spec.monitoring` for both `Cluster` + and `Pooler`.', '**Connection pooler scaling to zero**: `Pooler` resources + can now be scaled down to 0 instances, useful for pausing traffic without + deleting the resource.', '**Red Hat UBI 8 operator images**: new UBI-based + images are available, mainly for OLM-style deployments.'] + breaking_changes: ['**`ALTER SYSTEM` is now disabled by default**: if you relied + on the operator using `ALTER SYSTEM` to apply configuration, you must explicitly + re-enable it following the upgrade documentation.', '**PostgreSQL default + image bumped to 16.1**: new clusters (and any clusters that track the default + operand image) will move from 16.0 to 16.1; validate extension/compatibility + expectations before rollout.', '**TLS defaults tightened for Postgres 12+**: + TLSv1.3 is enforced by default, which can break older clients or environments + that require lower protocol versions unless you override the relevant `ssl_*` + GUCs.'] chart_version: 0.20.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.22.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.22.0'] - version: 1.21.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Kubernetes VolumeSnapshot support for backup and recovery (initially cold - backups from a standby), enabling incremental/differential snapshot-based - workflows. - - OLM/OperatorHub installation support via a stable channel for the latest patch - of the latest minor release. - - Managed role lifecycle improvements (from 1.20) and new cnpg kubectl plugin - enhancements (status includes primary timestamp/uptime; logs include previous - logs). - - Recovery/replica bootstrap enhancements using consistent sets of volume snapshots, - including full and PITR recovery. - breaking_changes: - - 'Default operational timeouts changed significantly: stopDelay now 1800s (was - 30s), startDelay now 3600s (was 30s), switchoverDelay now 3600s; plus new - smartShutdownTimeout affecting shutdown behavior.' - - 'Liveness probe behavior changed: initial delay replaced with a Kubernetes - startupProbe, which can affect readiness/liveness timing assumptions.' - - Superuser access is disabled by default (security hardening), which may break - workflows expecting direct superuser access. - - Replication slots for HA are enabled by default, which can change WAL retention - behavior and storage requirements. - - The legacy `postgresql` label is no longer supported; use `cnpg.io/cluster` - instead. - - 'kubectl plugin command change: `cnpg snapshot` replaced by `cnpg backup -m - volumeSnapshot`; label `role` is being deprecated in favor of `cnpg.io/instanceRole` - (and new `cnpg.io/instanceRole` added).' + kube: ['1.28', '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Kubernetes VolumeSnapshot support for backup and recovery (initially + cold backups from a standby), enabling incremental/differential snapshot-based + workflows.', OLM/OperatorHub installation support via a stable channel for + the latest patch of the latest minor release., Managed role lifecycle improvements + (from 1.20) and new cnpg kubectl plugin enhancements (status includes primary + timestamp/uptime; logs include previous logs)., 'Recovery/replica bootstrap + enhancements using consistent sets of volume snapshots, including full and + PITR recovery.'] + breaking_changes: ['Default operational timeouts changed significantly: stopDelay + now 1800s (was 30s), startDelay now 3600s (was 30s), switchoverDelay now + 3600s; plus new smartShutdownTimeout affecting shutdown behavior.', 'Liveness + probe behavior changed: initial delay replaced with a Kubernetes startupProbe, + which can affect readiness/liveness timing assumptions.', 'Superuser access + is disabled by default (security hardening), which may break workflows expecting + direct superuser access.', 'Replication slots for HA are enabled by default, + which can change WAL retention behavior and storage requirements.', The + legacy `postgresql` label is no longer supported; use `cnpg.io/cluster` + instead., 'kubectl plugin command change: `cnpg snapshot` replaced by `cnpg + backup -m volumeSnapshot`; label `role` is being deprecated in favor of + `cnpg.io/instanceRole` (and new `cnpg.io/instanceRole` added).'] chart_version: 0.19.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.21.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.21.0'] - version: 1.20.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Declarative role management via `managed.roles` in the Cluster spec to manage - PostgreSQL roles lifecycle (create/alter) from Kubernetes. - - Declarative cluster hibernation via the `cnpg.io/hibernation` annotation to - scale a cluster down to zero pods while retaining PVCs, with an inverse restore - procedure. - breaking_changes: - - 'Default behavior changes for newly created Clusters with replicas: backup-from-standby - is enabled by default unless `.spec.backup.target` is explicitly set to `primary`.' - - 'Default behavior changes for newly created Clusters: `primaryUpdateMethod` - now defaults to `restart` (unsupervised rolling update completes by restarting - the primary) unless explicitly set to `switchover`.' - - The `-any` Service is now disabled by default, which may affect clients relying - on that Service name/type. + kube: ['1.27', '1.26', '1.25', '1.24'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Declarative role management via `managed.roles` in the Cluster spec + to manage PostgreSQL roles lifecycle (create/alter) from Kubernetes., 'Declarative + cluster hibernation via the `cnpg.io/hibernation` annotation to scale a + cluster down to zero pods while retaining PVCs, with an inverse restore + procedure.'] + breaking_changes: ['Default behavior changes for newly created Clusters with + replicas: backup-from-standby is enabled by default unless `.spec.backup.target` + is explicitly set to `primary`.', 'Default behavior changes for newly created + Clusters: `primaryUpdateMethod` now defaults to `restart` (unsupervised + rolling update completes by restarting the primary) unless explicitly set + to `switchover`.', 'The `-any` Service is now disabled by default, which + may affect clients relying on that Service name/type.'] chart_version: 0.18.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.20.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.20.0'] - version: 1.19.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Cluster-managed physical replication slots for HA, automatically creating - and managing slots for each hot-standby replica. - - Cluster hibernation via `kubectl cnpg hibernate on/off/status`, which removes - cluster-generated resources except the primary PVCs. - - Backup from a standby using `.spec.backup.target=prefer-standby` to take a - base backup from the most aligned replica. - - Delayed failover via `failoverDelay` to postpone failover after the primary - is detected unhealthy. - - Support for Kubernetes projected volumes in pod specs. - - Support for custom environment variables to control the PostgreSQL server - process. - - New `kubectl cnpg backup` plugin command to trigger a base backup. - - Improved separate WAL volume support, including moving WAL to a dedicated - volume on existing clusters and added WAL-related Prometheus metrics. - breaking_changes: - - PostgreSQL 10 is no longer supported; CloudNativePG now supports PostgreSQL - 11+ (plan migrations accordingly, ideally toward PostgreSQL 15). + kube: ['1.26', '1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Cluster-managed physical replication slots for HA, automatically + creating and managing slots for each hot-standby replica.', 'Cluster hibernation + via `kubectl cnpg hibernate on/off/status`, which removes cluster-generated + resources except the primary PVCs.', Backup from a standby using `.spec.backup.target=prefer-standby` + to take a base backup from the most aligned replica., Delayed failover via + `failoverDelay` to postpone failover after the primary is detected unhealthy., + Support for Kubernetes projected volumes in pod specs., Support for custom + environment variables to control the PostgreSQL server process., New `kubectl + cnpg backup` plugin command to trigger a base backup., 'Improved separate + WAL volume support, including moving WAL to a dedicated volume on existing + clusters and added WAL-related Prometheus metrics.'] + breaking_changes: ['PostgreSQL 10 is no longer supported; CloudNativePG now + supports PostgreSQL 11+ (plan migrations accordingly, ideally toward PostgreSQL + 15).'] chart_version: 0.17.0 - images: - - busybox:latest - - ghcr.io/cloudnative-pg/cloudnative-pg:1.19.0 + images: ['busybox:latest', 'ghcr.io/cloudnative-pg/cloudnative-pg:1.19.0'] - version: 1.18.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Cluster-managed physical replication slots for HA: the operator can automatically - create/manage physical replication slots for each hot-standby replica on both - primary and standby clusters.' - - 'Postgres cluster hibernation (via cnpg kubectl plugin): you can hibernate - a cluster (destroy operator-managed resources but keep the primary PVCs) and - resume it later.' - - 'New cnpg plugin subcommands: `hibernate`, `pgbench` (generate a benchmarking - Job), and `install` (generate operator install manifests).' - - PostgreSQL 15.0 becomes the default PostgreSQL major/minor version for new - clusters. - - 'Security hardening: add `SeccompProfile` to pods and containers.' - breaking_changes: - - Default PostgreSQL version changes to 15.0 for newly created clusters; if - you rely on implicit defaults, you may get a different major version than - before (explicitly set `.spec.imageName`/`.spec.postgresql` version to avoid - surprises). - - Cluster-managed replication slots may change replication/slot behavior and - resource usage compared to manual slot management; review settings/monitoring - if you previously managed physical slots yourself. + kube: ['1.27', '1.26', '1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Cluster-managed physical replication slots for HA: the operator + can automatically create/manage physical replication slots for each hot-standby + replica on both primary and standby clusters.', 'Postgres cluster hibernation + (via cnpg kubectl plugin): you can hibernate a cluster (destroy operator-managed + resources but keep the primary PVCs) and resume it later.', 'New cnpg plugin + subcommands: `hibernate`, `pgbench` (generate a benchmarking Job), and `install` + (generate operator install manifests).', PostgreSQL 15.0 becomes the default + PostgreSQL major/minor version for new clusters., 'Security hardening: add + `SeccompProfile` to pods and containers.'] + breaking_changes: ['Default PostgreSQL version changes to 15.0 for newly created + clusters; if you rely on implicit defaults, you may get a different major + version than before (explicitly set `.spec.imageName`/`.spec.postgresql` + version to avoid surprises).', Cluster-managed replication slots may change + replication/slot behavior and resource usage compared to manual slot management; + review settings/monitoring if you previously managed physical slots yourself.] chart_version: 0.16.0 - images: - - busybox:latest - - ghcr.io/cloudnative-pg/cloudnative-pg:1.18.0 + images: ['busybox:latest', 'ghcr.io/cloudnative-pg/cloudnative-pg:1.18.0'] - version: 1.17.0 - kube: - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - '**v1.16.0:** Adds `bootstrap.initdb.import` to import schemas/data over the - network from an existing PostgreSQL (including outside Kubernetes) using logical - backup/restore; can also be used for major PostgreSQL upgrades on a new cluster - (supports `microservice` and `monolith` import modes).' - - '**v1.16.0:** Adds label-based anti-affinity rules for synchronous replicas - so they can be scheduled on nodes with different characteristics (e.g., different - AZ than the primary).' - - '**v1.17.0:** Adds optional `walStorage` to place `pg_wal` on a dedicated - volume separate from the main `storage`/`PGDATA` volume to improve write-heavy - performance (must be decided at cluster creation).' - - '**v1.17.0:** Improves PgBouncer by allowing configuration of low-level TCP - network settings.' - - '**v1.17.0:** Improves UX/ops with `kubectl cnpg destroy` to delete an instance - and its associated PVCs.' - breaking_changes: - - '**v1.17.0:** `walStorage` cannot be added/removed on an existing running - cluster; enabling it requires creating a new cluster (or recreating) with - the setting present from day 1.' - - '**v1.16.0:** Backup tooling requirement bump: Barman >= 3.0.0 is required - for future PostgreSQL 15 support; verify your backup image/tooling versions - are compatible before upgrading.' + kube: ['1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['**v1.16.0:** Adds `bootstrap.initdb.import` to import schemas/data + over the network from an existing PostgreSQL (including outside Kubernetes) + using logical backup/restore; can also be used for major PostgreSQL upgrades + on a new cluster (supports `microservice` and `monolith` import modes).', + '**v1.16.0:** Adds label-based anti-affinity rules for synchronous replicas + so they can be scheduled on nodes with different characteristics (e.g., + different AZ than the primary).', '**v1.17.0:** Adds optional `walStorage` + to place `pg_wal` on a dedicated volume separate from the main `storage`/`PGDATA` + volume to improve write-heavy performance (must be decided at cluster creation).', + '**v1.17.0:** Improves PgBouncer by allowing configuration of low-level TCP + network settings.', '**v1.17.0:** Improves UX/ops with `kubectl cnpg destroy` + to delete an instance and its associated PVCs.'] + breaking_changes: ['**v1.17.0:** `walStorage` cannot be added/removed on an + existing running cluster; enabling it requires creating a new cluster (or + recreating) with the setting present from day 1.', '**v1.16.0:** Backup + tooling requirement bump: Barman >= 3.0.0 is required for future PostgreSQL + 15 support; verify your backup image/tooling versions are compatible before + upgrading.'] chart_version: 0.15.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.17.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.17.0'] - version: 1.16.0 - kube: - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Operator now defaults operand/PostgreSQL image to 14.4 (was earlier in 1.15.x);\ - \ verify your clusters\u2019 `.spec.imageName`/operand image pinning if you\ - \ rely on a specific minor version." - - Backup/WAL archiving conditions now use Kubernetes built-in Condition types; - if you have tooling that parses old custom condition fields, validate it against - the new status output. - - Kubernetes 1.24 is supported (and Barman >= 3.0.0 is required for future PostgreSQL - 15 support). - features: - - "Offline logical import/major upgrade workflow via `bootstrap.initdb.import`,\ - \ supporting \u201Cmicroservice\u201D (single DB) and \u201Cmonolith\u201D\ - \ (multiple DBs + roles) import from an external or in-cluster PostgreSQL\ - \ using pg_dump/pg_restore." - - Label-based anti-affinity for synchronous replicas to ensure sync standbys - land on nodes with different characteristics (e.g., different AZ) than the - primary. - - Azure AD Workload Identity support for Barman Cloud backups via `inheritFromAzureAD`. - - New `barmanObjectStore.s3Credentials.region` value to set AWS region for backup - and recovery object stores. - - Recovery/cloning can now redefine app DB name/owner/secret when restoring - from object store or cloning via pg_basebackup (previously only initdb bootstrap). + kube: ['1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Operator now defaults operand/PostgreSQL image to 14.4 (was\ + \ earlier in 1.15.x); verify your clusters\u2019 `.spec.imageName`/operand\ + \ image pinning if you rely on a specific minor version.", 'Backup/WAL archiving + conditions now use Kubernetes built-in Condition types; if you have tooling + that parses old custom condition fields, validate it against the new status + output.', Kubernetes 1.24 is supported (and Barman >= 3.0.0 is required + for future PostgreSQL 15 support).] + features: ["Offline logical import/major upgrade workflow via `bootstrap.initdb.import`,\ + \ supporting \u201Cmicroservice\u201D (single DB) and \u201Cmonolith\u201D\ + \ (multiple DBs + roles) import from an external or in-cluster PostgreSQL\ + \ using pg_dump/pg_restore.", 'Label-based anti-affinity for synchronous + replicas to ensure sync standbys land on nodes with different characteristics + (e.g., different AZ) than the primary.', Azure AD Workload Identity support + for Barman Cloud backups via `inheritFromAzureAD`., New `barmanObjectStore.s3Credentials.region` + value to set AWS region for backup and recovery object stores., Recovery/cloning + can now redefine app DB name/owner/secret when restoring from object store + or cloning via pg_basebackup (previously only initdb bootstrap).] breaking_changes: [] chart_version: 0.14.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.16.0 + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.16.0'] - version: 1.15.0 - kube: - - '1.23' - - '1.22' - - '1.21' + kube: ['1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null chart_version: 0.13.0 - images: - - ghcr.io/cloudnative-pg/cloudnative-pg:1.15.0 - name: cloudnative-pg + images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.15.0'] - icon: https://github.com/kubernetes/kubernetes/raw/master/logo/logo.png git_url: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler release_url: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-{vsn} @@ -18581,8 +15448,7 @@ addons: chart_name: cluster-autoscaler versions: - version: 1.35.0 - kube: - - '1.35' + kube: ['1.35'] requirements: [] incompatibilities: [] summary: @@ -18593,462 +15459,377 @@ addons: \ verify the chart values render `imagePullSecrets` where you expect for both\ \ main and updater components.\n- **Image tag bump**: update to `registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0`\ \ (and arch-specific images)." - chart_updates: - - Chart now supports setting a VPA recommender via `vpa.recommender` (#8567). - - Updater deployment now receives `imagePullSecrets` (#8711). - features: - - CapacityBuffers v1beta1 API is released and integrated with ResourceQuotas; - buffer replicas will shrink to respect quotas. - - Autoscaler can now account for CSI volume limits when scaling nodes. - - Expanded accelerator resource support (amd.com/gpu, gpu.intel.com/xe, habana.ai/gaudi). - - 'New tuning/observability options: `--max-node-startup-time`, `--predicate-parallelism`, - and new/updated metrics including node deletion duration histogram and scale-down - simulation timing.' - - Optimized scaling loop interval is enabled by default, changing default behavior - toward faster loops. - breaking_changes: - - CapacityBuffers CRD scope changes from **Cluster** to **Namespaced**; existing - CRs/automation must be migrated accordingly. - - External gRPC cloudprovider APIs deprecate several fields (nodeInfo/time fields) - in favor of byte/duration equivalents; external integrations should update - before removals land. - - '`--scale-down-enabled` is deprecated; plan to remove/replace usage in automation/scripts.' - - AWS provider switches to AWS SDK v2 and deprecates v1; custom builds/plugins - depending on v1 need adjustment. + chart_updates: [Chart now supports setting a VPA recommender via `vpa.recommender` + (#8567)., Updater deployment now receives `imagePullSecrets` (#8711).] + features: [CapacityBuffers v1beta1 API is released and integrated with ResourceQuotas; + buffer replicas will shrink to respect quotas., Autoscaler can now account + for CSI volume limits when scaling nodes., 'Expanded accelerator resource + support (amd.com/gpu, gpu.intel.com/xe, habana.ai/gaudi).', 'New tuning/observability + options: `--max-node-startup-time`, `--predicate-parallelism`, and new/updated + metrics including node deletion duration histogram and scale-down simulation + timing.', 'Optimized scaling loop interval is enabled by default, changing + default behavior toward faster loops.'] + breaking_changes: [CapacityBuffers CRD scope changes from **Cluster** to **Namespaced**; + existing CRs/automation must be migrated accordingly., External gRPC cloudprovider + APIs deprecate several fields (nodeInfo/time fields) in favor of byte/duration + equivalents; external integrations should update before removals land., + '`--scale-down-enabled` is deprecated; plan to remove/replace usage in automation/scripts.', + AWS provider switches to AWS SDK v2 and deprecates v1; custom builds/plugins + depending on v1 need adjustment.] chart_version: 9.59.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.0'] - version: 1.34.2 - kube: - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'In 1.33.x, DRA (Dynamic Resource Allocation) support matured: faster/safer - snapshotting (DeltaSnapshotStore, patch-based snapshots) and better handling - of node readiness after scale-up; Cluster API provider gained better DRA handling - for scale-from-zero.' - - 'Performance/behavior improvements in 1.33.x: parallelized pod addition when - building snapshots (tunable via `--cluster-snapshot-parallelization`), improved - ProvisioningRequest processing (less delay, instance filtering via `--checkCapacityProvisioningRequestProcessorInstance`), - and default expander changed to `least-waste` (instead of `random`).' - - 'In 1.34.2, multiple correctness/stability fixes landed: proactive scale-up - no longer injects fake pods for scheduling-gated pods, and a panic in SimulateNodeRemoval - is prevented when node info is missing.' - - 1.34.2 includes Cluster API improvements (process managed labels) and dependency - bumps to Kubernetes 1.34.2, plus Azure SKU list/testing updates and a Capacity - Buffers CRD scope fix backport. - breaking_changes: - - 'Removed deprecated flags in the 1.33 line; upgrades will fail or behave unexpectedly - if your deployment still sets any of: `--max-autoprovisioned-node-group-count`, - `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, - or `--max-empty-bulk-delete`.' - - Default expander changed from `random` to `least-waste` in 1.33; if you relied - on prior expander behavior, explicitly set `--expander=` to keep the old selection - strategy. + kube: ['1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['In 1.33.x, DRA (Dynamic Resource Allocation) support matured: faster/safer + snapshotting (DeltaSnapshotStore, patch-based snapshots) and better handling + of node readiness after scale-up; Cluster API provider gained better DRA + handling for scale-from-zero.', 'Performance/behavior improvements in 1.33.x: + parallelized pod addition when building snapshots (tunable via `--cluster-snapshot-parallelization`), + improved ProvisioningRequest processing (less delay, instance filtering + via `--checkCapacityProvisioningRequestProcessorInstance`), and default + expander changed to `least-waste` (instead of `random`).', 'In 1.34.2, multiple + correctness/stability fixes landed: proactive scale-up no longer injects + fake pods for scheduling-gated pods, and a panic in SimulateNodeRemoval + is prevented when node info is missing.', '1.34.2 includes Cluster API improvements + (process managed labels) and dependency bumps to Kubernetes 1.34.2, plus + Azure SKU list/testing updates and a Capacity Buffers CRD scope fix backport.'] + breaking_changes: ['Removed deprecated flags in the 1.33 line; upgrades will + fail or behave unexpectedly if your deployment still sets any of: `--max-autoprovisioned-node-group-count`, + `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, + or `--max-empty-bulk-delete`.', 'Default expander changed from `random` + to `least-waste` in 1.33; if you relied on prior expander behavior, explicitly + set `--expander=` to keep the old selection strategy.'] chart_version: 9.53.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.2 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.2'] - version: 1.33.0 - kube: - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - DRA (Dynamic Resource Allocation) work matured in 1.33.0 with more efficient - snapshot processing (DeltaSnapshotStore, patch-based snapshots) and better - handling of node readiness after scale-up. - - 'Performance improvements: parallelized adding pods to the cluster snapshot - for scale-up; tunable via `--cluster-snapshot-parallelization`.' - - 'ProvisioningRequest improvements: ability to filter CheckCapacity ProvisioningRequests - by autoscaler instance; faster/frequent processing of newly created ProvisioningRequests; - additional throughput improvements (parallel condition marking).' - - 'Behavioral improvements: default expander changed from `random` to `least-waste` - to avoid selecting unnecessarily expensive nodes.' - - 'Provider enhancements: Cluster API provider can handle DRA devices for scale-from-0; - AWS ignores unrecognized provider IDs; Azure VM node pools enabled; GCE pricing - and diskTypes request resilience updates; various provider bug fixes (Azure - crash, Kamatera alignment, GCE memory leak).' - breaking_changes: - - 'Removed deprecated flags in 1.33.0: `--max-autoprovisioned-node-group-count`, - `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, - and `--max-empty-bulk-delete` (previously deprecated; in 1.32.0 it still worked - but warned).' - - If you relied on the default expander behavior, note the default changed to - `least-waste`; set `--expander=random` explicitly to preserve prior behavior. + kube: ['1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['DRA (Dynamic Resource Allocation) work matured in 1.33.0 with more + efficient snapshot processing (DeltaSnapshotStore, patch-based snapshots) + and better handling of node readiness after scale-up.', 'Performance improvements: + parallelized adding pods to the cluster snapshot for scale-up; tunable via + `--cluster-snapshot-parallelization`.', 'ProvisioningRequest improvements: + ability to filter CheckCapacity ProvisioningRequests by autoscaler instance; + faster/frequent processing of newly created ProvisioningRequests; additional + throughput improvements (parallel condition marking).', 'Behavioral improvements: + default expander changed from `random` to `least-waste` to avoid selecting + unnecessarily expensive nodes.', 'Provider enhancements: Cluster API provider + can handle DRA devices for scale-from-0; AWS ignores unrecognized provider + IDs; Azure VM node pools enabled; GCE pricing and diskTypes request resilience + updates; various provider bug fixes (Azure crash, Kamatera alignment, GCE + memory leak).'] + breaking_changes: ['Removed deprecated flags in 1.33.0: `--max-autoprovisioned-node-group-count`, + `--node-autoprovisioning-enabled`, `--gce-expander-ephemeral-storage-support`, + and `--max-empty-bulk-delete` (previously deprecated; in 1.32.0 it still + worked but warned).', 'If you relied on the default expander behavior, note + the default changed to `least-waste`; set `--expander=random` explicitly + to preserve prior behavior.'] chart_version: 9.51.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.0'] - version: 1.32.0 - kube: - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Experimental Dynamic Resource Allocation (DRA) autoscaling support (disabled - by default); enable with `--enable-dynamic-resource-allocation` plus the cluster - `DynamicResourceAllocation` feature gate and additional RBAC for `resource.k8s.io` - objects. - - 'ProvisioningRequest improvements: v1 CRD added; faster/frequent loops when - ProvisioningRequest seen; batch processing for CheckCapacity requests with - new batch-size/timebox flags; new parameter limiting retries; parallel marking - of CheckCapacity conditions to increase throughput.' - - 'Operational behavior tweaks: best-effort eviction of DaemonSet pods when - draining empty nodes; custom lease resource name via `--lease-resource-name`; - new flag `--force-delete-long-unregistered-nodes` to remove long-unregistered - nodes even if it violates nodegroup min size constraints.' - - 'Cloud-provider enhancements: AWS adds Nvidia L40s and g6e instance support - and optimizes instance requirement caching; Azure improves scale-from-zero - accuracy, adds cache/fast-delete flags, spot pool scaling fixes, and updated - SKU list; Hetzner adds custom endpoint and placement group support; OCI adds - node-group auto-discovery support; Exoscale adds `--nodes` flag support.' - - 'gRPC expander behavior change: if server returns nil best options, client - returns nil (avoid unexpected behavior).' - breaking_changes: - - Removed legacy scale-down code (may affect behavior/metrics; validate scale-down - outcomes in staging). - - '`--parallel-drain` flag removed; use `--max-drain-parallelism` (set to 1 - to preserve single-node drain behavior).' - - 'Azure GPU node identification changed: VMSS GPU nodes are now identified - by `kubernetes.azure.com/accelerator` label instead of `accelerator` (update - labels/queries/taints/affinity accordingly).' - - '`--max-empty-bulk-delete` deprecated; still works but will be replaced by - `--max-scale-down-parallelism` in a future release (start migrating now).' + kube: ['1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Experimental Dynamic Resource Allocation (DRA) autoscaling support + (disabled by default); enable with `--enable-dynamic-resource-allocation` + plus the cluster `DynamicResourceAllocation` feature gate and additional + RBAC for `resource.k8s.io` objects., 'ProvisioningRequest improvements: + v1 CRD added; faster/frequent loops when ProvisioningRequest seen; batch + processing for CheckCapacity requests with new batch-size/timebox flags; + new parameter limiting retries; parallel marking of CheckCapacity conditions + to increase throughput.', 'Operational behavior tweaks: best-effort eviction + of DaemonSet pods when draining empty nodes; custom lease resource name + via `--lease-resource-name`; new flag `--force-delete-long-unregistered-nodes` + to remove long-unregistered nodes even if it violates nodegroup min size + constraints.', 'Cloud-provider enhancements: AWS adds Nvidia L40s and g6e + instance support and optimizes instance requirement caching; Azure improves + scale-from-zero accuracy, adds cache/fast-delete flags, spot pool scaling + fixes, and updated SKU list; Hetzner adds custom endpoint and placement + group support; OCI adds node-group auto-discovery support; Exoscale adds + `--nodes` flag support.', 'gRPC expander behavior change: if server returns + nil best options, client returns nil (avoid unexpected behavior).'] + breaking_changes: [Removed legacy scale-down code (may affect behavior/metrics; + validate scale-down outcomes in staging)., '`--parallel-drain` flag removed; + use `--max-drain-parallelism` (set to 1 to preserve single-node drain behavior).', + 'Azure GPU node identification changed: VMSS GPU nodes are now identified + by `kubernetes.azure.com/accelerator` label instead of `accelerator` (update + labels/queries/taints/affinity accordingly).', '`--max-empty-bulk-delete` + deprecated; still works but will be replaced by `--max-scale-down-parallelism` + in a future release (start migrating now).'] chart_version: 9.46.6 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.0'] - version: 1.31.0 - kube: - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Proactive scale-up (disabled by default) can provision nodes before pods are - fully created/marked unschedulable; tunable with the new `--pod-injection-limit` - flag to avoid instability on large clusters. - - ProvisioningRequest v1 API support was added. - - New `least-nodes` expander option was introduced to bias scale-ups toward - using fewer nodes. - - New `--max-binpacking-time` flag caps binpacking duration to prevent rare - unresponsive behavior with very large pending pod sets. - - Improved handling of failed scale-ups (faster recovery when multiple quota/stockout - errors occur). - - Cluster Autoscaler can use in-cluster Kubernetes config when self-hosted as - a pod (simplifies auth/config in many deployments). - - 'Provider improvements: AWS fixes around placeholder vs real instance scale-down - and taints on MNGs at size 0; Azure config/interface improvements and new - features; GCE performance improvements for listing instances; Cluster API - provider gains per-nodegroup autoscaling options; Hetzner backoff fix.' - breaking_changes: - - 'Azure ACTION REQUIRED: VMSS GPU node groups must now include the `kubernetes.azure.com/accelerator` - label in addition to `accelerator`, otherwise GPU nodes may not be recognized/handled - correctly.' - - Azure configuration field and environment variable names were renamed (old - names still work and take precedence), but teams should update configs to - the new names and reference the cloud-provider-azure configuration docs going - forward. + kube: ['1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Proactive scale-up (disabled by default) can provision nodes before + pods are fully created/marked unschedulable; tunable with the new `--pod-injection-limit` + flag to avoid instability on large clusters., ProvisioningRequest v1 API + support was added., New `least-nodes` expander option was introduced to + bias scale-ups toward using fewer nodes., New `--max-binpacking-time` flag + caps binpacking duration to prevent rare unresponsive behavior with very + large pending pod sets., Improved handling of failed scale-ups (faster recovery + when multiple quota/stockout errors occur)., Cluster Autoscaler can use + in-cluster Kubernetes config when self-hosted as a pod (simplifies auth/config + in many deployments)., 'Provider improvements: AWS fixes around placeholder + vs real instance scale-down and taints on MNGs at size 0; Azure config/interface + improvements and new features; GCE performance improvements for listing + instances; Cluster API provider gains per-nodegroup autoscaling options; + Hetzner backoff fix.'] + breaking_changes: ['Azure ACTION REQUIRED: VMSS GPU node groups must now include + the `kubernetes.azure.com/accelerator` label in addition to `accelerator`, + otherwise GPU nodes may not be recognized/handled correctly.', 'Azure configuration + field and environment variable names were renamed (old names still work + and take precedence), but teams should update configs to the new names and + reference the cloud-provider-azure configuration docs going forward.'] chart_version: 9.44.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.31.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.31.0'] - version: 1.30.0 - kube: - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Provider rename: the former Packet cloud provider is now fully renamed to - Equinix Metal; in 1.30.0 you should use `--cloud-provider=equinixmetal` and - update any related env vars/configs if still referencing packet.' - - 'New scale-down behavior control: `--scale-down-delay-type-local` lets you - choose whether the `--scale-down-delay-after-*` timers apply per nodegroup - (local) or across all nodegroups (global).' - - 'New scale-up backoff control: `--node-group-keep-backoff-out-of-resources` - makes CA honor the full backoff window after out-of-resources errors during - scale-up.' - - 'Operational observability improvements: node group health/backoff metrics - added; `function_duration_seconds` metric uses finer exponential buckets; - status ConfigMap now stores status data as YAML and includes scale-up backoff - error info.' - - 'Additional optional tuning: restored QPS limit flags; added `frequent-loops-enabled` - (disabled by default) to run iterations more frequently.' - breaking_changes: - - 'Cloud provider rename impact: if you still use `--cloud-provider=packet` - or Packet-specific env vars, migrate to Equinix Metal naming; Packet is effectively - removed/renamed in 1.30.0.' - - 'Status ConfigMap format change: the `cluster-autoscaler-status` ConfigMap - status field switches to YAML, so any scripts/parsers expecting the previous - format must be updated.' - - 'ProvisioningRequest is not actually available by default: code landed with - beta API but the feature flag is hard-disabled in 1.30.0; enabling requires - reverting #6755 and building custom binaries/images.' + kube: ['1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Provider rename: the former Packet cloud provider is now fully renamed + to Equinix Metal; in 1.30.0 you should use `--cloud-provider=equinixmetal` + and update any related env vars/configs if still referencing packet.', 'New + scale-down behavior control: `--scale-down-delay-type-local` lets you choose + whether the `--scale-down-delay-after-*` timers apply per nodegroup (local) + or across all nodegroups (global).', 'New scale-up backoff control: `--node-group-keep-backoff-out-of-resources` + makes CA honor the full backoff window after out-of-resources errors during + scale-up.', 'Operational observability improvements: node group health/backoff + metrics added; `function_duration_seconds` metric uses finer exponential + buckets; status ConfigMap now stores status data as YAML and includes scale-up + backoff error info.', 'Additional optional tuning: restored QPS limit flags; + added `frequent-loops-enabled` (disabled by default) to run iterations more + frequently.'] + breaking_changes: ['Cloud provider rename impact: if you still use `--cloud-provider=packet` + or Packet-specific env vars, migrate to Equinix Metal naming; Packet is + effectively removed/renamed in 1.30.0.', 'Status ConfigMap format change: + the `cluster-autoscaler-status` ConfigMap status field switches to YAML, + so any scripts/parsers expecting the previous format must be updated.', + 'ProvisioningRequest is not actually available by default: code landed with + beta API but the feature flag is hard-disabled in 1.30.0; enabling requires + reverting #6755 and building custom binaries/images.'] chart_version: 9.37.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.30.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.30.0'] - version: 1.29.0 - kube: - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - New `--bypassed-scheduler-names` flag to let Cluster Autoscaler react to pending - pods without waiting for specific schedulers to mark them unschedulable; can - reduce scale-up latency but may increase CA load on very large bursts. - - "New `--drain-priority-config` flag to tune scale-down/drain behavior by pod\ - \ priority; mutually exclusive with `--max-graceful-termination-sec` (defaults\ - \ preserve existing behavior if you don\u2019t use it)." - - "Optional dynamic node delete delay with `--dynamic-node-delete-delay-after-taint-enabled`,\ - \ making taint\u2192drain delay adapt to API server latency for better scale-down\ - \ throughput and fewer race conditions." - - Structured logging support via `--logging-format json`. - - 'New metrics: `node_group_target_count` (requires `--emit-per-nodegroup-metrics`) - and `node_taints_count`.' - - New `--kube-api-content-type` flag; default switches to protobuf (`application/vnd.kubernetes.protobuf`) - instead of JSON. - - 'Provider enhancements: AWS instance type list updates, caching to reduce - AWS API calls, better scale-from-zero with existing EBS CSI PVs; Civo scale-from-zero; - Cluster API arch override for scale-from-zero; new Kwok cloud provider; gRPC - timeout config and better optional-method signaling.' - breaking_changes: - - 'Deprecation: `--ignore-taint` / `ignore-taint.cluster-autoscaler.kubernetes.io/` - is deprecated in favor of `--status-taint`/`status-taint...` and `--startup-taint`/`startup-taint...`; - old flag still works but now behaves like startup taint.' - - 'Deprecation: unused flags `--node-autoprovisioning-enabled` and `--max-autoprovisioned-node-group-count` - are deprecated and will be removed in a future release.' - - 'Azure: AKS `vmType` removed (may require config cleanup for AKS users).' - - 'Equinix Metal: `packet` cloud provider is deprecated in favor of `equinixmetal`; - env var names changed (with backward compatibility) and facilities support - removed in favor of metros.' - - 'GCE: `--gce-expander-ephemeral-storage-support` deprecated/ignored because - ephemeral storage support is always on.' - - Default API server content type changes to protobuf unless overridden; can - affect environments that rely on JSON for debugging/proxies or have compatibility - constraints. + kube: ['1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [New `--bypassed-scheduler-names` flag to let Cluster Autoscaler react + to pending pods without waiting for specific schedulers to mark them unschedulable; + can reduce scale-up latency but may increase CA load on very large bursts., + "New `--drain-priority-config` flag to tune scale-down/drain behavior by pod\ + \ priority; mutually exclusive with `--max-graceful-termination-sec` (defaults\ + \ preserve existing behavior if you don\u2019t use it).", "Optional dynamic\ + \ node delete delay with `--dynamic-node-delete-delay-after-taint-enabled`,\ + \ making taint\u2192drain delay adapt to API server latency for better scale-down\ + \ throughput and fewer race conditions.", Structured logging support via + `--logging-format json`., 'New metrics: `node_group_target_count` (requires + `--emit-per-nodegroup-metrics`) and `node_taints_count`.', New `--kube-api-content-type` + flag; default switches to protobuf (`application/vnd.kubernetes.protobuf`) + instead of JSON., 'Provider enhancements: AWS instance type list updates, + caching to reduce AWS API calls, better scale-from-zero with existing EBS + CSI PVs; Civo scale-from-zero; Cluster API arch override for scale-from-zero; + new Kwok cloud provider; gRPC timeout config and better optional-method + signaling.'] + breaking_changes: ['Deprecation: `--ignore-taint` / `ignore-taint.cluster-autoscaler.kubernetes.io/` + is deprecated in favor of `--status-taint`/`status-taint...` and `--startup-taint`/`startup-taint...`; + old flag still works but now behaves like startup taint.', 'Deprecation: + unused flags `--node-autoprovisioning-enabled` and `--max-autoprovisioned-node-group-count` + are deprecated and will be removed in a future release.', 'Azure: AKS `vmType` + removed (may require config cleanup for AKS users).', 'Equinix Metal: `packet` + cloud provider is deprecated in favor of `equinixmetal`; env var names changed + (with backward compatibility) and facilities support removed in favor of + metros.', 'GCE: `--gce-expander-ephemeral-storage-support` deprecated/ignored + because ephemeral storage support is always on.', Default API server content + type changes to protobuf unless overridden; can affect environments that + rely on JSON for debugging/proxies or have compatibility constraints.] chart_version: 9.36.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.29.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.29.0'] - version: 1.28.2 - kube: - - '1.28' + kube: ['1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Updates Cluster Autoscaler to v1.28.2, which includes a fix for a startup - crash when using the `--leader-elect` flag. - - Adds an official s390x image variant for v1.28.2 (in addition to amd64/arm64). + features: ['Updates Cluster Autoscaler to v1.28.2, which includes a fix for + a startup crash when using the `--leader-elect` flag.', Adds an official + s390x image variant for v1.28.2 (in addition to amd64/arm64).] breaking_changes: [] chart_version: 9.34.1 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.28.2 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.28.2'] - version: 1.27.2 - kube: - - '1.27' + kube: ['1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Updated Kubernetes vendor dependencies to 1.27.2 (aligns Cluster Autoscaler - with Kubernetes 1.27 APIs/behavior). - - 'AliCloud: added support for RRSA authentication.' - - 'AWS: added preview support for EC2 instance type p4de.24xlarge.' + features: [Updated Kubernetes vendor dependencies to 1.27.2 (aligns Cluster + Autoscaler with Kubernetes 1.27 APIs/behavior)., 'AliCloud: added support + for RRSA authentication.', 'AWS: added preview support for EC2 instance + type p4de.24xlarge.'] breaking_changes: [] chart_version: 9.33.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.27.2 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.27.2'] - version: 1.26.2 - kube: - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Improved scale-down behavior: Cluster Autoscaler no longer blocks scale-down - across the whole cluster just because some pods are waiting for nodes to boot; - it can scale down other node groups while scale-up is in progress.' - - Added a gRPC expander and an external gRPC cloud provider option for extensible - scaling strategies/providers. - - Added a debugging snapshot feature to capture autoscaler state for troubleshooting. - - Added `--node-info-cache-expire-time` to control how long node templates are - cached. - - 'Improved resilience: autoscaler can continue operating even if it cannot - remove some VMs that failed to register to the cluster.' - - 'Performance fixes: faster reaction when many similar pods exist (e.g., indexed - Jobs), improved handling of large scale-ups, and optimizations for large environments - (e.g., GCE).' - - 'Improved correctness: fixed multiple issues with daemonset accounting during - scale-up calculations.' - - Status ConfigMap now includes additional details about nodes with unready - resources. - - 'Cloud/provider enhancements: AWS early-abort when ASG has no capacity and - tag key `:` support; updated instance type lists for AWS/Azure; Azure NP-series - support; Cluster API multi-node delete fix; provider additions/renames (OracleCloud, - TencentCloud, Vultr; Packet->Equinix Metal).' - - 'Azure-specific stability fix in 1.26.2: avoids crash in non-public clouds.' - breaking_changes: - - Container image registry moved from `k8s.gcr.io` to `registry.k8s.io` between - 1.24.0 and 1.26.2; update your image repository references, mirrors, and any - allowlists accordingly. + kube: ['1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Improved scale-down behavior: Cluster Autoscaler no longer blocks + scale-down across the whole cluster just because some pods are waiting for + nodes to boot; it can scale down other node groups while scale-up is in + progress.', Added a gRPC expander and an external gRPC cloud provider option + for extensible scaling strategies/providers., Added a debugging snapshot + feature to capture autoscaler state for troubleshooting., Added `--node-info-cache-expire-time` + to control how long node templates are cached., 'Improved resilience: autoscaler + can continue operating even if it cannot remove some VMs that failed to + register to the cluster.', 'Performance fixes: faster reaction when many + similar pods exist (e.g., indexed Jobs), improved handling of large scale-ups, + and optimizations for large environments (e.g., GCE).', 'Improved correctness: + fixed multiple issues with daemonset accounting during scale-up calculations.', + Status ConfigMap now includes additional details about nodes with unready + resources., 'Cloud/provider enhancements: AWS early-abort when ASG has no + capacity and tag key `:` support; updated instance type lists for AWS/Azure; + Azure NP-series support; Cluster API multi-node delete fix; provider additions/renames + (OracleCloud, TencentCloud, Vultr; Packet->Equinix Metal).', 'Azure-specific + stability fix in 1.26.2: avoids crash in non-public clouds.'] + breaking_changes: ['Container image registry moved from `k8s.gcr.io` to `registry.k8s.io` + between 1.24.0 and 1.26.2; update your image repository references, mirrors, + and any allowlists accordingly.'] chart_version: 9.28.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.2 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.2'] - version: 1.24.0 - kube: - - '1.24' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Scale-down no longer blocks cluster-wide when some pods are waiting for nodes - to boot; scale-down can proceed in other node groups while scale-up is happening - elsewhere. - - New gRPC expander option and a new External gRPC cloud provider, enabling - custom expansion logic and providers over gRPC. - - New debugging snapshot capability to capture autoscaler state for troubleshooting. - - "Improved resiliency: autoscaler can continue operating even if it can\u2019\ - t delete some VMs that never registered with the cluster." - - New --node-info-cache-expire-time flag to control caching duration for node - templates. - - 'Provider additions/updates: new OracleCloud, TencentCloud, and Vultr providers; - Equinix Metal provider rename from Packet; instance-type list updates across - AWS/Azure and performance improvements on GCE.' - breaking_changes: - - If you build a custom Cluster Autoscaler image or import its code, note that - the previously deprecated NodeInfoProcessor interface is removed in 1.24 and - you must migrate to TemplateNodeInfoProvider; official images are unaffected. - - Go module import of Cluster Autoscaler 1.24.0 may fail to compile for downstream - projects importing CA code (known issue); this does not affect running the - official container image. + kube: ['1.24'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Scale-down no longer blocks cluster-wide when some pods are waiting + for nodes to boot; scale-down can proceed in other node groups while scale-up + is happening elsewhere., 'New gRPC expander option and a new External gRPC + cloud provider, enabling custom expansion logic and providers over gRPC.', + New debugging snapshot capability to capture autoscaler state for troubleshooting., + "Improved resiliency: autoscaler can continue operating even if it can\u2019\ + t delete some VMs that never registered with the cluster.", New --node-info-cache-expire-time + flag to control caching duration for node templates., 'Provider additions/updates: + new OracleCloud, TencentCloud, and Vultr providers; Equinix Metal provider + rename from Packet; instance-type list updates across AWS/Azure and performance + improvements on GCE.'] + breaking_changes: ['If you build a custom Cluster Autoscaler image or import + its code, note that the previously deprecated NodeInfoProcessor interface + is removed in 1.24 and you must migrate to TemplateNodeInfoProvider; official + images are unaffected.', Go module import of Cluster Autoscaler 1.24.0 may + fail to compile for downstream projects importing CA code (known issue); + this does not affect running the official container image.] chart_version: 9.27.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.24.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.24.0'] - version: 1.23.0 - kube: - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - '`--expander` now supports a comma-separated list of expanders with fallback - behavior when the first returns multiple node groups.' - - New `--feature-gates` flag to control Kubernetes feature gates for the embedded - kube-scheduler code used by Cluster Autoscaler. - - More reliable Kubernetes Events attached to the `cluster-autoscaler-status` - ConfigMap for every scale-up/scale-down attempt (including failures). - - Performance improvements for clusters with many pods using projected volumes. - - 'AWS: Instance type discovery now uses the EC2 `DescribeInstanceTypes` API - (adds NVIDIA A100 support), reduces API calls, and allows per-ASG scale-down - options.' - - 'Azure: Per-VMSS scale-down options, optional use of CLI credentials instead - of service principal, and NVIDIA A100 support.' - - 'GCE: Per-MIG scale-down options, ability to specify SSD ephemeral-storage - via instance templates enabling scale-from-0 for pods requesting it, and reduced - API calls.' - - New Brightbox cloud provider support. - breaking_changes: - - AWS default configuration now requires additional IAM permission `ec2:DescribeInstanceTypes` - due to switching instance type list generation to the DescribeInstanceTypes - API. - - NodeInfoProcessor interface is deprecated (removed in 1.24); impacts only - users building customized Cluster Autoscaler images/plugins and should be - migrated to TemplateNodeInfoProvider. + kube: ['1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['`--expander` now supports a comma-separated list of expanders with + fallback behavior when the first returns multiple node groups.', New `--feature-gates` + flag to control Kubernetes feature gates for the embedded kube-scheduler + code used by Cluster Autoscaler., More reliable Kubernetes Events attached + to the `cluster-autoscaler-status` ConfigMap for every scale-up/scale-down + attempt (including failures)., Performance improvements for clusters with + many pods using projected volumes., 'AWS: Instance type discovery now uses + the EC2 `DescribeInstanceTypes` API (adds NVIDIA A100 support), reduces + API calls, and allows per-ASG scale-down options.', 'Azure: Per-VMSS scale-down + options, optional use of CLI credentials instead of service principal, and + NVIDIA A100 support.', 'GCE: Per-MIG scale-down options, ability to specify + SSD ephemeral-storage via instance templates enabling scale-from-0 for pods + requesting it, and reduced API calls.', New Brightbox cloud provider support.] + breaking_changes: ['AWS default configuration now requires additional IAM permission + `ec2:DescribeInstanceTypes` due to switching instance type list generation + to the DescribeInstanceTypes API.', NodeInfoProcessor interface is deprecated + (removed in 1.24); impacts only users building customized Cluster Autoscaler + images/plugins and should be migrated to TemplateNodeInfoProvider.] chart_version: 9.24.0 - images: - - registry.k8s.io/autoscaling/cluster-autoscaler:v1.23.0 + images: ['registry.k8s.io/autoscaling/cluster-autoscaler:v1.23.0'] - version: 1.21.1 - kube: - - '1.21' + kube: ['1.21'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Core performance and correctness improvements in binpacking and scale-down - simulations, plus new metric for `--max-nodes-total` and better utilization - calculation (DaemonSet request handling). - - 'Broader cloud provider support and enhancements: new providers (CloudStack, - Exoscale, IONOS) and major additions for Cluster API and HuaweiCloud; ARM64 - build support added.' - - AWS/Azure/GCE received numerous reliability/performance improvements; in 1.21.1 - AWS gains proper IMDSv2 support and reduced memory usage; Packet adds providerID - prefix support and configurable controller node label. - breaking_changes: - - Error type returned by `IncreaseSize` changed from `apiError` to `cloudProviderError` - (could affect error handling or log parsing in integrations/tests). + features: ['Core performance and correctness improvements in binpacking and + scale-down simulations, plus new metric for `--max-nodes-total` and better + utilization calculation (DaemonSet request handling).', 'Broader cloud provider + support and enhancements: new providers (CloudStack, Exoscale, IONOS) and + major additions for Cluster API and HuaweiCloud; ARM64 build support added.', + AWS/Azure/GCE received numerous reliability/performance improvements; in 1.21.1 + AWS gains proper IMDSv2 support and reduced memory usage; Packet adds providerID + prefix support and configurable controller node label.] + breaking_changes: [Error type returned by `IncreaseSize` changed from `apiError` + to `cloudProviderError` (could affect error handling or log parsing in integrations/tests).] chart_version: 9.13.1 - images: - - k8s.gcr.io/autoscaling/cluster-autoscaler:v1.21.1 + images: ['k8s.gcr.io/autoscaling/cluster-autoscaler:v1.21.1'] - version: 1.20.0 - kube: - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Adds Helm chart support for the Magnum cloud provider. - - 'Cluster API provider: switches to using Kubernetes Unstructured objects, - adds node autodiscovery support and support for --cloud-config; updates the - annotation group identifier used.' - features: - - 'Performance improvements: faster binpacking and scale-down simulations via - fewer scheduler PreFilter calls; large-cluster scale-down unneeded-node detection - sped up 5x+.' - - 'New metrics/observability: exposes --max-nodes-total as a metric.' - - 'New platform support: ARM64 image/build support; added providers (Apache - CloudStack, Exoscale, IONOS) and expanded support for HuaweiCloud and Packet.' - - 'Improved scale-down behavior: best-effort eviction for DaemonSet pods on - non-empty nodes; more accurate node utilization by accounting for DaemonSet - requests in allocatable denominator.' - - Multiple cloud-provider fixes and enhancements across AWS/Azure/GCE (pricing, - caching, labels, throttling/backoff behavior, template labels, etc.). - breaking_changes: - - Error type returned from IncreaseSize changed from apiError to cloudProviderError - (could affect integrations relying on the specific error type). - - 'Image registry/name changes between 1.18.x and 1.20.0: 1.20.0 images are - published under k8s.gcr.io/autoscaling/* whereas 1.18.1 notes reference k8s-artifacts-prod - registries; update any pinned image repos accordingly.' + kube: ['1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Adds Helm chart support for the Magnum cloud provider., 'Cluster + API provider: switches to using Kubernetes Unstructured objects, adds node + autodiscovery support and support for --cloud-config; updates the annotation + group identifier used.'] + features: ['Performance improvements: faster binpacking and scale-down simulations + via fewer scheduler PreFilter calls; large-cluster scale-down unneeded-node + detection sped up 5x+.', 'New metrics/observability: exposes --max-nodes-total + as a metric.', 'New platform support: ARM64 image/build support; added providers + (Apache CloudStack, Exoscale, IONOS) and expanded support for HuaweiCloud + and Packet.', 'Improved scale-down behavior: best-effort eviction for DaemonSet + pods on non-empty nodes; more accurate node utilization by accounting for + DaemonSet requests in allocatable denominator.', 'Multiple cloud-provider + fixes and enhancements across AWS/Azure/GCE (pricing, caching, labels, throttling/backoff + behavior, template labels, etc.).'] + breaking_changes: [Error type returned from IncreaseSize changed from apiError + to cloudProviderError (could affect integrations relying on the specific + error type)., 'Image registry/name changes between 1.18.x and 1.20.0: 1.20.0 + images are published under k8s.gcr.io/autoscaling/* whereas 1.18.1 notes + reference k8s-artifacts-prod registries; update any pinned image repos accordingly.'] chart_version: 9.9.2 - images: - - k8s.gcr.io/autoscaling/cluster-autoscaler:v1.20.0 + images: ['k8s.gcr.io/autoscaling/cluster-autoscaler:v1.20.0'] - version: 1.18.1 - kube: - - '1.18' + kube: ['1.18'] requirements: [] incompatibilities: [] summary: null chart_version: 9.4.0 - images: - - us.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1 - name: cluster-autoscaler + images: ['us.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1'] - icon: https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/assets/logo/descheduler-stacked-color.png git_url: https://github.com/kubernetes-sigs/descheduler release_url: https://github.com/kubernetes-sigs/descheduler/releases/tag/v{vsn} @@ -19056,10 +15837,7 @@ addons: chart_name: descheduler versions: - version: 0.36.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -19072,31 +15850,22 @@ addons: \ Helm RBAC/ClusterRole was updated to account for **PVC-related failures**\ \ observed around 0.35.x; ensure you apply the new RBAC on upgrade (don\u2019\ t reuse old rendered manifests).\n" - chart_updates: - - 'Helm chart: add initContainers support.' - - 'Helm chart: allow overriding ServiceMonitor apiVersion.' - - 'Helm chart: update RBAC/ClusterRole to sync with base manifests and fix PVC-related - permission issues.' - - 'Chart metadata: icon URL updated.' - - "CI/security plumbing changes (pinned actions/plugins, updated scanners) that\ - \ don\u2019t affect runtime behavior." - features: - - "PodLifeTime strategy gained additional filters: condition, container exit\ - \ code, owner kind, and transition time\u2014enabling more precise eviction\ - \ targeting." - - Helm chart can now inject init containers into the descheduler Pod for pre-start - workflows. - - ServiceMonitor apiVersion is now configurable to improve compatibility with - different Prometheus Operator versions. + chart_updates: ['Helm chart: add initContainers support.', 'Helm chart: allow + overriding ServiceMonitor apiVersion.', 'Helm chart: update RBAC/ClusterRole + to sync with base manifests and fix PVC-related permission issues.', 'Chart + metadata: icon URL updated.', "CI/security plumbing changes (pinned actions/plugins,\ + \ updated scanners) that don\u2019t affect runtime behavior."] + features: ["PodLifeTime strategy gained additional filters: condition, container\ + \ exit code, owner kind, and transition time\u2014enabling more precise\ + \ eviction targeting.", Helm chart can now inject init containers into the + descheduler Pod for pre-start workflows., ServiceMonitor apiVersion is now + configurable to improve compatibility with different Prometheus Operator + versions.] breaking_changes: [] chart_version: 0.36.0 - images: - - registry.k8s.io/descheduler/descheduler:v0.36.0 + images: ['registry.k8s.io/descheduler/descheduler:v0.36.0'] - version: 0.35.1 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: @@ -19112,29 +15881,21 @@ addons: \ upgrade` and specifically review rendered RBAC and workload spec for any\ \ drift (serviceAccount, clusterrole rules, probes, securityContext, and any\ \ new initContainer blocks)." - chart_updates: - - Chart bump for descheduler v0.35.0 (included in v0.35.1). - - 'Helm chart: add initContainers support (PR #1826).' - - 'Helm chart: synchronize ClusterRole/RBAC with upstream base manifests (cherry-picked - #1836).' - - 'Helm chart: update icon URL in Chart.yaml (PR #1838).' - - 'CI/testing related: pin helm-unittest plugin version; bump chart-testing-action - (PR #1834).' - features: - - Helm chart can now configure init containers for the descheduler workload, - enabling pre-start tasks like config generation or fetching artifacts. - - PodLifeTime plugin extended with additional selectors/criteria such as condition, - exit code, and owner kind (helps target evictions more precisely if you use - PodLifeTime). + chart_updates: [Chart bump for descheduler v0.35.0 (included in v0.35.1)., 'Helm + chart: add initContainers support (PR #1826).', 'Helm chart: synchronize + ClusterRole/RBAC with upstream base manifests (cherry-picked #1836).', 'Helm + chart: update icon URL in Chart.yaml (PR #1838).', 'CI/testing related: + pin helm-unittest plugin version; bump chart-testing-action (PR #1834).'] + features: ['Helm chart can now configure init containers for the descheduler + workload, enabling pre-start tasks like config generation or fetching artifacts.', + 'PodLifeTime plugin extended with additional selectors/criteria such as condition, + exit code, and owner kind (helps target evictions more precisely if you + use PodLifeTime).'] breaking_changes: [] chart_version: 0.35.1 - images: - - registry.k8s.io/descheduler/descheduler:v0.35.1 + images: ['registry.k8s.io/descheduler/descheduler:v0.35.1'] - version: 0.34.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -19159,45 +15920,34 @@ addons: - **RBAC/permissions note:** if you use the built-in metrics collector / Prometheus\ \ integration, re-check RBAC after upgrade (v0.33.0 added perms when metricsCollector\ \ enabled; v0.34.0 expands Prometheus options)." - chart_updates: - - Removes references to deprecated/obsolete `deschedulerPolicy` fields from - chart values. - - Renders `deschedulerPolicy` via Helm `tpl` for more flexible templating. - - Updates default evictor configuration approach (removes no-op defaults; aligns - with `podProtections`). - - 'Sets `automountServiceAccountToken: true` on the Deployment.' - - Adds `activeDeadlineSeconds` to CronJob spec in the chart. - - Adds labels/annotations propagation to CronJob/Job; adds customizable Deployment - annotations. - - Fixes liveness probe timeout in the chart. - features: - - RemovePodsHavingTooManyRestarts can now sort candidate pods by restart count - to evict the worst offenders first. - - Prometheus metrics source supports different URL schemes (e.g., http/https) - for more flexible configuration. - - Eviction requests can include annotations to improve observability/auditing. - - DefaultEvictorArgs gains PodProtections (including an option for pods with - resource claims), improving safety controls on what can be evicted. - - PodLifeTime plugin can now allow Succeeded/Failed pod phases when configured, - broadening what it can act on. - breaking_changes: - - The chart removed obsolete `deschedulerPolicy` value fields; existing `values.yaml` - that still set them must be updated to the new structure or they will no longer - take effect. - - '`deschedulerPolicy` is processed with `tpl`; unescaped `{{ ... }}` sequences - inside the policy may now be evaluated as templates, changing rendered output - compared to previous versions.' - - Default evictor defaults changed (no more no-op defaults); if you relied on - implicit/default evictor settings you may need to explicitly configure `DefaultEvictorArgs`/`podProtections` - to preserve prior behavior. + chart_updates: [Removes references to deprecated/obsolete `deschedulerPolicy` + fields from chart values., Renders `deschedulerPolicy` via Helm `tpl` for + more flexible templating., Updates default evictor configuration approach + (removes no-op defaults; aligns with `podProtections`)., 'Sets `automountServiceAccountToken: + true` on the Deployment.', Adds `activeDeadlineSeconds` to CronJob spec + in the chart., Adds labels/annotations propagation to CronJob/Job; adds + customizable Deployment annotations., Fixes liveness probe timeout in the + chart.] + features: [RemovePodsHavingTooManyRestarts can now sort candidate pods by restart + count to evict the worst offenders first., 'Prometheus metrics source supports + different URL schemes (e.g., http/https) for more flexible configuration.', + Eviction requests can include annotations to improve observability/auditing., + 'DefaultEvictorArgs gains PodProtections (including an option for pods with + resource claims), improving safety controls on what can be evicted.', 'PodLifeTime + plugin can now allow Succeeded/Failed pod phases when configured, broadening + what it can act on.'] + breaking_changes: [The chart removed obsolete `deschedulerPolicy` value fields; + existing `values.yaml` that still set them must be updated to the new structure + or they will no longer take effect., '`deschedulerPolicy` is processed with + `tpl`; unescaped `{{ ... }}` sequences inside the policy may now be evaluated + as templates, changing rendered output compared to previous versions.', + Default evictor defaults changed (no more no-op defaults); if you relied on + implicit/default evictor settings you may need to explicitly configure `DefaultEvictorArgs`/`podProtections` + to preserve prior behavior.] chart_version: 0.34.0 - images: - - registry.k8s.io/descheduler/descheduler:v0.34.0 + images: ['registry.k8s.io/descheduler/descheduler:v0.34.0'] - version: 0.33.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -19212,39 +15962,30 @@ addons: re-validate them against the new chart. ' - chart_updates: - - Chart/image version bumps to align with descheduler v0.33.0. - - 'RBAC fixes: add missing permission for policy at ClusterRole.' - - RBAC additions when `metricsCollector` is enabled. - - 'Docs/NOTES changes in chart: move values.yaml comment about custom configmap - into NOTES.txt output; README updated to mention `cmdOptions.dry-run`.' - - Manifests/docs updated for v0.33.0. - features: - - Adds `grace_period_seconds` to `DeschedulerPolicy`, allowing a configurable - grace period for pod eviction. - - LowNodeUtilization gains per-plugin `evictionLimits` to cap evictions. - - "Low/NodeUtilization can integrate with Prometheus for \u201Cactual utilization\u201D\ - \ and allows selecting a metrics source via a string for extensibility." - - "Introduces a \u201Cstrict eviction policy\u201D mode to tighten eviction\ - \ behavior." - - Node utilization computation becomes more generic, can report utilization - for selected resources, and skips nodes lacking required extended resources - when averaging. - breaking_changes: - - Potential behavior changes in Low/NodeUtilization plugins due to refactoring - of thresholds/usage assessment and more generic node classification; validate - outcomes in a staging cluster before production rollout. - - "If you rely on custom/minimal RBAC, the chart\u2019s new/changed permissions\ - \ (especially for policy resources and `metricsCollector`) may require updating\ - \ your security review/overrides to avoid install/upgrade failures." + chart_updates: [Chart/image version bumps to align with descheduler v0.33.0., + 'RBAC fixes: add missing permission for policy at ClusterRole.', RBAC additions + when `metricsCollector` is enabled., 'Docs/NOTES changes in chart: move + values.yaml comment about custom configmap into NOTES.txt output; README + updated to mention `cmdOptions.dry-run`.', Manifests/docs updated for v0.33.0.] + features: ['Adds `grace_period_seconds` to `DeschedulerPolicy`, allowing a configurable + grace period for pod eviction.', LowNodeUtilization gains per-plugin `evictionLimits` + to cap evictions., "Low/NodeUtilization can integrate with Prometheus for\ + \ \u201Cactual utilization\u201D and allows selecting a metrics source via\ + \ a string for extensibility.", "Introduces a \u201Cstrict eviction policy\u201D\ + \ mode to tighten eviction behavior.", 'Node utilization computation becomes + more generic, can report utilization for selected resources, and skips nodes + lacking required extended resources when averaging.'] + breaking_changes: [Potential behavior changes in Low/NodeUtilization plugins + due to refactoring of thresholds/usage assessment and more generic node + classification; validate outcomes in a staging cluster before production + rollout., "If you rely on custom/minimal RBAC, the chart\u2019s new/changed\ + \ permissions (especially for policy resources and `metricsCollector`) may\ + \ require updating your security review/overrides to avoid install/upgrade\ + \ failures."] chart_version: 0.33.0 - images: - - registry.k8s.io/descheduler/descheduler:v0.33.0 + images: ['registry.k8s.io/descheduler/descheduler:v0.33.0'] - version: 0.32.2 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -19262,29 +16003,22 @@ addons: \ configurable.\n- v0.32.2 chart RBAC fixes:\n - Adds **missing ClusterRole\ \ permission for policy**.\n - Adds **additional permissions when `metricsCollector`\ \ is enabled** (compare your custom RBAC to upstream)." - chart_updates: - - "Chart bumped/updated as part of v0.31 line (notably an automated upgrade\ - \ mentioned as \u201Chelm: upgrade to v0.30.1\u201D in the notes)." - - Added Helm unit tests (helps detect template/value regressions). - - RBAC/ClusterRole permissions corrected in v0.32.2 (policy + metricsCollector). - features: - - 'PodEvictor enhancements: new options, made thread-safe, and supports limiting - total pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`).' - - 'KEP-1397 work: integration with the evacuation API as an alternative to the - eviction API (forward-looking; may be gated/optional depending on your config).' - - PodLifeTime plugin now checks init and ephemeral containers. - - 'Helm: namespace override settings added for more flexible deployments.' - breaking_changes: - - Removal of `descheduler/v1alpha1` type; policies/manifests referring to v1alpha1 - must be updated to the supported API version(s). + chart_updates: ["Chart bumped/updated as part of v0.31 line (notably an automated\ + \ upgrade mentioned as \u201Chelm: upgrade to v0.30.1\u201D in the notes).", + Added Helm unit tests (helps detect template/value regressions)., RBAC/ClusterRole + permissions corrected in v0.32.2 (policy + metricsCollector).] + features: ['PodEvictor enhancements: new options, made thread-safe, and supports + limiting total pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`).', + 'KEP-1397 work: integration with the evacuation API as an alternative to the + eviction API (forward-looking; may be gated/optional depending on your config).', + PodLifeTime plugin now checks init and ephemeral containers., 'Helm: namespace + override settings added for more flexible deployments.'] + breaking_changes: [Removal of `descheduler/v1alpha1` type; policies/manifests + referring to v1alpha1 must be updated to the supported API version(s).] chart_version: 0.32.2 - images: - - registry.k8s.io/descheduler/descheduler:v0.32.2 + images: ['registry.k8s.io/descheduler/descheduler:v0.32.2'] - version: 0.31.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -19307,65 +16041,48 @@ addons: \ now omit `securityContext` for Deployment/CronJob based on values. If you\ \ depend on a specific `securityContext`, ensure it remains enabled/configured\ \ after upgrade." - chart_updates: - - Chart templates updated to correctly type `replicas` and handle `cmdOption` - falsey values. - - Default deschedulerPolicy templating corrected; behavior may differ if you - depended on defaults. - - Added namespace override support in the Helm chart. - - Fixed leader election configuration key to `resourceNamespace` in chart values/templates. - - Made `securityContext` conditional for Deployment and CronJob; improved Helm - unit tests. - features: - - Pod evictor enhancements and new options; groundwork for eviction request - handling and thread-safety improvements. - - Support for limiting the **total** number of pods evicted per rescheduling - cycle (`maxNoOfPodsToEvictTotal`). - - PodLifeTime plugin gained checks for init containers and ephemeral containers. - - 'Integration work for KEP-1397: optional evacuation API flow as an alternative - to the eviction API (foundational work in this release).' - breaking_changes: - - Removed the `descheduler/v1alpha1` API type. Any manifests/policies still - referencing v1alpha1 must be updated to the supported policy API version used - by your deployment. - - Helm leader election namespace value key corrected to `resourceNamespace`; - configurations using the old key will stop applying after upgrade. + chart_updates: [Chart templates updated to correctly type `replicas` and handle + `cmdOption` falsey values., Default deschedulerPolicy templating corrected; + behavior may differ if you depended on defaults., Added namespace override + support in the Helm chart., Fixed leader election configuration key to `resourceNamespace` + in chart values/templates., Made `securityContext` conditional for Deployment + and CronJob; improved Helm unit tests.] + features: [Pod evictor enhancements and new options; groundwork for eviction + request handling and thread-safety improvements., Support for limiting the + **total** number of pods evicted per rescheduling cycle (`maxNoOfPodsToEvictTotal`)., + PodLifeTime plugin gained checks for init containers and ephemeral containers., + 'Integration work for KEP-1397: optional evacuation API flow as an alternative + to the eviction API (foundational work in this release).'] + breaking_changes: [Removed the `descheduler/v1alpha1` API type. Any manifests/policies + still referencing v1alpha1 must be updated to the supported policy API version + used by your deployment., Helm leader election namespace value key corrected + to `resourceNamespace`; configurations using the old key will stop applying + after upgrade.] chart_version: 0.31.0 - images: - - registry.k8s.io/descheduler/descheduler:v0.31.0 + images: ['registry.k8s.io/descheduler/descheduler:v0.31.0'] - version: 0.30.2 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Descheduler v0.29.0 includes several Helm-related improvements and one breaking-ish - template/values adjustment to avoid a CronJob args unmarshal error. - - Helm chart adds support for CronJob `timeZone`, `dnsConfig`, Pod `securityContext`, - and `ipFamilyPolicy` configuration. - features: - - Improved TopologySpreadConstraint handling, adding support for `nodeTaintsPolicy`, - `nodeAffinityPolicy`, and `matchLabelKeys`. - - PodLifeTime strategy now considers pods in `ImagePullBackOff`. - - Logging improvements (structured errors, JSON logging fixes, more readable - node utilization percentages, correct ownerKey). - - 'Compatibility and security updates: dependency bumps for multiple CVEs and - updated Kubernetes/Go dependencies, including Kubernetes 1.29 support.' - breaking_changes: - - Helm CronJob args values format changed to avoid an unmarshal error; existing - custom `cronJob.args`/args configuration may need adjustment when upgrading. + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Descheduler v0.29.0 includes several Helm-related improvements + and one breaking-ish template/values adjustment to avoid a CronJob args + unmarshal error., 'Helm chart adds support for CronJob `timeZone`, `dnsConfig`, + Pod `securityContext`, and `ipFamilyPolicy` configuration.'] + features: ['Improved TopologySpreadConstraint handling, adding support for `nodeTaintsPolicy`, + `nodeAffinityPolicy`, and `matchLabelKeys`.', PodLifeTime strategy now considers + pods in `ImagePullBackOff`., 'Logging improvements (structured errors, JSON + logging fixes, more readable node utilization percentages, correct ownerKey).', + 'Compatibility and security updates: dependency bumps for multiple CVEs and + updated Kubernetes/Go dependencies, including Kubernetes 1.29 support.'] + breaking_changes: [Helm CronJob args values format changed to avoid an unmarshal + error; existing custom `cronJob.args`/args configuration may need adjustment + when upgrading.] chart_version: 0.30.2 - images: - - registry.k8s.io/descheduler/descheduler:v0.30.2 + images: ['registry.k8s.io/descheduler/descheduler:v0.30.2'] - version: 0.29.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -19385,35 +16102,27 @@ addons: **Action for upgrade:** diff your current `values.yaml` against the new chart defaults and specifically validate any custom `cronJob.*`, `dnsConfig`, `securityContext`, and networking-related settings (`ipFamilyPolicy`).' - chart_updates: - - "Helm chart version was bumped alongside image updates as part of the v0.28.1\u2192\ - v0.29.0 release train." - - Chart gained additional configurability for CronJob (`timeZone`), Pod spec - (`dnsConfig`, `securityContext`), and networking (`ipFamilyPolicy`). - - CronJob args templating/values handling was changed to prevent unmarshal errors - (can impact existing values). - features: - - TopologySpreadConstraints support was expanded (nodeTaintsPolicy, nodeAffinityPolicy, - and matchLabelKeys handling). - - '`PodLifeTime` plugin now considers pods in `ImagePullBackOff` container status, - which can increase the set of pods eligible for eviction under that policy.' - - 'Logging improvements: more structured error logs during eviction and more - accurate/human-readable node utilization and topologySpreadConstraint fields.' - breaking_changes: - - "Potential Helm values behavior change for CronJob args: prior `cronJob.args`\ - \ values may fail to render or may need to be reformatted due to the unmarshal\ - \ fix\u2014verify during `helm template`/dry-run." - - 'Kubernetes 1.29 dependency/go-version bump: if you run older Kubernetes versions - or have strict version-skew constraints, validate descheduler compatibility - against your managed provider/K8s version before upgrading.' + chart_updates: ["Helm chart version was bumped alongside image updates as part\ + \ of the v0.28.1\u2192v0.29.0 release train.", 'Chart gained additional + configurability for CronJob (`timeZone`), Pod spec (`dnsConfig`, `securityContext`), + and networking (`ipFamilyPolicy`).', CronJob args templating/values handling + was changed to prevent unmarshal errors (can impact existing values).] + features: ['TopologySpreadConstraints support was expanded (nodeTaintsPolicy, + nodeAffinityPolicy, and matchLabelKeys handling).', '`PodLifeTime` plugin + now considers pods in `ImagePullBackOff` container status, which can increase + the set of pods eligible for eviction under that policy.', 'Logging improvements: + more structured error logs during eviction and more accurate/human-readable + node utilization and topologySpreadConstraint fields.'] + breaking_changes: ["Potential Helm values behavior change for CronJob args:\ + \ prior `cronJob.args` values may fail to render or may need to be reformatted\ + \ due to the unmarshal fix\u2014verify during `helm template`/dry-run.", + 'Kubernetes 1.29 dependency/go-version bump: if you run older Kubernetes versions + or have strict version-skew constraints, validate descheduler compatibility + against your managed provider/K8s version before upgrading.'] chart_version: 0.29.0 - images: - - registry.k8s.io/descheduler/descheduler:v0.29.0 + images: ['registry.k8s.io/descheduler/descheduler:v0.29.0'] - version: 0.28.1 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -19426,51 +16135,38 @@ addons: \ if you deploy descheduler as a CronJob and your cluster supports `spec.timeZone`).\n\ - **New optional `dnsConfig` support**: You can now provide `dnsConfig` via\ \ values to customize pod DNS settings (nameservers/searches/options)." - chart_updates: - - 'Helm chart: fixed CronJob args rendering to prevent unmarshal errors (PRs - #1229, #1231).' - - 'Helm chart: added CronJob `timeZone` value support (PR #1245).' - - 'Helm chart: added ability to set `dnsConfig` for the workload (PR #1260).' - features: - - 'TopologySpreadConstraints handling improved: respects `nodeTaintsPolicy` - and `nodeAffinityPolicy` and adds support for `matchLabelKeys`.' - - 'Improved logging/observability: structured eviction errors, corrected ownerKey - display, fixed JSON logging, and more readable node utilization percentages.' - - Better compatibility with managed Kubernetes providers via version-skew fixes. - - 'Security hardening: dependency bumps for CVE-2023-44487, CVE-2023-25151, - and CVE-2023-47108.' + chart_updates: ['Helm chart: fixed CronJob args rendering to prevent unmarshal + errors (PRs #1229, #1231).', 'Helm chart: added CronJob `timeZone` value + support (PR #1245).', 'Helm chart: added ability to set `dnsConfig` for + the workload (PR #1260).'] + features: ['TopologySpreadConstraints handling improved: respects `nodeTaintsPolicy` + and `nodeAffinityPolicy` and adds support for `matchLabelKeys`.', 'Improved + logging/observability: structured eviction errors, corrected ownerKey display, + fixed JSON logging, and more readable node utilization percentages.', Better + compatibility with managed Kubernetes providers via version-skew fixes., + 'Security hardening: dependency bumps for CVE-2023-44487, CVE-2023-25151, + and CVE-2023-47108.'] breaking_changes: [] chart_version: 0.28.1 - images: - - registry.k8s.io/descheduler/descheduler:v0.28.1 + images: ['registry.k8s.io/descheduler/descheduler:v0.28.1'] - version: 0.27.1 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'v0.26.1: Reverted Dockerfile ENTRYPOINT/CMD split (no user-facing chart values - change).' - - 'v0.26.1: Helm chart updated to v0.26.0 (aligns chart/app; review chart version - bump in your repo).' - - 'v0.27.1: Fixes plugin argument conversion when using multiple profiles with - the same plugin (behavioral bugfix; no values change noted).' - features: - - v0.27.1 improves stability when configuring multiple descheduler profiles - that reuse the same plugin by correctly converting plugin arguments. + chart_updates: ['v0.26.1: Reverted Dockerfile ENTRYPOINT/CMD split (no user-facing + chart values change).', 'v0.26.1: Helm chart updated to v0.26.0 (aligns + chart/app; review chart version bump in your repo).', 'v0.27.1: Fixes plugin + argument conversion when using multiple profiles with the same plugin (behavioral + bugfix; no values change noted).'] + features: [v0.27.1 improves stability when configuring multiple descheduler + profiles that reuse the same plugin by correctly converting plugin arguments.] breaking_changes: [] chart_version: 0.27.1 - images: - - registry.k8s.io/descheduler/descheduler:v0.27.1 + images: ['registry.k8s.io/descheduler/descheduler:v0.27.1'] - version: 0.26.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -19480,23 +16176,17 @@ addons: \ schema changes are called out in the provided notes; validate by diffing\ \ your current `values.yaml` against the new chart\u2019s `values.yaml` and\ \ running a `helm template`/`helm diff`.\n" - chart_updates: - - Helm chart version bump to **v0.26.0** (as referenced in the v0.26.1 release - notes). - features: - - Fixes default value assignment for the `EvictLocalStoragePods` option, making - behavior more consistent when the value is omitted. - breaking_changes: - - None explicitly mentioned in the provided v0.25.1 and v0.26.1 notes; still - validate against intermediate releases (v0.26.0) for any API/config deprecations. + chart_updates: [Helm chart version bump to **v0.26.0** (as referenced in the + v0.26.1 release notes).] + features: ['Fixes default value assignment for the `EvictLocalStoragePods` option, + making behavior more consistent when the value is omitted.'] + breaking_changes: [None explicitly mentioned in the provided v0.25.1 and v0.26.1 + notes; still validate against intermediate releases (v0.26.0) for any API/config + deprecations.] chart_version: 0.26.1 - images: - - registry.k8s.io/descheduler/descheduler:v0.26.1 + images: ['registry.k8s.io/descheduler/descheduler:v0.26.1'] - version: 0.25.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -19509,26 +16199,20 @@ addons: against the new chart defaults and documentation. ' - chart_updates: - - Helm chart bumped to **v1.25.0** (per v0.25.1 release notes). - - v0.24.1 included "helm chart fixes" and a fix to the version command to parse - helm chart tags (already in your starting version). - features: - - No new end-user features are called out in the provided notes; v0.25.1 appears - to be primarily a chart bump plus a backported fix (issue 960) and documentation - updates. - breaking_changes: - - "No explicit breaking changes are mentioned in the provided release notes.\ - \ The main risk is **Helm chart major-version jump (0.x \u2192 1.x)** which\ - \ can imply breaking changes in values/templating even if not called out." + chart_updates: [Helm chart bumped to **v1.25.0** (per v0.25.1 release notes)., + v0.24.1 included "helm chart fixes" and a fix to the version command to parse + helm chart tags (already in your starting version).] + features: [No new end-user features are called out in the provided notes; v0.25.1 + appears to be primarily a chart bump plus a backported fix (issue 960) and + documentation updates.] + breaking_changes: ["No explicit breaking changes are mentioned in the provided\ + \ release notes. The main risk is **Helm chart major-version jump (0.x \u2192\ + \ 1.x)** which can imply breaking changes in values/templating even if not\ + \ called out."] chart_version: 0.25.2 - images: - - k8s.gcr.io/descheduler/descheduler:v0.25.1 + images: ['k8s.gcr.io/descheduler/descheduler:v0.25.1'] - version: 0.24.1 - kube: - - '1.24' - - '1.23' - - '1.22' + kube: ['1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: @@ -19540,67 +16224,47 @@ addons: - **If you pin image tags manually:** update the Descheduler image tag from `v0.23.1` to `v0.24.1` (`k8s.gcr.io/descheduler/descheduler:v0.24.1`).' - chart_updates: - - 'Helm chart updated to v0.24 (PR #796).' - - 'Helm chart fixes in release-1.24 branch (PR #817).' - - 'Version command fixed to parse Helm chart tags correctly (PR #824).' + chart_updates: ['Helm chart updated to v0.24 (PR #796).', 'Helm chart fixes + in release-1.24 branch (PR #817).', 'Version command fixed to parse Helm + chart tags correctly (PR #824).'] features: [] breaking_changes: [] chart_version: 0.24.1 - images: - - alpine:latest - - k8s.gcr.io/descheduler/descheduler:v0.24.1 + images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.24.1'] - version: 0.23.1 - kube: - - '1.23' - - '1.22' - - '1.21' + kube: ['1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v0.23.1 includes a fix for a panic when running descheduler v0.23 as a Kubernetes - CronJob. - - v0.23.1 bumps the Go toolchain to 1.17.7 to address CVE-2021-44716. + features: [v0.23.1 includes a fix for a panic when running descheduler v0.23 + as a Kubernetes CronJob., v0.23.1 bumps the Go toolchain to 1.17.7 to address + CVE-2021-44716.] breaking_changes: [] chart_version: 0.23.2 - images: - - alpine:latest - - k8s.gcr.io/descheduler/descheduler:v0.23.1 + images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.23.1'] - version: 0.22.1 - kube: - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Patch upgrade from descheduler v0.21.0 to v0.22.1; ensure the deployed container - image tag is updated to `k8s.gcr.io/descheduler/descheduler:v0.22.1`. - - The v0.22.1 application release is a crash fix for the `RemoveFailedPods` - strategy; validate whether this strategy is enabled in your policy/config - and prioritize this upgrade if it is. - features: - - v0.22.1 is a patch release that fixes a crash in the new `RemoveFailedPods` - strategy. - - 'v0.21.0 introduced multiple operational and scheduling-related enhancements: - running as non-root (UID 1000), metrics collection, new/updated strategies - (e.g., HighNodeUtilization), and additional filtering knobs (labelSelector, - ignore pods with PVCs, soft topology spread constraints).' + kube: ['1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Patch upgrade from descheduler v0.21.0 to v0.22.1; ensure the + deployed container image tag is updated to `k8s.gcr.io/descheduler/descheduler:v0.22.1`.', + The v0.22.1 application release is a crash fix for the `RemoveFailedPods` + strategy; validate whether this strategy is enabled in your policy/config + and prioritize this upgrade if it is.] + features: [v0.22.1 is a patch release that fixes a crash in the new `RemoveFailedPods` + strategy., 'v0.21.0 introduced multiple operational and scheduling-related + enhancements: running as non-root (UID 1000), metrics collection, new/updated + strategies (e.g., HighNodeUtilization), and additional filtering knobs (labelSelector, + ignore pods with PVCs, soft topology spread constraints).'] breaking_changes: [] chart_version: 0.22.1 - images: - - alpine:latest - - k8s.gcr.io/descheduler/descheduler:v0.22.1 + images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.22.1'] - version: 0.21.0 - kube: - - '1.21' - - '1.20' - - '1.19' + kube: ['1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -19616,42 +16280,32 @@ addons: \ to specific nodes.\n- **Docs/values fixes**:\n - Fixed `values.yaml` indentation\ \ (#498).\n - Corrected chart docs for container requests/limits (#526).\n\ - **Helm chart testing**:\n - Added a **helm test** hook (#527).\n" - chart_updates: - - Workload manifests updated to run as non-root (UID 1000) and support `runAsNonRoot` - (aligns with upstream security changes). - - CronJob template enhanced with `nodeSelector` support. - - 'Chart hygiene updates: `values.yaml` indentation fix and documentation corrections - for resources.' - - Added Helm test hook for basic install validation. - features: - - Runs descheduler as non-root by default (UID 1000), improving security posture - and compatibility with restricted PodSecurity policies. - - Adds metrics collection support, enabling scraping/observability of descheduler - behavior. - - 'New/expanded eviction filtering: labelSelector-based filtering, option to - ignore pods with PVCs, and optional eviction of system-critical pods (configurable).' - - TopologySpreadConstraint strategy enhancements, including support for soft - constraints and labelSelector filtering during eviction. - - 'New/updated strategies and behavior: HighNodeUtilization strategy, improved - NodeFit feature, and LowNodeUtilization extended resource support.' - - Updated Kubernetes dependency compatibility to 1.21 and expanded multi-arch - images (adds ARM32v7). - breaking_changes: - - Descheduler now defaults to **running as non-root (UID 1000)**; clusters/environments - that assume root (custom securityContext, PSP, file permissions on mounted - volumes, or restrictive policies) may require adjustments. - - Kubernetes library/dependency bump to **1.21.0** may effectively drop compatibility - with older Kubernetes versions; validate your cluster version and API availability - before upgrading. + chart_updates: [Workload manifests updated to run as non-root (UID 1000) and + support `runAsNonRoot` (aligns with upstream security changes)., CronJob + template enhanced with `nodeSelector` support., 'Chart hygiene updates: + `values.yaml` indentation fix and documentation corrections for resources.', + Added Helm test hook for basic install validation.] + features: ['Runs descheduler as non-root by default (UID 1000), improving security + posture and compatibility with restricted PodSecurity policies.', 'Adds + metrics collection support, enabling scraping/observability of descheduler + behavior.', 'New/expanded eviction filtering: labelSelector-based filtering, + option to ignore pods with PVCs, and optional eviction of system-critical + pods (configurable).', 'TopologySpreadConstraint strategy enhancements, + including support for soft constraints and labelSelector filtering during + eviction.', 'New/updated strategies and behavior: HighNodeUtilization strategy, + improved NodeFit feature, and LowNodeUtilization extended resource support.', + Updated Kubernetes dependency compatibility to 1.21 and expanded multi-arch + images (adds ARM32v7).] + breaking_changes: ['Descheduler now defaults to **running as non-root (UID 1000)**; + clusters/environments that assume root (custom securityContext, PSP, file + permissions on mounted volumes, or restrictive policies) may require adjustments.', + Kubernetes library/dependency bump to **1.21.0** may effectively drop compatibility + with older Kubernetes versions; validate your cluster version and API availability + before upgrading.] chart_version: 0.21.0 - images: - - alpine:latest - - k8s.gcr.io/descheduler/descheduler:v0.21.0 + images: ['alpine:latest', 'k8s.gcr.io/descheduler/descheduler:v0.21.0'] - version: 0.20.0 - kube: - - '1.20' - - '1.19' - - '1.18' + kube: ['1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: @@ -19668,41 +16322,30 @@ addons: \ move those settings into values.\n- **TopologySpreadConstraint strategy\ \ namespaces** can be configured via Helm (PR #455) \u2014 check your values\ \ if you use that strategy.\n" - chart_updates: - - "Chart renamed (PR #436) \u2014 update chart reference in Helm/GitOps." - - 'Add PodSecurityPolicy support to the chart templates (PR #418).' - - 'Expose CronJob scheduling/history settings in values: startingDeadlineSeconds, - successfulJobsHistoryLimit, failedJobsHistoryLimit (PRs #444, #453).' - - 'Add container resource configuration in chart (PR #443).' - - 'Helm support for listing namespaces for topologySpreadConstraint strategy - (PR #455).' - features: - - New **PodTopologySpread** strategy to rebalance pods across topology domains - (#413). - - RemoveDuplicates and TopologySpread-related strategies gain **namespace filtering** - (#406) and improved namespace handling (#455). - - PodLifeTime strategy can now customize which **podStatusPhases** count (#393). - - 'New logging-format flag and broader structured logging improvements (#412, - #376/#394).' - - 'Helm/chart improvements: PSP support, CronJob timing and history limits, - configurable resources (#418, #444, #453, #443).' - - 'Descheduler updated for Kubernetes 1.20 dependencies and multi-arch images - (#464, #449).' - breaking_changes: - - Helm **chart rename** may break automated upgrades or GitOps references until - you update the chart name/repo/path (#436). - - "If you relied on old CLI flags previously deprecated in 0.19.0 (node-selector,\ - \ max-pods-to-evict-per-node, evict-local-storage-pods), 0.20.0 continues\ - \ the move toward policy fields; validate your deployment isn\u2019t still\ - \ depending on removed/ignored flags." + chart_updates: ["Chart renamed (PR #436) \u2014 update chart reference in Helm/GitOps.", + 'Add PodSecurityPolicy support to the chart templates (PR #418).', 'Expose + CronJob scheduling/history settings in values: startingDeadlineSeconds, + successfulJobsHistoryLimit, failedJobsHistoryLimit (PRs #444, #453).', 'Add + container resource configuration in chart (PR #443).', 'Helm support for + listing namespaces for topologySpreadConstraint strategy (PR #455).'] + features: [New **PodTopologySpread** strategy to rebalance pods across topology + domains (#413)., RemoveDuplicates and TopologySpread-related strategies + gain **namespace filtering** (#406) and improved namespace handling (#455)., + PodLifeTime strategy can now customize which **podStatusPhases** count (#393)., + 'New logging-format flag and broader structured logging improvements (#412, + #376/#394).', 'Helm/chart improvements: PSP support, CronJob timing and + history limits, configurable resources (#418, #444, #453, #443).', 'Descheduler + updated for Kubernetes 1.20 dependencies and multi-arch images (#464, #449).'] + breaking_changes: [Helm **chart rename** may break automated upgrades or GitOps + references until you update the chart name/repo/path (#436)., "If you relied\ + \ on old CLI flags previously deprecated in 0.19.0 (node-selector, max-pods-to-evict-per-node,\ + \ evict-local-storage-pods), 0.20.0 continues the move toward policy fields;\ + \ validate your deployment isn\u2019t still depending on removed/ignored\ + \ flags."] chart_version: 0.20.0 - images: - - k8s.gcr.io/descheduler/descheduler:v0.20.0 + images: ['k8s.gcr.io/descheduler/descheduler:v0.20.0'] - version: 0.19.0 - kube: - - '1.19' - - '1.18' - - '1.17' + kube: ['1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: @@ -19720,172 +16363,98 @@ addons: rather than extraArgs/command flags. ' - chart_updates: - - Helm chart is now a first-class release artifact (added around this cycle) - and v0.19.0 has a dedicated chart release tag `descheduler-helm-chart-0.19.0`. - - 'Chart maintainer metadata updated (#375) and Helm release process/documentation - improved (#351, #356, #359).' - features: - - Namespace-based pod filtering support was added (you can scope strategies - to specific namespaces). - - Custom priority threshold support was added for priority-based decisions/evictions. - - Kubernetes dependencies were bumped for Kubernetes 1.19 compatibility and - the project moved to Go 1.15. - breaking_changes: - - Image registry/repository location changed to `k8s.gcr.io/descheduler/descheduler`; - environments with allowlists/mirrors must be updated. - - Several command-line flags were deprecated (`node-selector`, `max-pods-to-evict-per-node`, - `evict-local-storage-pods`) in favor of policy `v1alpha1` fields; upgrades - relying on those flags should migrate to policy-based configuration to avoid - future removal. + chart_updates: [Helm chart is now a first-class release artifact (added around + this cycle) and v0.19.0 has a dedicated chart release tag `descheduler-helm-chart-0.19.0`., + 'Chart maintainer metadata updated (#375) and Helm release process/documentation + improved (#351, #356, #359).'] + features: [Namespace-based pod filtering support was added (you can scope strategies + to specific namespaces)., Custom priority threshold support was added for + priority-based decisions/evictions., Kubernetes dependencies were bumped + for Kubernetes 1.19 compatibility and the project moved to Go 1.15.] + breaking_changes: [Image registry/repository location changed to `k8s.gcr.io/descheduler/descheduler`; + environments with allowlists/mirrors must be updated., 'Several command-line + flags were deprecated (`node-selector`, `max-pods-to-evict-per-node`, `evict-local-storage-pods`) + in favor of policy `v1alpha1` fields; upgrades relying on those flags should + migrate to policy-based configuration to avoid future removal.'] chart_version: 0.19.2 - images: - - k8s.gcr.io/descheduler/descheduler:v0.19.0 + images: ['k8s.gcr.io/descheduler/descheduler:v0.19.0'] - version: 0.18.0 - kube: - - '1.18' - - '1.17' - - '1.16' + kube: ['1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null chart_version: 0.18.2 - images: - - us.gcr.io/k8s-artifacts-prod/descheduler/descheduler:v0.18.0 - name: descheduler + images: ['us.gcr.io/k8s-artifacts-prod/descheduler/descheduler:v0.18.0'] - icon: https://github.com/kubernetes-sigs/external-dns/blob/master/docs/img/external-dns.png?raw=true git_url: https://github.com/kubernetes-sigs/external-dns release_url: https://github.com/kubernetes-sigs/external-dns/releases/tag/v{vsn} helm_repository_url: https://kubernetes-sigs.github.io/external-dns versions: - version: 0.21.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Charts: Fix ptsc indentation (#6054).' - - 'Charts: Add schema for provider.webhook.serviceMonitor (#5932).' - - 'Charts: Skip cluster-scope RBAC when running namespaced (#5843).' - features: - - 'New Kubernetes client rate-limiting flags: `--kube-api-qps` and `--kube-api-burst` - to control API load.' - - Events can be emitted for managed resources (Ingress/Service/Pod/Node/CRD) - with standardized messages, improving debuggability. - - 'Expanded DNS record support: NAPTR (AWS/Route53 + TXT registry), SRV/NAPTR - in TXT registry, MX trailing-dot handling, and generalized PTR support across - providers.' - - Cloudflare can batch DNS record changes, reducing API calls; Azure supports - DNS record metadata/tags. - - Memory/performance improvements via informer object transformers and reduced - cache footprint; new metric for ownership conflicts (`skipped_records_owner_mismatch_per_sync`). - breaking_changes: - - DigitalOcean in-tree provider removed; deployments using the built-in DigitalOcean - provider must switch to an alternative (e.g., webhook provider) or stay pinned. - - CloudFoundry source support removed; any setups relying on CloudFoundry resources - must migrate away. - - Gateway API sources migrated to `gateway.networking.k8s.io/v1` (Gateway/HTTPRoute); - clusters still using beta APIs must upgrade CRDs/resources. - - Istio sources migrated to `networking.istio.io/v1` for Gateway/VirtualService; - older Istio API versions will no longer be watched. - - "PTR record support generalized beyond rfc2136; expect behavior/flags/annotations\ - \ around PTR to change\u2014test provider compatibility." - - Pi-hole v5 API support deprecated; plan to move to v6 API. - - Service source now ignores unschedulable nodes; if you previously relied on - DNS records from unschedulable nodes, behavior will change. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Charts: Fix ptsc indentation (#6054).', 'Charts: Add schema + for provider.webhook.serviceMonitor (#5932).', 'Charts: Skip cluster-scope + RBAC when running namespaced (#5843).'] + features: ['New Kubernetes client rate-limiting flags: `--kube-api-qps` and + `--kube-api-burst` to control API load.', 'Events can be emitted for managed + resources (Ingress/Service/Pod/Node/CRD) with standardized messages, improving + debuggability.', 'Expanded DNS record support: NAPTR (AWS/Route53 + TXT + registry), SRV/NAPTR in TXT registry, MX trailing-dot handling, and generalized + PTR support across providers.', 'Cloudflare can batch DNS record changes, + reducing API calls; Azure supports DNS record metadata/tags.', Memory/performance + improvements via informer object transformers and reduced cache footprint; + new metric for ownership conflicts (`skipped_records_owner_mismatch_per_sync`).] + breaking_changes: ['DigitalOcean in-tree provider removed; deployments using + the built-in DigitalOcean provider must switch to an alternative (e.g., + webhook provider) or stay pinned.', CloudFoundry source support removed; + any setups relying on CloudFoundry resources must migrate away., Gateway + API sources migrated to `gateway.networking.k8s.io/v1` (Gateway/HTTPRoute); + clusters still using beta APIs must upgrade CRDs/resources., Istio sources + migrated to `networking.istio.io/v1` for Gateway/VirtualService; older Istio + API versions will no longer be watched., "PTR record support generalized\ + \ beyond rfc2136; expect behavior/flags/annotations around PTR to change\u2014\ + test provider compatibility.", Pi-hole v5 API support deprecated; plan to + move to v6 API., 'Service source now ignores unschedulable nodes; if you + previously relied on DNS records from unschedulable nodes, behavior will + change.'] chart_version: 1.21.1 - images: - - registry.k8s.io/external-dns/external-dns:v0.21.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.21.0'] - version: 0.20.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - CLI parsing/flag handling was migrated from kingpin to cobra (dual-parity), - which can subtly affect how flags are parsed/aliased in manifests and Helm - values -> args; review your configured args carefully. - - Chart release aligns with app v0.20.0 image tag; no explicit Helm values deprecations - were called out in the provided notes, but validate against your current values.yaml - due to the CLI migration. - - If you rely on the `--min-ttl` flag, be aware it was unintentionally removed - in v0.20.0 and is expected to be restored in the next release. - features: - - New flags to support OwnerID migration, making it easier to move between ownership - identifiers without recreating all records. - - Custom annotation prefix support for split-horizon DNS, enabling multiple - DNS views using different annotation namespaces. - - Cloudflare provider now supports tags for records (where supported), improving - record organization and filtering. - - CoreDNS provider gained new annotations for groups and improved etcd client - usage with context support. - - 'Additional provider/source enhancements: AWS adds ap-southeast-6 region; - F5 Virtual Server source adds host aliases support.' - breaking_changes: - - '`--min-ttl` was unintentionally removed in v0.20.0; any deployment depending - on it will fail to start or will ignore the setting until the flag is restored - in a later version.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['CLI parsing/flag handling was migrated from kingpin to cobra + (dual-parity), which can subtly affect how flags are parsed/aliased in manifests + and Helm values -> args; review your configured args carefully.', 'Chart + release aligns with app v0.20.0 image tag; no explicit Helm values deprecations + were called out in the provided notes, but validate against your current + values.yaml due to the CLI migration.', 'If you rely on the `--min-ttl` + flag, be aware it was unintentionally removed in v0.20.0 and is expected + to be restored in the next release.'] + features: ['New flags to support OwnerID migration, making it easier to move + between ownership identifiers without recreating all records.', 'Custom + annotation prefix support for split-horizon DNS, enabling multiple DNS views + using different annotation namespaces.', 'Cloudflare provider now supports + tags for records (where supported), improving record organization and filtering.', + CoreDNS provider gained new annotations for groups and improved etcd client + usage with context support., 'Additional provider/source enhancements: AWS + adds ap-southeast-6 region; F5 Virtual Server source adds host aliases support.'] + breaking_changes: ['`--min-ttl` was unintentionally removed in v0.20.0; any + deployment depending on it will fail to start or will ignore the setting + until the flag is restored in a later version.'] chart_version: 1.20.0 - images: - - registry.k8s.io/external-dns/external-dns:v0.20.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.20.0'] - version: 0.19.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -19904,51 +16473,27 @@ addons: \ RBAC after upgrade.\n- **Schema update**: Helm values schema updated to\ \ accept **`policy: create-only`** as a valid type (useful if you want to\ \ prevent deletions).\n" - chart_updates: - - 'Adds a dedicated Helm value to configure `annotationFilter` (PR #5737).' - - 'Fixes `.extraContainers` values schema/type to be an array (PR #5564).' - - 'RBAC fixes for namespaced Gateway sources (PR #5578).' - - 'Makes EndpointSlice RBAC permissions conditional (PR #5746).' - - 'Helm values schema updated to allow `policy: create-only` (PR #5627).' - features: - - '~10x lower average memory usage for pod/node sources by using informer transformers - (PR #5596).' - - 'Adds `build_info` Prometheus metric for easier version/build visibility (PR - #5643).' - - 'Adds AWS Route53 support for ap-east-2 and geoproximity routing policies - (PRs #5638, #5347).' - - 'Adds pod source support for annotation and label filters (PR #5583).' - - 'Chart: easier configuration of `annotationFilter` via a dedicated Helm value - (PR #5737).' - breaking_changes: - - 'Nodes source now exposes external IPv6 by default, which can change which - AAAA records are published unless you override with flags (PR #5575).' - - 'Traefik legacy listeners on the `traefik.containo.us` API group are disabled, - so older Traefik CRDs/listeners may stop being watched unless you switch to - the supported API group/config (PR #5565).' + chart_updates: ['Adds a dedicated Helm value to configure `annotationFilter` + (PR #5737).', 'Fixes `.extraContainers` values schema/type to be an array + (PR #5564).', 'RBAC fixes for namespaced Gateway sources (PR #5578).', 'Makes + EndpointSlice RBAC permissions conditional (PR #5746).', 'Helm values schema + updated to allow `policy: create-only` (PR #5627).'] + features: ['~10x lower average memory usage for pod/node sources by using informer + transformers (PR #5596).', 'Adds `build_info` Prometheus metric for easier + version/build visibility (PR #5643).', 'Adds AWS Route53 support for ap-east-2 + and geoproximity routing policies (PRs #5638, #5347).', 'Adds pod source + support for annotation and label filters (PR #5583).', 'Chart: easier configuration + of `annotationFilter` via a dedicated Helm value (PR #5737).'] + breaking_changes: ['Nodes source now exposes external IPv6 by default, which + can change which AAAA records are published unless you override with flags + (PR #5575).', 'Traefik legacy listeners on the `traefik.containo.us` API + group are disabled, so older Traefik CRDs/listeners may stop being watched + unless you switch to the supported API group/config (PR #5565).'] chart_version: 1.19.0 - images: - - registry.k8s.io/external-dns/external-dns:v0.19.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.19.0'] - version: 0.18.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -19969,56 +16514,31 @@ addons: \ in-tree `ibmcloud`, `tencentcloud`, or `ultradns`, you must pin older versions\ \ or migrate to a webhook provider. This may require chart values updates\ \ to the `provider` setting and any provider-specific config.\n" - chart_updates: - - RBAC updates are required for EndpointSlices; note that the v0.18.0 app release - says this is included in the *next* Helm chart release (so upgrading the app - image without upgrading the chart/RBAC can break Service source). - - Helm chart release workflow/process fixes mentioned upstream (not functional - changes, but suggests chart version selection matters). - features: - - 'Cloudflare: support for MX records and DNS record comments; improved regional - hostnames behavior.' - - Service source now uses EndpointSlices (more scalable than Endpoints). - - FQDN templating improvements (ExecTemplate functions; pod/node/service-related - enhancements). - - New/updated metrics including `consecutiveSoftErrors` and metrics for all - supported endpoint types. - - Optional `--force-default-targets` mitigation flag to control default-target - behavior. - breaking_changes: - - 'RBAC: Service source now uses EndpointSlices; without EndpointSlice permissions, - ExternalDNS may fail to read service endpoints.' - - Metrics output was significantly reworked; existing dashboards/alerts scraping - specific series/labels will likely break. - - Removed `--txt-new-format-only` flag and deprecated legacy TXT registry format; - only the new TXT format is supported now. - - 'Removed in-tree providers: ibmcloud, tencentcloud, and ultradns; must migrate - (webhook) or stay on an older version.' - - Default-targets behavior changed; may affect record targets unless you opt - into the mitigation flag (`--force-default-targets`). + chart_updates: [RBAC updates are required for EndpointSlices; note that the + v0.18.0 app release says this is included in the *next* Helm chart release + (so upgrading the app image without upgrading the chart/RBAC can break Service + source)., 'Helm chart release workflow/process fixes mentioned upstream + (not functional changes, but suggests chart version selection matters).'] + features: ['Cloudflare: support for MX records and DNS record comments; improved + regional hostnames behavior.', Service source now uses EndpointSlices (more + scalable than Endpoints)., FQDN templating improvements (ExecTemplate functions; + pod/node/service-related enhancements)., New/updated metrics including `consecutiveSoftErrors` + and metrics for all supported endpoint types., Optional `--force-default-targets` + mitigation flag to control default-target behavior.] + breaking_changes: ['RBAC: Service source now uses EndpointSlices; without EndpointSlice + permissions, ExternalDNS may fail to read service endpoints.', Metrics output + was significantly reworked; existing dashboards/alerts scraping specific + series/labels will likely break., Removed `--txt-new-format-only` flag and + deprecated legacy TXT registry format; only the new TXT format is supported + now., 'Removed in-tree providers: ibmcloud, tencentcloud, and ultradns; + must migrate (webhook) or stay on an older version.', Default-targets behavior + changed; may affect record targets unless you opt into the mitigation flag + (`--force-default-targets`).] chart_version: 1.18.0 - images: - - registry.k8s.io/external-dns/external-dns:v0.18.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.18.0'] - version: 0.17.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -20034,110 +16554,62 @@ addons: - No other explicit required values changes were called out in these notes; the main operator-facing changes are provider/flag related (see breaking/risks).' - chart_updates: - - Helm chart schema and validation improvements (added missing schema values; - updated schema). - - Chart supports `extraArgs` as a map in addition to a list, enabling per-arg - overrides. - - 'Minor chart typing fix: add missing types for empty values.' - features: - - 'Helm chart: `extraArgs` can now be a map as well as a list to make overriding - individual arguments easier.' - - 'Cloudflare: support multiple custom hostnames (plus fixes for duplicates/regional - hostnames edge cases).' - - 'Pi-hole: added optional v6 support and IPv6 dual format support.' - - 'Node source: can optionally exclude unschedulable nodes.' - - 'Node source: optional exposure/handling of internal IPv6 addresses (`expose-internal-ipv6`) - per IPv6 proposal 002.' - - Zone finder is IDNA-aware; also improved handling of underscores in DNS records. - - OVH provider was heavily rewritten (functional and behavioral improvements). - breaking_changes: - - 'OpenStack Designate **in-tree provider removed** (`chore(openstack designate)!` - #5126). If you used `--provider=designate`, you must move to the OpenStack - webhook provider before upgrading.' - - 'OVH provider rewrite may require **new/updated ACLs/credentials/permissions**; - treat as a potentially breaking behavioral change and follow the provider - docs/PR #5143.' - - 'Known issue: Active Directory provider has a **severe regression since v0.16.0** - (#5240) and is not fixed in v0.17.0 per notes; avoid upgrading or plan mitigation - if you rely on AD.' - - 'Deprecation heads-up: Pi-hole v5 is deprecated (v6 support added) and will - be removed in a future release.' - - 'Deprecation heads-up: legacy TXT registry format is planned to be removed - in the next minor version; no migration script is provided, so plan record - cleanup/migration now.' + chart_updates: [Helm chart schema and validation improvements (added missing + schema values; updated schema)., 'Chart supports `extraArgs` as a map in + addition to a list, enabling per-arg overrides.', 'Minor chart typing fix: + add missing types for empty values.'] + features: ['Helm chart: `extraArgs` can now be a map as well as a list to make + overriding individual arguments easier.', 'Cloudflare: support multiple + custom hostnames (plus fixes for duplicates/regional hostnames edge cases).', + 'Pi-hole: added optional v6 support and IPv6 dual format support.', 'Node + source: can optionally exclude unschedulable nodes.', 'Node source: optional + exposure/handling of internal IPv6 addresses (`expose-internal-ipv6`) per + IPv6 proposal 002.', Zone finder is IDNA-aware; also improved handling of + underscores in DNS records., OVH provider was heavily rewritten (functional + and behavioral improvements).] + breaking_changes: ['OpenStack Designate **in-tree provider removed** (`chore(openstack + designate)!` #5126). If you used `--provider=designate`, you must move to + the OpenStack webhook provider before upgrading.', 'OVH provider rewrite + may require **new/updated ACLs/credentials/permissions**; treat as a potentially + breaking behavioral change and follow the provider docs/PR #5143.', 'Known + issue: Active Directory provider has a **severe regression since v0.16.0** + (#5240) and is not fixed in v0.17.0 per notes; avoid upgrading or plan mitigation + if you rely on AD.', 'Deprecation heads-up: Pi-hole v5 is deprecated (v6 + support added) and will be removed in a future release.', 'Deprecation heads-up: + legacy TXT registry format is planned to be removed in the next minor version; + no migration script is provided, so plan record cleanup/migration now.'] chart_version: 1.17.0 - images: - - registry.k8s.io/external-dns/external-dns:v0.17.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.17.0'] - version: 0.16.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Webhook provider improvements (webhook-* annotations forwarded to webhooks) - and additional webhook provider options documented (e.g., Infoblox, Unifi). - - CoreDNS provider gains etcd authentication support (and related HTTPS doc - updates). - - AWS provider can use local AWS credential profiles from a .credentials file. - - RFC2136 provider adds optional PTR record support. - - 'Gateway API support evolves: GRPCRoute client updated to stable v1 and Gateway - API gains dual-stack support, plus a follow-up revert to v1beta1 objects in - v0.15.0 notes.' - breaking_changes: - - v0.15.0 drops several unmaintained in-tree providers; users must stay on older - versions or migrate to webhook providers for those DNS providers. - - Infoblox in-tree provider is removed (use the Infoblox webhook provider instead). - - Cloudflare had a breaking change in v0.16.0 that is fixed in v0.16.1; still - treat Cloudflare upgrades cautiously. - - TXT registry now has an option to use only the new TXT format; the old format - is planned for removal in the next release, so plan a migration if you rely - on legacy TXT ownership records. - - OpenStack Designate in-tree provider is slated for removal next version; migrate - to the external webhook provider. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Webhook provider improvements (webhook-* annotations forwarded to + webhooks) and additional webhook provider options documented (e.g., Infoblox, + Unifi).', CoreDNS provider gains etcd authentication support (and related + HTTPS doc updates)., AWS provider can use local AWS credential profiles + from a .credentials file., RFC2136 provider adds optional PTR record support., + 'Gateway API support evolves: GRPCRoute client updated to stable v1 and Gateway + API gains dual-stack support, plus a follow-up revert to v1beta1 objects + in v0.15.0 notes.'] + breaking_changes: [v0.15.0 drops several unmaintained in-tree providers; users + must stay on older versions or migrate to webhook providers for those DNS + providers., Infoblox in-tree provider is removed (use the Infoblox webhook + provider instead)., Cloudflare had a breaking change in v0.16.0 that is + fixed in v0.16.1; still treat Cloudflare upgrades cautiously., 'TXT registry + now has an option to use only the new TXT format; the old format is planned + for removal in the next release, so plan a migration if you rely on legacy + TXT ownership records.', OpenStack Designate in-tree provider is slated + for removal next version; migrate to the external webhook provider.] chart_version: 1.16.1 - images: - - registry.k8s.io/external-dns/external-dns:v0.16.1 + images: ['registry.k8s.io/external-dns/external-dns:v0.16.1'] - version: 0.15.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -20149,112 +16621,65 @@ addons: \n> Practical action: run `helm diff upgrade` and pay extra attention to the\ \ webhook Deployment/Service/SA resources and any values under webhook-related\ \ keys you use.\n" - chart_updates: - - 'Helm chart webhook integration fixes: webhook workload now uses the configured - resource values; additional chart fixes for webhook provider support (verify - rendered manifests).' - features: - - Provider cache added to reduce repeated provider lookups and improve performance/efficiency. - - 'CoreDNS provider: added etcd authentication support (and accompanying docs - for etcd HTTPS).' - - 'AWS provider: can use AWS profiles via a `.credentials` file (useful when - not relying on IRSA/ambient credentials).' - - 'RFC2136 provider: optional PTR record support.' - - 'Webhook provider improvements: passes `webhook-*` annotations through to - webhook providers; webhook flags are no longer marked experimental.' - - 'Gateway API: dual-stack support added.' - - 'Ambassador Host source: supports annotation/label filters.' - breaking_changes: - - Unmaintained providers were removed in v0.15.0; if you rely on one of the - dropped in-tree providers, you must stay on an older ExternalDNS version or - migrate to a webhook provider implementation. - - Infoblox **in-tree** provider was removed; use the new **Infoblox webhook - provider** instead. - - GRPCRoute client updated from `v1alpha2` to stable `v1`; if you use GRPCRoute-related - features, validate your Gateway API CRDs/versions and manifests accordingly. + chart_updates: ['Helm chart webhook integration fixes: webhook workload now + uses the configured resource values; additional chart fixes for webhook + provider support (verify rendered manifests).'] + features: [Provider cache added to reduce repeated provider lookups and improve + performance/efficiency., 'CoreDNS provider: added etcd authentication support + (and accompanying docs for etcd HTTPS).', 'AWS provider: can use AWS profiles + via a `.credentials` file (useful when not relying on IRSA/ambient credentials).', + 'RFC2136 provider: optional PTR record support.', 'Webhook provider improvements: + passes `webhook-*` annotations through to webhook providers; webhook flags + are no longer marked experimental.', 'Gateway API: dual-stack support added.', + 'Ambassador Host source: supports annotation/label filters.'] + breaking_changes: ['Unmaintained providers were removed in v0.15.0; if you rely + on one of the dropped in-tree providers, you must stay on an older ExternalDNS + version or migrate to a webhook provider implementation.', Infoblox **in-tree** + provider was removed; use the new **Infoblox webhook provider** instead., + 'GRPCRoute client updated from `v1alpha2` to stable `v1`; if you use GRPCRoute-related + features, validate your Gateway API CRDs/versions and manifests accordingly.'] chart_version: 1.15.0 - images: - - registry.k8s.io/external-dns/external-dns:v0.15.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.15.0'] - version: 0.14.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Helm chart release referenced as \u201CReleased chart for v0.13.6\u201D (PR\ - \ #3917). No explicit values schema changes were included in the provided\ - \ notes, so assume chart defaults may have shifted with image/tag bump; verify\ - \ with `helm diff` and the chart\u2019s `values.yaml` between your chart versions." - - Container image continues to be published as `registry.k8s.io/external-dns/external-dns:`; - v0.13.1 and v0.14.0 both use registry.k8s.io (align your image repository - overrides if you still use k8s.gcr.io). - - "(From the v0.13.1 notes you included) the Helm chart added support for configuring\ - \ `dnsPolicy` for the Deployment and changed Deployment update strategy to\ - \ `Recreate` to avoid multiple external-dns pods conflicting\u2014ensure this\ - \ matches your availability expectations during upgrades." - features: - - Webhook provider is officially supported in v0.14.0, enabling out-of-tree - provider implementations and a mode to run external-dns as a webhook server - (`--webhook-server`). - - 'New CLI flags: `--exclude-record-types` to prevent managing specific DNS - record types, and `--label-filter` support for the node source.' - - 'Provider/source enhancements: Azure AAAA (IPv6) record support; Linode NS - record support; target-annotation support expanded across more sources; Gateway/Gateway - API improvements including annotation target override on Gateway.' - - 'Operational/observability: new metric `external_dns_controller_last_reconcile_timestamp_seconds` - for tracking last reconcile time.' - breaking_changes: - - '`--run-aws-provider-as-webhook` flag was removed in v0.14.0; if you used - it, migrate to the new webhook provider model and/or `--webhook-server` as - appropriate.' - - 'Build/runtime environment change: external-dns is now built with Go 1.21; - if you depend on custom builds/plugins or strict base-image compliance scanning, - re-validate.' - - 'Behavioral changes worth validating: AWS Alias records are represented as - record type A; ClusterIP services with `internal-hostname` annotation now - use ServiceIP; these may affect record outputs in some setups.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Helm chart release referenced as \u201CReleased chart for v0.13.6\u201D\ + \ (PR #3917). No explicit values schema changes were included in the provided\ + \ notes, so assume chart defaults may have shifted with image/tag bump;\ + \ verify with `helm diff` and the chart\u2019s `values.yaml` between your\ + \ chart versions.", 'Container image continues to be published as `registry.k8s.io/external-dns/external-dns:`; + v0.13.1 and v0.14.0 both use registry.k8s.io (align your image repository + overrides if you still use k8s.gcr.io).', "(From the v0.13.1 notes you included)\ + \ the Helm chart added support for configuring `dnsPolicy` for the Deployment\ + \ and changed Deployment update strategy to `Recreate` to avoid multiple\ + \ external-dns pods conflicting\u2014ensure this matches your availability\ + \ expectations during upgrades."] + features: ['Webhook provider is officially supported in v0.14.0, enabling out-of-tree + provider implementations and a mode to run external-dns as a webhook server + (`--webhook-server`).', 'New CLI flags: `--exclude-record-types` to prevent + managing specific DNS record types, and `--label-filter` support for the + node source.', 'Provider/source enhancements: Azure AAAA (IPv6) record support; + Linode NS record support; target-annotation support expanded across more + sources; Gateway/Gateway API improvements including annotation target override + on Gateway.', 'Operational/observability: new metric `external_dns_controller_last_reconcile_timestamp_seconds` + for tracking last reconcile time.'] + breaking_changes: ['`--run-aws-provider-as-webhook` flag was removed in v0.14.0; + if you used it, migrate to the new webhook provider model and/or `--webhook-server` + as appropriate.', 'Build/runtime environment change: external-dns is now + built with Go 1.21; if you depend on custom builds/plugins or strict base-image + compliance scanning, re-validate.', 'Behavioral changes worth validating: + AWS Alias records are represented as record type A; ClusterIP services with + `internal-hostname` annotation now use ServiceIP; these may affect record + outputs in some setups.'] chart_version: 1.14.3 - images: - - registry.k8s.io/external-dns/external-dns:v0.14.0 + images: ['registry.k8s.io/external-dns/external-dns:v0.14.0'] - version: 0.13.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -20271,49 +16696,25 @@ addons: \ be aware of the known bug where deletions could incorrectly trigger TXT\ \ record deletions; ensure you are not running an affected build before/while\ \ upgrading or validate TXT ownership records after the upgrade." - chart_updates: - - Helm chart supports configuring `dnsPolicy` on the Deployment. - - Deployment update strategy set to `Recreate` to prevent multiple pods conflicting - during upgrades. - - Chart/manifests updated to newer ExternalDNS image versions and to use `registry.k8s.io` - image registry in deployment YAML. - features: - - Target filtering can be based on network, improving control over which endpoints - are considered. - - AWS provider supports ExternalID when assuming a role, improving compatibility - with stricter IAM setups. - - 'New DNS providers added: Tencent Cloud and Plural DNS.' - - Gateway API dependency upgraded (v0.5.0), improving Gateway API route source - support compatibility. - breaking_changes: - - Deployment strategy change to `Recreate` alters rollout behavior; expect brief - downtime during upgrades and ensure only one replica is used to avoid provider - conflicts. - - Image registry change to `registry.k8s.io` may break clusters with strict - image allowlists or mirroring configurations unless updated. + chart_updates: [Helm chart supports configuring `dnsPolicy` on the Deployment., + Deployment update strategy set to `Recreate` to prevent multiple pods conflicting + during upgrades., Chart/manifests updated to newer ExternalDNS image versions + and to use `registry.k8s.io` image registry in deployment YAML.] + features: ['Target filtering can be based on network, improving control over + which endpoints are considered.', 'AWS provider supports ExternalID when + assuming a role, improving compatibility with stricter IAM setups.', 'New + DNS providers added: Tencent Cloud and Plural DNS.', 'Gateway API dependency + upgraded (v0.5.0), improving Gateway API route source support compatibility.'] + breaking_changes: [Deployment strategy change to `Recreate` alters rollout behavior; + expect brief downtime during upgrades and ensure only one replica is used + to avoid provider conflicts., Image registry change to `registry.k8s.io` + may break clusters with strict image allowlists or mirroring configurations + unless updated.] chart_version: 1.12.0 - images: - - k8s.gcr.io/external-dns/external-dns:v0.13.1 + images: ['k8s.gcr.io/external-dns/external-dns:v0.13.1'] - version: 0.12.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -20324,52 +16725,29 @@ addons: \ you can ignore it; if you do, set it explicitly.\n- No other Helm values\ \ changes are clearly called out in the provided notes (the rest are docs/CI\ \ fixes or app/provider changes)." - chart_updates: - - Helm chart published/released as **v1.8.0**. - - Deployment template now supports setting `shareProcessNamespace`. - - Minor chart/documentation fixes (e.g., installation command line correction). - features: - - New **Gateway API route sources** support (can generate DNS records from Gateway - API routes). - - New **IBM Cloud DNS provider**. - - New **registry record type** support (enhances record ownership/registry behavior). - - 'Headless Service enhancements: can set target to `NodeExternalIP` or via - annotation.' - - 'RFC2136 security improvement: Kerberos password is no longer exposed in logs.' - - OpenShift Route source improved by using Route status more effectively. - - 'Istio improvements: reuse existing VirtualService informer and add debug - logging when endpoints are missing.' - breaking_changes: - - '**Known critical bug in v0.12.0:** deletions of Kubernetes resources may - incorrectly trigger deletion of TXT records (affects deletions, not additions) - when upgrading from earlier versions. Mitigate by postponing upgrade, being - ready to manually recreate records, or downgrading; fix tracked in PR #2811.' - - "Potential behavior changes for specific providers due to dependency/client\ - \ migrations (e.g., Infoblox client v2) \u2014 validate in staging if you\ - \ use these providers." + chart_updates: [Helm chart published/released as **v1.8.0**., Deployment template + now supports setting `shareProcessNamespace`., 'Minor chart/documentation + fixes (e.g., installation command line correction).'] + features: [New **Gateway API route sources** support (can generate DNS records + from Gateway API routes)., New **IBM Cloud DNS provider**., New **registry + record type** support (enhances record ownership/registry behavior)., 'Headless + Service enhancements: can set target to `NodeExternalIP` or via annotation.', + 'RFC2136 security improvement: Kerberos password is no longer exposed in logs.', + OpenShift Route source improved by using Route status more effectively., 'Istio + improvements: reuse existing VirtualService informer and add debug logging + when endpoints are missing.'] + breaking_changes: ['**Known critical bug in v0.12.0:** deletions of Kubernetes + resources may incorrectly trigger deletion of TXT records (affects deletions, + not additions) when upgrading from earlier versions. Mitigate by postponing + upgrade, being ready to manually recreate records, or downgrading; fix tracked + in PR #2811.', "Potential behavior changes for specific providers due to\ + \ dependency/client migrations (e.g., Infoblox client v2) \u2014 validate\ + \ in staging if you use these providers."] chart_version: 1.10.1 - images: - - k8s.gcr.io/external-dns/external-dns:v0.12.0 + images: ['k8s.gcr.io/external-dns/external-dns:v0.12.0'] - version: 0.11.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -20389,137 +16767,89 @@ addons: \ documented/accepted values.\n\n> Note: The app release notes include a \u201C\ feat(chart): Update chart to use v0.10.2\u201D entry; ensure your helm chart\ \ version actually targets external-dns **v0.11.0** when doing the upgrade." - chart_updates: - - 'RBAC updates: added cluster role permissions for other sources; restored/added - permissions needed for Istio-related sources (services + istio-gateway).' - - Helm chart gained `txtSuffix` value for TXT registry ownership records. - - Helm chart gained support for `topologySpreadConstraints` on the Deployment. - - Helm chart allows adding annotations to the Deployment. - - Helm chart docs corrected the list of valid `logLevel` options. - features: - - RFC2136 provider now supports creating/updating NS records (useful for delegations - managed via RFC2136). - - OpenShift Route source now has an event handler, improving responsiveness/updates - when Routes change. - - New SafeDNS provider added. - - 'BlueCat provider enhancements: supports proxy env vars and adds new CLI options - including full deploy functionality.' - - 'AWS improvements: CloudFront canonical hosted zone added and additional tests/behavior - around routing policies; AWS SD provider cleanup improvements.' - breaking_changes: - - No explicit breaking changes are called out in the provided v0.11.0 notes; - most changes are additive (RBAC, providers, chart values) plus dependency - bumps. - - 'Potential operational change: image base updated (Alpine 3.15) and Go version - bumped to 1.17; if you have strict runtime/compliance constraints, re-validate - the image and behavior in your environment.' + chart_updates: ['RBAC updates: added cluster role permissions for other sources; + restored/added permissions needed for Istio-related sources (services + + istio-gateway).', Helm chart gained `txtSuffix` value for TXT registry ownership + records., Helm chart gained support for `topologySpreadConstraints` on the + Deployment., Helm chart allows adding annotations to the Deployment., Helm + chart docs corrected the list of valid `logLevel` options.] + features: [RFC2136 provider now supports creating/updating NS records (useful + for delegations managed via RFC2136)., 'OpenShift Route source now has an + event handler, improving responsiveness/updates when Routes change.', New + SafeDNS provider added., 'BlueCat provider enhancements: supports proxy + env vars and adds new CLI options including full deploy functionality.', + 'AWS improvements: CloudFront canonical hosted zone added and additional tests/behavior + around routing policies; AWS SD provider cleanup improvements.'] + breaking_changes: ['No explicit breaking changes are called out in the provided + v0.11.0 notes; most changes are additive (RBAC, providers, chart values) + plus dependency bumps.', 'Potential operational change: image base updated + (Alpine 3.15) and Go version bumped to 1.17; if you have strict runtime/compliance + constraints, re-validate the image and behavior in your environment.'] chart_version: 1.9.0 - images: - - k8s.gcr.io/external-dns/external-dns:v0.11.0 + images: ['k8s.gcr.io/external-dns/external-dns:v0.11.0'] - version: 0.10.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'External-DNS upstream added an official Helm chart in v0.10.0 (PR #2208). - If you were previously deploying via raw manifests/kustomize or a third-party - chart, decide whether to migrate to the new chart and reconcile values/RBAC/serviceAccount - naming accordingly.' - - "Kustomize tooling in the repo was bumped (kustomize v0.9.0) and the repo\ - \ includes various CI/security tooling additions (CodeQL, Trivy, Dependabot).\ - \ These don\u2019t affect runtime directly but may change how you consume/build\ - \ manifests if you vendor them." - features: - - Official Helm chart added upstream (new supported install path). - - Controller updated for Kubernetes v1.22 to use networking.k8s.io/v1 Ingress - API (improves compatibility on newer clusters). - - Security posture improvements via dependency bumps and base image fixes (alpine - vulnerabilities) which may reduce CVE findings. - breaking_changes: - - Ingress handling updated toward networking.k8s.io/v1; if your cluster is <1.19 - or you still rely on extensions/v1beta1 or networking.k8s.io/v1beta1 Ingress, - validate API availability and your Ingress manifests before upgrading. - - 'If switching to the newly introduced official Helm chart, treat it as a deployment/migration - change: flags/args mapping, resource names, and RBAC may differ from your - current installation method.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['External-DNS upstream added an official Helm chart in v0.10.0 + (PR #2208). If you were previously deploying via raw manifests/kustomize + or a third-party chart, decide whether to migrate to the new chart and reconcile + values/RBAC/serviceAccount naming accordingly.', "Kustomize tooling in the\ + \ repo was bumped (kustomize v0.9.0) and the repo includes various CI/security\ + \ tooling additions (CodeQL, Trivy, Dependabot). These don\u2019t affect\ + \ runtime directly but may change how you consume/build manifests if you\ + \ vendor them."] + features: [Official Helm chart added upstream (new supported install path)., + Controller updated for Kubernetes v1.22 to use networking.k8s.io/v1 Ingress + API (improves compatibility on newer clusters)., Security posture improvements + via dependency bumps and base image fixes (alpine vulnerabilities) which + may reduce CVE findings.] + breaking_changes: ['Ingress handling updated toward networking.k8s.io/v1; if + your cluster is <1.19 or you still rely on extensions/v1beta1 or networking.k8s.io/v1beta1 + Ingress, validate API availability and your Ingress manifests before upgrading.', + 'If switching to the newly introduced official Helm chart, treat it as a deployment/migration + change: flags/args mapping, resource names, and RBAC may differ from your + current installation method.'] chart_version: 1.3.2 - images: - - k8s.gcr.io/external-dns/external-dns:v0.10.0 + images: ['k8s.gcr.io/external-dns/external-dns:v0.10.0'] - version: 0.9.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' - - '1.10' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14', '1.13', + '1.12', '1.11', '1.10'] requirements: [] incompatibilities: [] summary: null chart_version: 1.2.0 - images: - - k8s.gcr.io/external-dns/external-dns:v0.9.0 - name: external-dns + images: ['k8s.gcr.io/external-dns/external-dns:v0.9.0'] - icon: https://raw.githubusercontent.com/external-secrets/external-secrets/main/assets/eso-logo-large.png git_url: https://github.com/external-secrets/external-secrets release_url: https://github.com/external-secrets/external-secrets/releases/tag/v{vsn} helm_repository_url: https://charts.external-secrets.io versions: - version: 2.10.0 - kube: - - '1.36' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart was released for external-secrets app v2.9.0 (chart packaging update - only; no chart-specific value changes were called out in the provided notes). - - Deployment now applies a TLS security profile (may introduce/enable stricter - TLS settings depending on cluster defaults and chart configuration). - features: - - 'Conjur: added PushSecret support.' - - 'OpenBao: added `auth.kubernetes` authentication method support.' - - 'Passbolt: added support for custom fields and surfaced custom field functions - in the SDK.' - - 'Providers: added Nebius MysteryBox service-account token federation auth - option.' - - 'GitHub provider: added support for Dependabot secrets.' - - "Core: reconcile now reports \u201Csafe\u201D reconcile errors via status\ - \ conditions (improves observability)." + kube: ['1.36'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart was released for external-secrets app v2.9.0 (chart + packaging update only; no chart-specific value changes were called out in + the provided notes)., Deployment now applies a TLS security profile (may + introduce/enable stricter TLS settings depending on cluster defaults and + chart configuration).] + features: ['Conjur: added PushSecret support.', 'OpenBao: added `auth.kubernetes` + authentication method support.', 'Passbolt: added support for custom fields + and surfaced custom field functions in the SDK.', 'Providers: added Nebius + MysteryBox service-account token federation auth option.', 'GitHub provider: + added support for Dependabot secrets.', "Core: reconcile now reports \u201C\ + safe\u201D reconcile errors via status conditions (improves observability)."] breaking_changes: [] chart_version: 2.10.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.10.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.10.0'] - version: 2.9.0 - kube: - - '1.36' + kube: ['1.36'] requirements: [] incompatibilities: [] summary: @@ -20539,26 +16869,20 @@ addons: recheck cache-related values after upgrade. ' - chart_updates: - - Adds opt-in `schedulerName` and `runtimeClassName` support for pods. - - 'Conjur Helm installation improvements: adds install timeout and pins Conjur - server image version.' - - Fixes chart behavior where cache enablement could be removed when `installCRD=false`. - - Assorted dependency/security maintenance in the release pipeline (no chart - action required). - features: - - '1Password SDK: adds **environments** support, enabling selection/segmentation - across 1Password environments.' - - 'Helm chart: opt-in support for configuring `schedulerName` and `runtimeClassName` - on pods for advanced scheduling and runtime isolation.' + chart_updates: [Adds opt-in `schedulerName` and `runtimeClassName` support for + pods., 'Conjur Helm installation improvements: adds install timeout and + pins Conjur server image version.', Fixes chart behavior where cache enablement + could be removed when `installCRD=false`., Assorted dependency/security + maintenance in the release pipeline (no chart action required).] + features: ['1Password SDK: adds **environments** support, enabling selection/segmentation + across 1Password environments.', 'Helm chart: opt-in support for configuring + `schedulerName` and `runtimeClassName` on pods for advanced scheduling and + runtime isolation.'] breaking_changes: [] chart_version: 2.9.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.9.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.9.0'] - version: 2.8.0 - kube: - - '1.36' - - '1.35' + kube: ['1.36', '1.35'] requirements: [] incompatibilities: [] summary: @@ -20579,28 +16903,21 @@ addons: in Helm values; confirm your current value still makes sense after upgrade. ' - chart_updates: - - Added `aggregateToAdmin` toggle for RBAC aggregation. - - Added optional `NetworkPolicy` manifests/values support. - - Added `startupProbe` configuration support for the webhook Deployment. - features: - - Added a GitLab deploy token generator (new generator option for GitLab auth - flows). - - AWS Certificate Manager provider implemented (new backend/provider for reading - cert material). - - Leader election lease timings are now configurable (tune for HA and slow API - servers). - - ExternalSecrets now support a `CreateOrMerge` creation policy (merge behavior - when writing target Secrets). - - SecretStore `refreshInterval` now accepts a duration string (e.g., `"5m"`) - in addition to existing formats. + chart_updates: [Added `aggregateToAdmin` toggle for RBAC aggregation., Added + optional `NetworkPolicy` manifests/values support., Added `startupProbe` + configuration support for the webhook Deployment.] + features: [Added a GitLab deploy token generator (new generator option for GitLab + auth flows)., AWS Certificate Manager provider implemented (new backend/provider + for reading cert material)., Leader election lease timings are now configurable + (tune for HA and slow API servers)., ExternalSecrets now support a `CreateOrMerge` + creation policy (merge behavior when writing target Secrets)., 'SecretStore + `refreshInterval` now accepts a duration string (e.g., `"5m"`) in addition + to existing formats.'] breaking_changes: [] chart_version: 2.8.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.8.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.8.0'] - version: 2.7.0 - kube: - - '1.35' + kube: ['1.35'] requirements: [] incompatibilities: [] summary: @@ -20619,56 +16936,43 @@ addons: they still apply. ' - chart_updates: - - 'Helm charts released as 2.6.0 (from app release notes: PR #6427).' - - 'Chart templates truncate component names to comply with 63-char DNS label - constraints (PR #6428).' - - 'Expose `storeRequeueInterval` as a chart value (PR #6140).' - - 'Scope cert-controller RBAC to managed CRDs and webhook secret (PR #6481).' - features: - - Dedicated OpenBao provider added, plus OpenBao enhancements (custom CAs via - `caBundle`/`caProvider`, new auth methods `userPass`/`appRole`, and namespace - support). - - ExternalSecret gains `SyncWindows` to gate/limit periodic refresh windows. - - AWS Secrets Manager provider adds `replicationLocations`. - - 'Templating improvements: new `hexdec` function and ability to decode `templateFrom` - values.' - - 'New providers/capabilities: BeyondTrust WorkloadCredentials provider; Infisical - adds PushSecret support and better 404 handling; 1Password SDK adds GetAllSecrets.' - breaking_changes: - - 'PushSecret behavior for Kubernetes provider changed: when pushing, the operator - replaces the entire remote secret instead of merging (PR #6485). This may - overwrite fields you previously expected to be preserved.' + chart_updates: ['Helm charts released as 2.6.0 (from app release notes: PR #6427).', + 'Chart templates truncate component names to comply with 63-char DNS label + constraints (PR #6428).', 'Expose `storeRequeueInterval` as a chart value + (PR #6140).', 'Scope cert-controller RBAC to managed CRDs and webhook secret + (PR #6481).'] + features: ['Dedicated OpenBao provider added, plus OpenBao enhancements (custom + CAs via `caBundle`/`caProvider`, new auth methods `userPass`/`appRole`, + and namespace support).', ExternalSecret gains `SyncWindows` to gate/limit + periodic refresh windows., AWS Secrets Manager provider adds `replicationLocations`., + 'Templating improvements: new `hexdec` function and ability to decode `templateFrom` + values.', 'New providers/capabilities: BeyondTrust WorkloadCredentials provider; + Infisical adds PushSecret support and better 404 handling; 1Password SDK + adds GetAllSecrets.'] + breaking_changes: ['PushSecret behavior for Kubernetes provider changed: when + pushing, the operator replaces the entire remote secret instead of merging + (PR #6485). This may overwrite fields you previously expected to be preserved.'] chart_version: 2.7.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.7.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.7.0'] - version: 2.6.0 - kube: - - '1.35' - - '1.34' + kube: ['1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Helm chart released for app v2.5.0 (packaging update). - - 'Chart bugfix: PodDisruptionBudget now renders the PDB spec even when `minAvailable` - or `maxUnavailable` is set to `0` (previously treated as empty/falsey).' - features: - - 'Keeper provider: adds `provider_api_calls_count` metric to help observe/alert - on provider API usage.' - - 'Passbolt: supports `v5-custom-fields` resource type (enables syncing secrets - stored as custom fields).' - - 'Testing: adds OpenBao end-to-end test coverage (improves confidence for Vault/OpenBao - users).' + chart_updates: [Helm chart released for app v2.5.0 (packaging update)., 'Chart + bugfix: PodDisruptionBudget now renders the PDB spec even when `minAvailable` + or `maxUnavailable` is set to `0` (previously treated as empty/falsey).'] + features: ['Keeper provider: adds `provider_api_calls_count` metric to help + observe/alert on provider API usage.', 'Passbolt: supports `v5-custom-fields` + resource type (enables syncing secrets stored as custom fields).', 'Testing: + adds OpenBao end-to-end test coverage (improves confidence for Vault/OpenBao + users).'] breaking_changes: [] chart_version: 2.6.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.6.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.6.0'] - version: 2.5.0 - kube: - - '1.35' - - '1.34' + kube: ['1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -20686,100 +16990,75 @@ addons: \ #6343).\n- **Controller args rendering cleanup:** Removed a stale args guard\ \ in the controller deployment. If you have custom `extraArgs`/args overrides,\ \ validate the rendered manifest after upgrade (PR #6347).\n" - chart_updates: - - Chart released for app v2.4.1 baseline (v2.5.0 release notes include chart - release housekeeping). - - 'RBAC templates updated: conditional `serviceaccounts/token` rule; RBAC permissions - now depend on `processClusterExternalSecret`.' - - 'Scoped RBAC defaults changed: `scopedNamespace` defaults to Helm release - namespace when `scopedRBAC` is enabled.' - - Controller deployment template cleaned up by removing a stale args guard. - features: - - 'Pulumi provider: added OIDC-based authentication support.' - - Added liveness `healthz` checks for the cert-controller and webhook components - (improves probe behavior/operability). - - 'GCP: Workload Identity Federation impersonation can optionally specify a - service account email.' - - 'Security/metrics: added authentication and authorization for the metrics - endpoint via FilterProvider.' - - 'AWS: ability to inject Kubernetes context as STS session tags.' - breaking_changes: - - 'RBAC behavior changes in the Helm chart can effectively remove permissions - you previously had: `serviceaccounts/token` access may no longer be granted - unless enabled, and `externalsecrets` write RBAC is reduced when `processClusterExternalSecret` - is false. Review RBAC diffs and adjust values if needed.' - - If you enable `scopedRBAC`, `scopedNamespace` now implicitly becomes the release - namespace; set it explicitly if your installation expects a different target - namespace. + chart_updates: [Chart released for app v2.4.1 baseline (v2.5.0 release notes + include chart release housekeeping)., 'RBAC templates updated: conditional + `serviceaccounts/token` rule; RBAC permissions now depend on `processClusterExternalSecret`.', + 'Scoped RBAC defaults changed: `scopedNamespace` defaults to Helm release + namespace when `scopedRBAC` is enabled.', Controller deployment template + cleaned up by removing a stale args guard.] + features: ['Pulumi provider: added OIDC-based authentication support.', Added + liveness `healthz` checks for the cert-controller and webhook components + (improves probe behavior/operability)., 'GCP: Workload Identity Federation + impersonation can optionally specify a service account email.', 'Security/metrics: + added authentication and authorization for the metrics endpoint via FilterProvider.', + 'AWS: ability to inject Kubernetes context as STS session tags.'] + breaking_changes: ['RBAC behavior changes in the Helm chart can effectively + remove permissions you previously had: `serviceaccounts/token` access may + no longer be granted unless enabled, and `externalsecrets` write RBAC is + reduced when `processClusterExternalSecret` is false. Review RBAC diffs + and adjust values if needed.', 'If you enable `scopedRBAC`, `scopedNamespace` + now implicitly becomes the release namespace; set it explicitly if your + installation expects a different target namespace.'] chart_version: 2.5.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.5.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.5.0'] - version: 2.4.0 - kube: - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart released for app v2.3.0 (chart packaging/refresh as part of v2.4.0 - release). - - 'Chart fix: add `failurePolicy` to the ClusterSecretStore validating webhook - configuration (may affect admission behavior during webhook outages).' - features: - - 'Leader election: new `--leader-election-id` flag to support HA deployments - and allow multiple ESO instances with distinct leader locks.' - - 'Keeper provider: support fetching secrets by either ID or name.' - - 'DVLS provider: add name support for entries.' - - 'VaultDynamicSecret: GET method can now take parameters from the spec; also - separates GET parameters from other calls to avoid mixing request types.' - breaking_changes: - - 'Conjur provider: PushSecret and DeleteSecret now explicitly return an error - when used (if you relied on silent no-op behavior, this will now fail).' + kube: ['1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart released for app v2.3.0 (chart packaging/refresh + as part of v2.4.0 release)., 'Chart fix: add `failurePolicy` to the ClusterSecretStore + validating webhook configuration (may affect admission behavior during webhook + outages).'] + features: ['Leader election: new `--leader-election-id` flag to support HA deployments + and allow multiple ESO instances with distinct leader locks.', 'Keeper provider: + support fetching secrets by either ID or name.', 'DVLS provider: add name + support for entries.', 'VaultDynamicSecret: GET method can now take parameters + from the spec; also separates GET parameters from other calls to avoid mixing + request types.'] + breaking_changes: ['Conjur provider: PushSecret and DeleteSecret now explicitly + return an error when used (if you relied on silent no-op behavior, this + will now fail).'] chart_version: 2.4.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.4.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.4.0'] - version: 2.3.0 - kube: - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Charts were released alongside app v2.3.0 (release charts v2.2.0 noted); no - explicit Helm values changes called out in the provided notes. - - 'Helm chart dependency bump: Bitwarden chart version updated to v0.6.0.' - features: - - 'Doppler provider: ETag-based caching to reduce unnecessary fetches and improve - performance.' - - New OVHcloud provider implementation. - - PushSecret support added for Delinea Secret Server. - - 'GCP Workload Identity Federation: support service account impersonation when - using a Kubernetes service account.' - - 'PushSecret: add `dataTo` support for bulk secret pushing.' - - 'GitHub provider: new `orgSecretVisibility` field.' - - '1Password SDK: expanded PushSecret support (multi-field and complete PushSecret) - and better native item ID support.' - - 'Vault: VaultRole attribute added for TLS auth.' - - Vault token cache feature promoted out of experimental with expiry validation - improvements. - - 'Security/behavior controls: new source null byte policy.' - breaking_changes: - - 'Templating change: `getHostByName` was removed from template functions; templates - relying on it must be updated.' - - 'Templating dependency change: sprig dependency removed; any templates implicitly - relying on sprig-only functions should be validated (function availability - may differ).' + kube: ['1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Charts were released alongside app v2.3.0 (release charts v2.2.0 + noted); no explicit Helm values changes called out in the provided notes., + 'Helm chart dependency bump: Bitwarden chart version updated to v0.6.0.'] + features: ['Doppler provider: ETag-based caching to reduce unnecessary fetches + and improve performance.', New OVHcloud provider implementation., PushSecret + support added for Delinea Secret Server., 'GCP Workload Identity Federation: + support service account impersonation when using a Kubernetes service account.', + 'PushSecret: add `dataTo` support for bulk secret pushing.', 'GitHub provider: + new `orgSecretVisibility` field.', '1Password SDK: expanded PushSecret support + (multi-field and complete PushSecret) and better native item ID support.', + 'Vault: VaultRole attribute added for TLS auth.', Vault token cache feature + promoted out of experimental with expiry validation improvements., 'Security/behavior + controls: new source null byte policy.'] + breaking_changes: ['Templating change: `getHostByName` was removed from template + functions; templates relying on it must be updated.', 'Templating dependency + change: sprig dependency removed; any templates implicitly relying on sprig-only + functions should be validated (function availability may differ).'] chart_version: 2.3.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.3.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.3.0'] - version: 2.2.0 - kube: - - '1.35' - - '1.34' + kube: ['1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -20792,35 +17071,27 @@ addons: \ readiness probe support for the `external-secrets` deployment was added\ \ (chart feature). Review your values to optionally enable/tune `readinessProbe`\ \ for the controller.\n" - chart_updates: - - Added readinessProbe support for the external-secrets deployment (chart feature). - - Chart publishing/build pipeline adjusted (Docker build v4); mostly internal - but worth noting if you mirror/validate images or rely on build metadata. - - Security/dependency updates in the operator image and build chain (includes - grpc CVE fix). - features: - - 'GCP Secret Manager: can auto-detect `projectID` from the GCP metadata server, - reducing required configuration on GCE/GKE.' - - "Kubectl printers for ExternalSecret/PushSecret now show a \u201CLast Sync\u201D\ - \ column for easier troubleshooting/ops visibility." - - Passbolt provider now supports the v5 API. - - Azure Key Vault provider can surface expiration time for secrets. - - 'Templating: added a `certSANs` function to extract SANs from certificates.' - - 'cloud.ru provider: added support for configuring a path.' - - '1Password provider: supports native item IDs.' - - "AWS: tags and resource policy can be synced even when the secret value hasn\u2019\ - t changed (better drift correction)." - breaking_changes: - - Flux + OCIRepository chart consumers must update to use a `layerSelector` - when pulling the chart from the OCI registry; without it Flux may fail to - fetch/extract the chart. + chart_updates: [Added readinessProbe support for the external-secrets deployment + (chart feature)., Chart publishing/build pipeline adjusted (Docker build + v4); mostly internal but worth noting if you mirror/validate images or rely + on build metadata., Security/dependency updates in the operator image and + build chain (includes grpc CVE fix).] + features: ['GCP Secret Manager: can auto-detect `projectID` from the GCP metadata + server, reducing required configuration on GCE/GKE.', "Kubectl printers\ + \ for ExternalSecret/PushSecret now show a \u201CLast Sync\u201D column\ + \ for easier troubleshooting/ops visibility.", Passbolt provider now supports + the v5 API., Azure Key Vault provider can surface expiration time for secrets., + 'Templating: added a `certSANs` function to extract SANs from certificates.', + 'cloud.ru provider: added support for configuring a path.', '1Password provider: + supports native item IDs.', "AWS: tags and resource policy can be synced\ + \ even when the secret value hasn\u2019t changed (better drift correction)."] + breaking_changes: [Flux + OCIRepository chart consumers must update to use a + `layerSelector` when pulling the chart from the OCI registry; without it + Flux may fail to fetch/extract the chart.] chart_version: 2.2.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.2.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.2.0'] - version: 2.1.0 - kube: - - '1.35' - - '1.34' + kube: ['1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -20835,58 +17106,45 @@ addons: \ annotations after upgrade.\n\n> No explicit values renames/removals were\ \ listed in the provided notes; validate against the chart\u2019s `values.yaml`/README\ \ when you pull the new chart." - chart_updates: - - Helm chart refreshed for the v2.1.0 release. - - Added a chart option to enable leader election for the cert-manager/cert-controller - component. - - Fixed incorrectly set annotations on the cert-controller metrics Service. - features: - - Kubernetes TLS handling now falls back to system CA roots when no CA bundle - is configured, reducing configuration friction for outbound TLS. - - Allows cross-namespace PushSecret when using ClusterSecretStore, enabling - more flexible multi-namespace workflows. - - 'Added a new provider integration: Nebius MysteryBox.' - - Implemented a `SecretExists` check, improving behavior/logic around secret - presence detection. - - Metrics and caching logic were corrected and missing metrics added, improving - observability and correctness. - breaking_changes: - - "No new breaking changes were called out for v2.1.0 in the provided notes.\ - \ Note: v2.0.1 reiterates that the earlier sprig templating function changes\ - \ are breaking\u2014retest any ExternalSecret templates that use sprig functions." + chart_updates: [Helm chart refreshed for the v2.1.0 release., Added a chart + option to enable leader election for the cert-manager/cert-controller component., + Fixed incorrectly set annotations on the cert-controller metrics Service.] + features: ['Kubernetes TLS handling now falls back to system CA roots when no + CA bundle is configured, reducing configuration friction for outbound TLS.', + 'Allows cross-namespace PushSecret when using ClusterSecretStore, enabling + more flexible multi-namespace workflows.', 'Added a new provider integration: + Nebius MysteryBox.', 'Implemented a `SecretExists` check, improving behavior/logic + around secret presence detection.', 'Metrics and caching logic were corrected + and missing metrics added, improving observability and correctness.'] + breaking_changes: ["No new breaking changes were called out for v2.1.0 in the\ + \ provided notes. Note: v2.0.1 reiterates that the earlier sprig templating\ + \ function changes are breaking\u2014retest any ExternalSecret templates\ + \ that use sprig functions."] chart_version: 2.1.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.1.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.1.0'] - version: 2.0.1 - kube: - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart was released for v2.0.0 (no explicit values/schema changes called - out in these notes); review chart version alignment when bumping app image/tag. - - "Chart previously bumped to 1.3.2 as part of v2.0.0; v2.0.1 notes don\u2019\ - t mention further chart version/value changes." - features: - - HostAliases support was added to the Helm chart (v2.0.0), enabling you to - configure pod-level /etc/hosts entries via chart values. - - Validating webhook failurePolicy for SecretStore is now determined dynamically - (v2.0.0), improving webhook behavior across environments. - breaking_changes: - - Providers Alibaba and Device42 were removed in v2.0.0; any SecretStore/ClusterSecretStore - using them will stop working and must be migrated to a supported provider. - - Sprig dependency update in v2.0.1 changes some templating functions; templates - in ExternalSecret/ClusterExternalSecret that relied on old sprig behavior - may render differently or fail. + kube: ['1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart was released for v2.0.0 (no explicit values/schema + changes called out in these notes); review chart version alignment when + bumping app image/tag., "Chart previously bumped to 1.3.2 as part of v2.0.0;\ + \ v2.0.1 notes don\u2019t mention further chart version/value changes."] + features: ['HostAliases support was added to the Helm chart (v2.0.0), enabling + you to configure pod-level /etc/hosts entries via chart values.', 'Validating + webhook failurePolicy for SecretStore is now determined dynamically (v2.0.0), + improving webhook behavior across environments.'] + breaking_changes: [Providers Alibaba and Device42 were removed in v2.0.0; any + SecretStore/ClusterSecretStore using them will stop working and must be + migrated to a supported provider., Sprig dependency update in v2.0.1 changes + some templating functions; templates in ExternalSecret/ClusterExternalSecret + that relied on old sprig behavior may render differently or fail.] chart_version: 2.0.1 - images: - - ghcr.io/external-secrets/external-secrets:v2.0.1 + images: ['ghcr.io/external-secrets/external-secrets:v2.0.1'] - version: 2.0.0 - kube: - - '1.34' + kube: ['1.34'] requirements: [] incompatibilities: [] summary: @@ -20902,135 +17160,106 @@ addons: \ for Secretstore dynamically`). If you previously relied on a fixed failurePolicy\ \ setting, re-check resulting rendered manifests and admission behavior in\ \ your cluster.\n" - chart_updates: - - Added `hostAliases` support in the Helm chart (lets you inject host aliases - into pods). - - Validating webhook failurePolicy for SecretStore is now determined dynamically - (behavior/manifest may differ from prior releases). - - Chart housekeeping/cleanup and chart version bump noted as part of the release - process. - features: - - Helm chart now supports configuring `hostAliases` for External Secrets pods. - - SecretStore validating webhook failurePolicy is now set dynamically, improving - compatibility across cluster conditions. - breaking_changes: - - Providers **Alibaba** and **Device42** were removed (unsupported/unmaintained). - Any `SecretStore`/`ClusterSecretStore` using these providers will stop working - and must be migrated to a supported provider before upgrading. + chart_updates: [Added `hostAliases` support in the Helm chart (lets you inject + host aliases into pods)., Validating webhook failurePolicy for SecretStore + is now determined dynamically (behavior/manifest may differ from prior releases)., + Chart housekeeping/cleanup and chart version bump noted as part of the release + process.] + features: [Helm chart now supports configuring `hostAliases` for External Secrets + pods., 'SecretStore validating webhook failurePolicy is now set dynamically, + improving compatibility across cluster conditions.'] + breaking_changes: [Providers **Alibaba** and **Device42** were removed (unsupported/unmaintained). + Any `SecretStore`/`ClusterSecretStore` using these providers will stop working + and must be migrated to a supported provider before upgrading.] chart_version: 2.0.0 - images: - - ghcr.io/external-secrets/external-secrets:v2.0.0 + images: ['ghcr.io/external-secrets/external-secrets:v2.0.0'] - version: 1.3.2 - kube: - - '1.34' + kube: ['1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Helm chart released/updated around this range (notably: chart release 1.2.0 - in app v1.2.1 notes; chart release for v1.3.1 mentioned in v1.3.2 notes).' - - 'Chart: added/ensured tests for `readinessProbe` values/rendering (PR #5769).' - features: - - 'Infisical provider: added support for `caBundle` and `caProvider` to trust - custom CAs when talking to Infisical.' + chart_updates: ['Helm chart released/updated around this range (notably: chart + release 1.2.0 in app v1.2.1 notes; chart release for v1.3.1 mentioned in + v1.3.2 notes).', 'Chart: added/ensured tests for `readinessProbe` values/rendering + (PR #5769).'] + features: ['Infisical provider: added support for `caBundle` and `caProvider` + to trust custom CAs when talking to Infisical.'] breaking_changes: [] chart_version: 1.3.2 - images: - - ghcr.io/external-secrets/external-secrets:v1.3.2 + images: ['ghcr.io/external-secrets/external-secrets:v1.3.2'] - version: 1.2.1 - kube: - - '1.34' + kube: ['1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Helm chart bumped from 1.1.0 (noted in app v1.1.1 release notes) to 1.2.0 - (noted in app v1.2.1 release notes). - features: - - 'Infisical provider: added caBundle and caProvider support for custom/cluster - CA handling.' - - 'Doppler provider: added configurable retry settings.' - - 'BeyondTrust provider: enabled pushing secrets to BeyondTrust.' - - 'Password generator: can generate and expose multiple passwords.' - - 'Oracle provider: implemented SecretExists check/behavior.' - - 'Helm chart: added dynamic labelSelector when topologySpreadConstraints labelSelector - is not defined.' + chart_updates: [Helm chart bumped from 1.1.0 (noted in app v1.1.1 release notes) + to 1.2.0 (noted in app v1.2.1 release notes).] + features: ['Infisical provider: added caBundle and caProvider support for custom/cluster + CA handling.', 'Doppler provider: added configurable retry settings.', 'BeyondTrust + provider: enabled pushing secrets to BeyondTrust.', 'Password generator: + can generate and expose multiple passwords.', 'Oracle provider: implemented + SecretExists check/behavior.', 'Helm chart: added dynamic labelSelector + when topologySpreadConstraints labelSelector is not defined.'] breaking_changes: [] chart_version: 1.2.1 - images: - - ghcr.io/external-secrets/external-secrets:v1.2.1 + images: ['ghcr.io/external-secrets/external-secrets:v1.2.1'] - version: 1.1.1 - kube: - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart released for operator v1.0.0 (from v0.20.4); includes a fix to - normalize the default certificate duration value. - - Helm chart released as version 1.1.0 as part of the v1.1.1 application release - notes. - - 'Helm chart enhancement: add dynamic labelSelector when topologySpreadConstraints - is set but labelSelector is not explicitly defined.' - features: - - Dynamic target implementation for external secrets sources (new behavior around - how targets can be selected/handled). - - 'esoctl: new bootstrap generator commands to help generate/initialize generator-related - resources.' - - 'Doppler provider: configurable retry settings support.' - - 'BeyondTrust provider: enable pushing secrets (write/push support).' - - 'Oracle provider: implement SecretExists support (improves behavior/validation - when checking for existing secrets).' - - 'Generator: password generator can generate and expose multiple passwords.' - - 'Bitwarden Secrets Manager: `bitwardenServerSDKURL` is now required for `bitwardensecretsmanager`.' - - 'Helm: dynamic labelSelector defaulting for topologySpreadConstraints to reduce - misconfiguration.' - breaking_changes: - - Bitwarden Secrets Manager integration now requires `bitwardenServerSDKURL` - for `bitwardensecretsmanager`; existing configs without it will fail until - set. + kube: ['1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart released for operator v1.0.0 (from v0.20.4); includes + a fix to normalize the default certificate duration value., Helm chart released + as version 1.1.0 as part of the v1.1.1 application release notes., 'Helm + chart enhancement: add dynamic labelSelector when topologySpreadConstraints + is set but labelSelector is not explicitly defined.'] + features: [Dynamic target implementation for external secrets sources (new behavior + around how targets can be selected/handled)., 'esoctl: new bootstrap generator + commands to help generate/initialize generator-related resources.', 'Doppler + provider: configurable retry settings support.', 'BeyondTrust provider: + enable pushing secrets (write/push support).', 'Oracle provider: implement + SecretExists support (improves behavior/validation when checking for existing + secrets).', 'Generator: password generator can generate and expose multiple + passwords.', 'Bitwarden Secrets Manager: `bitwardenServerSDKURL` is now + required for `bitwardensecretsmanager`.', 'Helm: dynamic labelSelector defaulting + for topologySpreadConstraints to reduce misconfiguration.'] + breaking_changes: [Bitwarden Secrets Manager integration now requires `bitwardenServerSDKURL` + for `bitwardensecretsmanager`; existing configs without it will fail until + set.] chart_version: 1.1.1 - images: - - ghcr.io/external-secrets/external-secrets:v1.1.1 + images: ['ghcr.io/external-secrets/external-secrets:v1.1.1'] - version: 1.0.0 - kube: - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart release/update is included for v0.20.4 (from v0.20.3) but v1.0.0 - notes provided do not include specific chart value/key changes beyond one - default normalization and internal chart cleanups mentioned in PR titles. - - 'Chart-related changes called out: removed unused values from the chart (in - v0.20.4) and normalized the default certificate duration value (in v1.0.0).' - features: - - Dynamic target implementation for ExternalSecret sources (new dynamic target - behavior/implementation). - - 'esoctl: new bootstrap generator commands to help generate bootstrap manifests/config - for generators.' - - 'Generators: added a hex generator.' - - 'AWS Secrets Manager: ability to define a resource policy via metadata.' - - E2E managed tests were re-implemented (improves test coverage/reliability - rather than user-facing runtime behavior). - breaking_changes: - - 'Possible Helm values impact: chart removed unused values (if you set any - of those keys, Helm will now ignore/possibly error depending on tooling) and - the default certificate duration value was normalized (could change effective - cert validity if you relied on the previous implicit default).' - - Go module separation/internal build changes (generally not runtime-breaking - for users, but could affect downstream builds/forks or custom images if you - vendor/import ESO modules). + kube: ['1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart release/update is included for v0.20.4 (from v0.20.3) + but v1.0.0 notes provided do not include specific chart value/key changes + beyond one default normalization and internal chart cleanups mentioned in + PR titles., 'Chart-related changes called out: removed unused values from + the chart (in v0.20.4) and normalized the default certificate duration value + (in v1.0.0).'] + features: [Dynamic target implementation for ExternalSecret sources (new dynamic + target behavior/implementation)., 'esoctl: new bootstrap generator commands + to help generate bootstrap manifests/config for generators.', 'Generators: + added a hex generator.', 'AWS Secrets Manager: ability to define a resource + policy via metadata.', E2E managed tests were re-implemented (improves test + coverage/reliability rather than user-facing runtime behavior).] + breaking_changes: ['Possible Helm values impact: chart removed unused values + (if you set any of those keys, Helm will now ignore/possibly error depending + on tooling) and the default certificate duration value was normalized (could + change effective cert validity if you relied on the previous implicit default).', + 'Go module separation/internal build changes (generally not runtime-breaking + for users, but could affect downstream builds/forks or custom images if + you vendor/import ESO modules).'] chart_version: 1.0.0 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v1.0.0 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v1.0.0'] - version: 0.20.4 - kube: - - '1.34' + kube: ['1.34'] requirements: [] incompatibilities: [] summary: @@ -21039,82 +17268,66 @@ addons: \ includes keys that are no longer referenced, they may be ignored or trigger\ \ schema/lint failures depending on your tooling\u2014run a diff/`helm template`\ \ and remove any obsolete keys.\n" - chart_updates: - - 'Helm chart released for v0.20.3 as part of the v0.20.4 notes (PR #5467).' - - 'Chart values were cleaned up by removing unused options (PR #5334).' - features: - - New **hex generator** was added (generators). - - AWS Secrets Manager now supports defining a **resource policy via metadata**. - - "E2E \u201Cmanaged tests\u201D were re-implemented (primarily CI/test infrastructure,\ - \ not user-facing behavior)." - - Infisical provider gained additional auth methods (Kubernetes, AWS, token - auth) noted earlier in the range (from v0.19.2 notes). - breaking_changes: - - STSSessionToken generator documentation indicates the **JWT token authentication - option was removed**; if you relied on that auth mode, migrate to a supported - method. - - UBI-based container images were updated from **UBI8 to UBI9**; this can be - breaking for environments with strict base-image allowlists or vulnerability/compliance - baselines. + chart_updates: ['Helm chart released for v0.20.3 as part of the v0.20.4 notes + (PR #5467).', 'Chart values were cleaned up by removing unused options (PR + #5334).'] + features: [New **hex generator** was added (generators)., AWS Secrets Manager + now supports defining a **resource policy via metadata**., "E2E \u201Cmanaged\ + \ tests\u201D were re-implemented (primarily CI/test infrastructure, not\ + \ user-facing behavior).", 'Infisical provider gained additional auth methods + (Kubernetes, AWS, token auth) noted earlier in the range (from v0.19.2 notes).'] + breaking_changes: ['STSSessionToken generator documentation indicates the **JWT + token authentication option was removed**; if you relied on that auth mode, + migrate to a supported method.', UBI-based container images were updated + from **UBI8 to UBI9**; this can be breaking for environments with strict + base-image allowlists or vulnerability/compliance baselines.] chart_version: 0.20.4 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.20.4 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.20.4'] - version: 0.19.2 - kube: - - '1.33' + kube: ['1.33'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Helm chart was re-released alongside the app version (v0.18.1 chart release - mentioned in v0.18.2 notes; v0.19.1 chart release mentioned in v0.19.2 notes). - No explicit values/schema changes are called out in the provided notes. - - 'Container image options changed operationally: v0.18.2 notes warn UBI images - are broken; v0.19.2 includes working `-ubi` and `-ubi-boringssl` images again.' - features: - - 'Infisical provider enhancements: additional auth methods (Kubernetes, AWS, - token) in v0.19.2; earlier v0.18.2 added Azure auth/refactor to Go SDK.' - - 'GitLab provider: support for custom CAs (v0.18.2).' - - 'AWS Parameter Store: support selecting parameters by AWS tags (v0.18.2).' - - 'Bitwarden SDK server subchart: ability to set namespace (v0.18.2).' + chart_updates: [Helm chart was re-released alongside the app version (v0.18.1 + chart release mentioned in v0.18.2 notes; v0.19.1 chart release mentioned + in v0.19.2 notes). No explicit values/schema changes are called out in the + provided notes., 'Container image options changed operationally: v0.18.2 + notes warn UBI images are broken; v0.19.2 includes working `-ubi` and `-ubi-boringssl` + images again.'] + features: ['Infisical provider enhancements: additional auth methods (Kubernetes, + AWS, token) in v0.19.2; earlier v0.18.2 added Azure auth/refactor to Go + SDK.', 'GitLab provider: support for custom CAs (v0.18.2).', 'AWS Parameter + Store: support selecting parameters by AWS tags (v0.18.2).', 'Bitwarden + SDK server subchart: ability to set namespace (v0.18.2).'] breaking_changes: [] chart_version: 0.19.2 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.19.2 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.19.2'] - version: 0.18.2 - kube: - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'v0.17.0: Helm chart updated (release notes mention chart update to v0.16.2); - no explicit value changes called out in provided notes.' - - 'v0.18.2: Helm chart released for v0.18.1 (packaging/release process); no - explicit helm values changes called out in provided notes.' - - 'v0.18.2: bitwarden-sdk-server subchart now supports configuring its namespace - (new chart capability).' - features: - - 'v0.17.0: Added a 1Password SDK-based provider.' - - 'v0.17.0: Infisical provider now supports secrets within paths for `data` - references.' - - 'v0.17.0: Vault provider can cache separate clients per namespace when needed.' - - 'v0.18.2: GitLab provider supports custom CAs.' - - 'v0.18.2: Infisical provider adds Azure auth and refactors to the Go SDK.' - - 'v0.18.2: AWS Parameter Store supports filtering/working with AWS tags.' - - 'v0.18.2: Bitwarden SDK server subchart allows setting the namespace.' - breaking_changes: - - 'v0.17.0: Stops serving `external-secrets.io/v1beta1` APIs; all manifests - must be migrated to `external-secrets.io/v1` before upgrading from 0.16.x - to 0.17.0.' + kube: ['1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['v0.17.0: Helm chart updated (release notes mention chart update + to v0.16.2); no explicit value changes called out in provided notes.', 'v0.18.2: + Helm chart released for v0.18.1 (packaging/release process); no explicit + helm values changes called out in provided notes.', 'v0.18.2: bitwarden-sdk-server + subchart now supports configuring its namespace (new chart capability).'] + features: ['v0.17.0: Added a 1Password SDK-based provider.', 'v0.17.0: Infisical + provider now supports secrets within paths for `data` references.', 'v0.17.0: + Vault provider can cache separate clients per namespace when needed.', 'v0.18.2: + GitLab provider supports custom CAs.', 'v0.18.2: Infisical provider adds + Azure auth and refactors to the Go SDK.', 'v0.18.2: AWS Parameter Store + supports filtering/working with AWS tags.', 'v0.18.2: Bitwarden SDK server + subchart allows setting the namespace.'] + breaking_changes: ['v0.17.0: Stops serving `external-secrets.io/v1beta1` APIs; + all manifests must be migrated to `external-secrets.io/v1` before upgrading + from 0.16.x to 0.17.0.'] chart_version: 0.18.2 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.18.2 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.18.2'] - version: 0.17.0 - kube: - - '1.33' + kube: ['1.33'] requirements: [] incompatibilities: [] summary: @@ -21127,36 +17340,30 @@ addons: \ and some chart-release fixes, but the notes provided don\u2019t list additional\ \ required values changes beyond the RBAC aggregation toggle and the Grafana\ \ dashboard addition.\n" - chart_updates: - - Added Grafana dashboard manifests to the Helm chart (0.16.2). - - Added Helm option to disable RBAC aggregation labels (`aggregate-to-view` - / `aggregate-to-edit`) on default ClusterRoles (0.16.2). - - 'Chart release process fixes (0.17.0): avoid re-releasing an already released - chart; remove an in-chart comment; fix logic around releasing charts.' - features: - - 'Generic webhook provider: added NTLM authentication support (0.16.2).' - - Improved GitHub provider error reporting (0.17.0). - - 'GCP PushSecret: fixed location replication behavior (0.17.0).' - - 'Infisical provider: support secrets within paths for `data` references (0.17.0).' - - 'Vault provider: cache separate clients per namespace when needed (0.17.0).' - - Added a new 1Password SDK-based provider (0.17.0). - - 'Helm: optional Grafana dashboard for observability (0.16.2).' - breaking_changes: - - '**v0.17.0 stops serving `external-secrets.io/v1beta1` APIs.** You must update - all External Secrets Operator CR manifests from `apiVersion: external-secrets.io/v1beta1` - to `apiVersion: external-secrets.io/v1` before upgrading from 0.16.x to 0.17.0. - The intended change is just removing `beta1`, and 0.16.2 already supports - `v1` to allow a safe transition.' - - '**v0.16.2 Generator refresh behavior changed.** If you use Generators with - `refreshInterval: 0` or a refresh policy intended to prevent updates, 0.16.2 - will force updates anyway; review Generator usage/expectations before and - after upgrading.' + chart_updates: [Added Grafana dashboard manifests to the Helm chart (0.16.2)., + Added Helm option to disable RBAC aggregation labels (`aggregate-to-view` + / `aggregate-to-edit`) on default ClusterRoles (0.16.2)., 'Chart release + process fixes (0.17.0): avoid re-releasing an already released chart; remove + an in-chart comment; fix logic around releasing charts.'] + features: ['Generic webhook provider: added NTLM authentication support (0.16.2).', + Improved GitHub provider error reporting (0.17.0)., 'GCP PushSecret: fixed + location replication behavior (0.17.0).', 'Infisical provider: support secrets + within paths for `data` references (0.17.0).', 'Vault provider: cache separate + clients per namespace when needed (0.17.0).', Added a new 1Password SDK-based + provider (0.17.0)., 'Helm: optional Grafana dashboard for observability + (0.16.2).'] + breaking_changes: ['**v0.17.0 stops serving `external-secrets.io/v1beta1` APIs.** + You must update all External Secrets Operator CR manifests from `apiVersion: + external-secrets.io/v1beta1` to `apiVersion: external-secrets.io/v1` before + upgrading from 0.16.x to 0.17.0. The intended change is just removing `beta1`, + and 0.16.2 already supports `v1` to allow a safe transition.', '**v0.16.2 + Generator refresh behavior changed.** If you use Generators with `refreshInterval: + 0` or a refresh policy intended to prevent updates, 0.16.2 will force updates + anyway; review Generator usage/expectations before and after upgrading.'] chart_version: 0.17.0 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.17.0 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.17.0'] - version: 0.16.2 - kube: - - '1.32' + kube: ['1.32'] requirements: [] incompatibilities: [] summary: @@ -21165,376 +17372,235 @@ addons: t want ESO roles automatically aggregated into the built-in `view/edit` roles).\n\ - **Helm chart adds a Grafana dashboard** (if you deploy dashboards via Helm,\ \ expect new/updated dashboard resources).\n" - chart_updates: - - Helm chart release bumped to v0.16.1 (chart packaging changes aligned with - app v0.16.x). - - 'Helm: Added a bundled Grafana dashboard.' - - 'Helm: Added values/support to disable `aggregate-to-view`/`aggregate-to-edit` - labels on default ClusterRoles.' - features: - - Grafana dashboard support was added to the Helm chart for easier observability/monitoring. - - Generic webhook generator gained NTLM authentication support (relevant if - you use the webhook generator with NTLM-protected endpoints). - breaking_changes: - - '**Generators behavior change:** If you use Generators with `refreshInterval: - 0` (or another refreshPolicy intended to prevent updates), upgrading to **v0.16.2 - will force that value to be updated**, potentially causing unexpected secret - refreshes/rotations.' + chart_updates: [Helm chart release bumped to v0.16.1 (chart packaging changes + aligned with app v0.16.x)., 'Helm: Added a bundled Grafana dashboard.', + 'Helm: Added values/support to disable `aggregate-to-view`/`aggregate-to-edit` + labels on default ClusterRoles.'] + features: [Grafana dashboard support was added to the Helm chart for easier + observability/monitoring., Generic webhook generator gained NTLM authentication + support (relevant if you use the webhook generator with NTLM-protected endpoints).] + breaking_changes: ['**Generators behavior change:** If you use Generators with + `refreshInterval: 0` (or another refreshPolicy intended to prevent updates), + upgrading to **v0.16.2 will force that value to be updated**, potentially + causing unexpected secret refreshes/rotations.'] chart_version: 0.16.2 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.16.2 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.16.2'] - version: 0.15.1 - kube: - - '1.32' + kube: ['1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v0.14.4 introduced a Prometheus status metric for PushSecret objects. - - v0.14.4 added support for tagging secrets when pushing to Azure Key Vault. - - v0.14.4 enabled pushing an entire secret to AWS Secrets Manager (PushSecret - use case). - - v0.14.4 made Vault auth an optional entry in its configuration/secret reference. - - v0.14.4 updated AWS identity documentation to include the EKS pod identity - flow. - - v0.14.4 updated the project to build with Go 1.24. + features: [v0.14.4 introduced a Prometheus status metric for PushSecret objects., + v0.14.4 added support for tagging secrets when pushing to Azure Key Vault., + v0.14.4 enabled pushing an entire secret to AWS Secrets Manager (PushSecret + use case)., v0.14.4 made Vault auth an optional entry in its configuration/secret + reference., v0.14.4 updated AWS identity documentation to include the EKS + pod identity flow., v0.14.4 updated the project to build with Go 1.24.] breaking_changes: [] chart_version: 0.15.1 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.15.1 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.15.1'] - version: 0.14.4 - kube: - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Chart bundle updated to app v0.14.3 as part of the v0.14.4 release notes (no - explicit chart-value changes called out in the provided notes). - features: - - 'AWS Parameter Store PushSecret: new metadata/spec structure supports configuring - tier, KMS key, secretType, and policies/attributes (breaking vs previous metadata - format).' - - 'New generator: Quay generator support.' - - New renderer for template data and secrets (rendering improvements/CLI tooling - referenced as esoctl). - - 'PushSecret observability: Prometheus status metric for PushSecret objects.' - - 'Azure Key Vault PushSecret: ability to specify tags when pushing secrets.' - - 'AWS Secrets Manager PushSecret: option to push the entire secret payload.' - - 'Vault: allowEmptyResponse for VaultDynamicSecret; and vault auth entry can - be optional.' - - 'Vault provider: allow UUID as vault and item name.' - - 'Infisical provider: allow reference expansion when searching by key; improved - error handling to avoid silent failures.' - breaking_changes: - - AWS Parameter Store PushSecret metadata format changed (METADATA structure - breaking change). Existing PushSecrets using old metadata must be migrated - to the new PushSecretMetadata spec structure before/with upgrade. + kube: ['1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Chart bundle updated to app v0.14.3 as part of the v0.14.4 release + notes (no explicit chart-value changes called out in the provided notes).] + features: ['AWS Parameter Store PushSecret: new metadata/spec structure supports + configuring tier, KMS key, secretType, and policies/attributes (breaking + vs previous metadata format).', 'New generator: Quay generator support.', + New renderer for template data and secrets (rendering improvements/CLI tooling + referenced as esoctl)., 'PushSecret observability: Prometheus status metric + for PushSecret objects.', 'Azure Key Vault PushSecret: ability to specify + tags when pushing secrets.', 'AWS Secrets Manager PushSecret: option to + push the entire secret payload.', 'Vault: allowEmptyResponse for VaultDynamicSecret; + and vault auth entry can be optional.', 'Vault provider: allow UUID as vault + and item name.', 'Infisical provider: allow reference expansion when searching + by key; improved error handling to avoid silent failures.'] + breaking_changes: [AWS Parameter Store PushSecret metadata format changed (METADATA + structure breaking change). Existing PushSecrets using old metadata must + be migrated to the new PushSecretMetadata spec structure before/with upgrade.] chart_version: 0.14.4 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.14.4 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.14.4'] - version: 0.13.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart-specific changelog provided in the supplied notes (only application - release notes). - - Assume Helm chart version bumps alongside app versions; verify chart version - and values schema by running `helm show values` for both versions and diffing, - and review rendered manifests with `helm template`. - features: - - 'AWS Parameter Store PushSecret: can now configure Parameter Store tier (Standard/Advanced) - and richer metadata options (KMS key, policies, attributes).' - - 'Generators: new Quay generator support.' - - 'VaultDynamicSecret: new `allowEmptyResponse` option to tolerate empty responses.' - - 'Template rendering: added a renderer for template data and secrets (new/updated - CLI plumbing; release notes mention rename in release action from `render` - to `esoctl`).' - - 'Infisical provider: improved error handling so missing secrets/incorrect - auth no longer fail silently.' - breaking_changes: - - AWS Parameter Store PushSecret metadata structure changed (v0.13.0). Existing - PushSecret manifests using the old metadata layout will break and must be - updated to the new `PushSecretMetadata` structure documented in the provider - docs. - - '(From 0.12.1, still relevant if you skipped it) AWS provider permission update: - Bulk/Batch fetch for multiple secrets requires adding the BulkFetch/batch - endpoint permission to IAM policies.' - - (From 0.12.1, still relevant) GCP Secret Manager PushSecret metadata format - was standardized (including CMEK); older manifests will stop working until - updated. - - "(From 0.12.1, still relevant) Generator JSON tag typo fix (`ecrRAuthorizationTokenSpec`\ - \ \u2192 `ecrAuthorizationTokenSpec`) may affect any custom tooling/JSON-based\ - \ specs relying on the old field name." + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [No Helm chart-specific changelog provided in the supplied notes + (only application release notes)., 'Assume Helm chart version bumps alongside + app versions; verify chart version and values schema by running `helm show + values` for both versions and diffing, and review rendered manifests with + `helm template`.'] + features: ['AWS Parameter Store PushSecret: can now configure Parameter Store + tier (Standard/Advanced) and richer metadata options (KMS key, policies, + attributes).', 'Generators: new Quay generator support.', 'VaultDynamicSecret: + new `allowEmptyResponse` option to tolerate empty responses.', 'Template + rendering: added a renderer for template data and secrets (new/updated CLI + plumbing; release notes mention rename in release action from `render` to + `esoctl`).', 'Infisical provider: improved error handling so missing secrets/incorrect + auth no longer fail silently.'] + breaking_changes: [AWS Parameter Store PushSecret metadata structure changed + (v0.13.0). Existing PushSecret manifests using the old metadata layout will + break and must be updated to the new `PushSecretMetadata` structure documented + in the provider docs., '(From 0.12.1, still relevant if you skipped it) + AWS provider permission update: Bulk/Batch fetch for multiple secrets requires + adding the BulkFetch/batch endpoint permission to IAM policies.', '(From + 0.12.1, still relevant) GCP Secret Manager PushSecret metadata format was + standardized (including CMEK); older manifests will stop working until updated.', + "(From 0.12.1, still relevant) Generator JSON tag typo fix (`ecrRAuthorizationTokenSpec`\ + \ \u2192 `ecrAuthorizationTokenSpec`) may affect any custom tooling/JSON-based\ + \ specs relying on the old field name."] chart_version: 0.13.0 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.13.0 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.13.0'] - version: 0.12.1 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Application version moves from v0.11.0 to v0.12.1 (note: v0.12.0 tag exists - but release failed; v0.12.1 is the intended upgrade target).' - - "OLM note from v0.11.0: 0.11.0 is the last OLM release \u201Cuntil further\ - \ notice\u201D; you can keep OLM manifests but must set `image.tag` to run\ - \ newer ESO images." - features: - - AWS provider now uses a bulk/batch fetch mechanism when retrieving multiple - secrets, reducing API calls. - - GCP Secrets Manager PushSecret gains CMEK support and a standardized metadata - structure. - - 1Password PushSecret adds support for tags and configurable destination vault. - - AWS ECR Public authorization token generator support was added. - - Template helper `filterCertChain` was added; default controller QPS/Burst - increased to 50/100; various provider robustness fixes (GitLab/Vault/GCP labels). - breaking_changes: - - 'AWS provider permission change: additional permission required for the BulkFetch/batch - endpoint when fetching multiple secrets.' - - 'Generator JSON tag typo fixed: `ecrRAuthorizationTokenSpec` corrected (manifests - using the old field/tag may break).' - - GCP Secrets Manager PushSecret metadata format was standardized; existing - PushSecret manifests may stop working until updated to the new structure. + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Application version moves from v0.11.0 to v0.12.1 (note: v0.12.0 + tag exists but release failed; v0.12.1 is the intended upgrade target).', + "OLM note from v0.11.0: 0.11.0 is the last OLM release \u201Cuntil further\ + \ notice\u201D; you can keep OLM manifests but must set `image.tag` to run\ + \ newer ESO images."] + features: ['AWS provider now uses a bulk/batch fetch mechanism when retrieving + multiple secrets, reducing API calls.', GCP Secrets Manager PushSecret gains + CMEK support and a standardized metadata structure., 1Password PushSecret + adds support for tags and configurable destination vault., AWS ECR Public + authorization token generator support was added., Template helper `filterCertChain` + was added; default controller QPS/Burst increased to 50/100; various provider + robustness fixes (GitLab/Vault/GCP labels).] + breaking_changes: ['AWS provider permission change: additional permission required + for the BulkFetch/batch endpoint when fetching multiple secrets.', 'Generator + JSON tag typo fixed: `ecrRAuthorizationTokenSpec` corrected (manifests using + the old field/tag may break).', GCP Secrets Manager PushSecret metadata + format was standardized; existing PushSecret manifests may stop working + until updated to the new structure.] chart_version: 0.12.1 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.12.1 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.12.1'] - version: 0.11.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [New reconciliation approach reduces Kubernetes API calls; introduces + managed-secrets caching as the new default and supports partial/managed + secret caching behavior changes., ClusterGenerators and generator caching + added (cluster-wide generators)., 'Azure Key Vault: can push expiration + date to secrets.', 'BeyondTrust provider: API key authentication support.', + 'Delinea Secret Server: support multiple Items fields.'] + breaking_changes: ['OLM: 0.11.0 is the last release available for OLM until + further notice; OLM users may need to pin image.tag going forward.', 'Secret + key cleanup behavior changed: keys previously created by ExternalSecret + but no longer present in template/data/dataFrom will now be removed from + target Secrets (even with CreationPolicy=Merge).', 'With CreationPolicy=Owner, + operator now fully recalculates desired Secret state each loop and will + not retain extra keys, potentially removing previously retained keys on + upgrade.', CRDs now include stricter validation (kubebuilder markers) which + can reject previously-accepted but incomplete/invalid manifests., Memory + usage may increase if not using --enable-secrets-caching; caching flag defaults/behavior + changed (managed secrets caching default).] + chart_version: 0.11.0 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.11.0'] + - version: 0.10.7 + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: [] - features: - - New reconciliation approach reduces Kubernetes API calls; introduces managed-secrets - caching as the new default and supports partial/managed secret caching behavior - changes. - - ClusterGenerators and generator caching added (cluster-wide generators). - - 'Azure Key Vault: can push expiration date to secrets.' - - 'BeyondTrust provider: API key authentication support.' - - 'Delinea Secret Server: support multiple Items fields.' - breaking_changes: - - 'OLM: 0.11.0 is the last release available for OLM until further notice; OLM - users may need to pin image.tag going forward.' - - 'Secret key cleanup behavior changed: keys previously created by ExternalSecret - but no longer present in template/data/dataFrom will now be removed from target - Secrets (even with CreationPolicy=Merge).' - - With CreationPolicy=Owner, operator now fully recalculates desired Secret - state each loop and will not retain extra keys, potentially removing previously - retained keys on upgrade. - - CRDs now include stricter validation (kubebuilder markers) which can reject - previously-accepted but incomplete/invalid manifests. - - Memory usage may increase if not using --enable-secrets-caching; caching flag - defaults/behavior changed (managed secrets caching default). - chart_version: 0.11.0 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.11.0 - - version: 0.10.7 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Docs/helm: release v0.10.6 helm chart docs update (no functional change indicated).' - features: - - "Adds YAML-based encoding option for \u201Cget secrets as map\u201D functionality." - - Fixes Azure Key Vault provider URL suffix to resolve OpenID discovery issues - (improves Azure auth reliability). + chart_updates: ['Docs/helm: release v0.10.6 helm chart docs update (no functional + change indicated).'] + features: ["Adds YAML-based encoding option for \u201Cget secrets as map\u201D\ + \ functionality.", Fixes Azure Key Vault provider URL suffix to resolve + OpenID discovery issues (improves Azure auth reliability).] breaking_changes: [] chart_version: 0.10.7 - images: - - oci.external-secrets.io/external-secrets/external-secrets:v0.10.7 + images: ['oci.external-secrets.io/external-secrets/external-secrets:v0.10.7'] - version: 0.9.20 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'New provider integrations: Infisical, Device42, and Bitwarden Secret Manager.' - - 'GCP PushSecret: support specifying a location/region for pushed secrets.' - - 'AWS SSM Parameter Store: support setting parameter Type, and reduce API calls - (fetch once).' - - 'ClusterSecretStore: namespaceConditions now support glob patterns for namespace - matching.' - - 'PushSecret: add logic to skip unmanaged stores; support pushing whole Kubernetes - Secrets to Google Cloud Secret Manager and Azure Key Vault.' - - 'Kubernetes provider: add AuthRef support for improved auth configuration.' - - 'Logging: add log.level and log.encoding options across components.' - - 'cert-controller performance/scaling: allow restricting CRDs/webhooks in informer - cache; enable partial cache when installCRDs=true.' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', + '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['New provider integrations: Infisical, Device42, and Bitwarden Secret + Manager.', 'GCP PushSecret: support specifying a location/region for pushed + secrets.', 'AWS SSM Parameter Store: support setting parameter Type, and + reduce API calls (fetch once).', 'ClusterSecretStore: namespaceConditions + now support glob patterns for namespace matching.', 'PushSecret: add logic + to skip unmanaged stores; support pushing whole Kubernetes Secrets to Google + Cloud Secret Manager and Azure Key Vault.', 'Kubernetes provider: add AuthRef + support for improved auth configuration.', 'Logging: add log.level and log.encoding + options across components.', 'cert-controller performance/scaling: allow + restricting CRDs/webhooks in informer cache; enable partial cache when installCRDs=true.'] breaking_changes: [] chart_version: 0.9.20 - images: - - ghcr.io/external-secrets/external-secrets:v0.9.20 + images: ['ghcr.io/external-secrets/external-secrets:v0.9.20'] - version: 0.8.7 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - From the provided notes, v0.7.2 introduced new capabilities like referent - auth for AWS/GCP/Azure, AWS role chaining, KeyVault PushSecret support, and - HashiCorp Vault deletion policy handling. - - The provided v0.8.7 entry includes image tags and release assets only; no - feature list was included in the notes you supplied. - breaking_changes: - - No breaking changes are mentioned in the provided release notes for either - v0.7.2 or v0.8.7; however, this does not guarantee there were none across - intermediate 0.8.x releases. + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['From the provided notes, v0.7.2 introduced new capabilities like + referent auth for AWS/GCP/Azure, AWS role chaining, KeyVault PushSecret + support, and HashiCorp Vault deletion policy handling.', The provided v0.8.7 + entry includes image tags and release assets only; no feature list was included + in the notes you supplied.] + breaking_changes: ['No breaking changes are mentioned in the provided release + notes for either v0.7.2 or v0.8.7; however, this does not guarantee there + were none across intermediate 0.8.x releases.'] chart_version: 0.8.7 - images: - - ghcr.io/external-secrets/external-secrets:v0.8.7 + images: ['ghcr.io/external-secrets/external-secrets:v0.8.7'] - version: 0.7.2 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'HashiCorp Vault: deletion policy support.' - - 'AWS: role chaining support.' - - Referent auth support for GCP and AWS (Secrets Manager/Parameter Store), plus - Azure referent auth. - - 'Azure Key Vault: PushSecret support.' + features: ['HashiCorp Vault: deletion policy support.', 'AWS: role chaining + support.', 'Referent auth support for GCP and AWS (Secrets Manager/Parameter + Store), plus Azure referent auth.', 'Azure Key Vault: PushSecret support.'] breaking_changes: [] chart_version: 0.7.2 - images: - - ghcr.io/external-secrets/external-secrets:v0.7.2 + images: ['ghcr.io/external-secrets/external-secrets:v0.7.2'] - version: 0.6.1 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator image tags were corrected; the default/main image is now built and - published with a proper `-ubi` variant, and the release publishes SBOM/provenance - assets. - - "Controller-runtime dependency was bumped (0.12.3 \u2192 0.13.0), which can\ - \ impact Kubernetes compatibility and controller behavior indirectly." - - Several fixes landed around deletion behavior and path building logic, which - may affect reconciliation outcomes in edge cases. - features: - - ClusterSecretStore gained a namespace condition, enabling scoping/selection - logic based on namespaces. - - An Oracle validator was implemented (improves provider/validation behavior - for Oracle-related integrations). - - Releases now attach SBOM and provenance files (supply-chain metadata) to GitHub - releases. + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator image tags were corrected; the default/main image + is now built and published with a proper `-ubi` variant, and the release + publishes SBOM/provenance assets.', "Controller-runtime dependency was bumped\ + \ (0.12.3 \u2192 0.13.0), which can impact Kubernetes compatibility and\ + \ controller behavior indirectly.", 'Several fixes landed around deletion + behavior and path building logic, which may affect reconciliation outcomes + in edge cases.'] + features: ['ClusterSecretStore gained a namespace condition, enabling scoping/selection + logic based on namespaces.', An Oracle validator was implemented (improves + provider/validation behavior for Oracle-related integrations)., Releases + now attach SBOM and provenance files (supply-chain metadata) to GitHub releases.] breaking_changes: [] chart_version: 0.6.1 - images: - - ghcr.io/external-secrets/external-secrets:v0.6.1 + images: ['ghcr.io/external-secrets/external-secrets:v0.6.1'] - version: 0.5.9 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -21552,76 +17618,46 @@ addons: > No other explicit Helm values changes were included in the provided notes; review your current values for ServiceAccount/metrics/DNS settings and decide if you want to adopt the new knobs.' - chart_updates: - - Adds Helm templating/values for extra ServiceAccount labels. - - Adds Helm chart support for DNS options. - - Adds Helm flags to create additional metrics Services for other scrapers. - - Adds kustomization file under `config/crds/bases` (useful for non-Helm install/CRD - management workflows). - features: - - 'AWS provider: retry/throttling handling improved via a retryer implementation - (better behavior under AWS API rate limits).' - - 'New kubectl-friendly output: additional columns for relevant CRDs to improve - `kubectl get` visibility.' - - Configurable cache and throttling options (helps performance and stability - under load). - - Implements `dataFrom` key rewrite (new/updated behavior for rewriting keys - when importing multiple secrets). - - 'IBM provider: adds support for container auth.' - - 1Password integration improvements (plus docs updates). - breaking_changes: - - "No explicit breaking changes are called out in the provided notes. The biggest\ - \ behavior change risk is the `dataFrom` key rewrite implementation\u2014\ - verify your ExternalSecret/ClusterSecretStore usage and rendered Secret keys\ - \ in a non-prod environment before rolling out." + chart_updates: [Adds Helm templating/values for extra ServiceAccount labels., + Adds Helm chart support for DNS options., Adds Helm flags to create additional + metrics Services for other scrapers., Adds kustomization file under `config/crds/bases` + (useful for non-Helm install/CRD management workflows).] + features: ['AWS provider: retry/throttling handling improved via a retryer implementation + (better behavior under AWS API rate limits).', 'New kubectl-friendly output: + additional columns for relevant CRDs to improve `kubectl get` visibility.', + Configurable cache and throttling options (helps performance and stability + under load)., Implements `dataFrom` key rewrite (new/updated behavior for + rewriting keys when importing multiple secrets)., 'IBM provider: adds support + for container auth.', 1Password integration improvements (plus docs updates).] + breaking_changes: ["No explicit breaking changes are called out in the provided\ + \ notes. The biggest behavior change risk is the `dataFrom` key rewrite\ + \ implementation\u2014verify your ExternalSecret/ClusterSecretStore usage\ + \ and rendered Secret keys in a non-prod environment before rolling out."] chart_version: 0.5.9 - images: - - ghcr.io/external-secrets/external-secrets:v0.5.9 + images: ['ghcr.io/external-secrets/external-secrets:v0.5.9'] - version: 0.4.4 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'v0.3.11: Added ability to provide a custom CA for the Yandex Lockbox provider.' - - 'v0.3.11: Updated the project to Go 1.17 and included various minor fixes.' - - 'v0.4.4: Patch release focused on security updates plus minor documentation - improvements (AWS custom endpoints, template snippet fix).' - - 'v0.4.4: Dependency bumps including controller-runtime 0.11.1 and updates - to Google Secret Manager/IAM and other libraries.' + features: ['v0.3.11: Added ability to provide a custom CA for the Yandex Lockbox + provider.', 'v0.3.11: Updated the project to Go 1.17 and included various + minor fixes.', 'v0.4.4: Patch release focused on security updates plus minor + documentation improvements (AWS custom endpoints, template snippet fix).', + 'v0.4.4: Dependency bumps including controller-runtime 0.11.1 and updates + to Google Secret Manager/IAM and other libraries.'] breaking_changes: [] chart_version: 0.4.4 - images: - - ghcr.io/external-secrets/external-secrets:v0.4.4 + images: ['ghcr.io/external-secrets/external-secrets:v0.4.4'] - version: 0.3.11 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null chart_version: 0.3.11 - images: - - ghcr.io/external-secrets/external-secrets:v0.3.11 - name: external-secrets + images: ['ghcr.io/external-secrets/external-secrets:v0.3.11'] - icon: https://avatars.githubusercontent.com/u/52158677?s=200&v=4 git_url: https://github.com/fluxcd/flux2 release_url: https://github.com/fluxcd/flux2/releases/tag/v{vsn} @@ -21630,53 +17666,28 @@ addons: eolApiSlug: flux versions: - version: 2.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' + kube: ['1.36', '1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null - version: 2.8.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' + kube: ['1.36', '1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null - version: 2.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null - version: 2.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null eolAt: '2026-06-30' - version: 2.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null @@ -21688,82 +17699,58 @@ addons: helm_repository_url: https://kubernetes.github.io/ingress-nginx versions: - version: 1.15.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'Controller image updates only: controller v1.15.1 (new digests) and related - build pipeline bumps.' - - 'Template change: remove path from a generated comment (cosmetic; no behavior - change expected).' - - 'CI/tooling refresh: Kubernetes test version to v1.35.3, Helm to v4.1.3, Test - Runner to v2.2.9, plus Go dependency updates and rebuilt side images.' + chart_updates: ['Controller image updates only: controller v1.15.1 (new digests) + and related build pipeline bumps.', 'Template change: remove path from a + generated comment (cosmetic; no behavior change expected).', 'CI/tooling + refresh: Kubernetes test version to v1.35.3, Helm to v4.1.3, Test Runner + to v2.2.9, plus Go dependency updates and rebuilt side images.'] features: [] breaking_changes: [] chart_version: 4.15.1 - images: - - registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd + images: ['registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd'] - version: 1.15.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Template hardening/quoting improvements: quote all `location`/`server_name` - directives (and escape quotes/backslashes) and quote `proxy_pass` to reduce - config-generation edge cases.' - - 'Admission controller tweaks: remove an obsolete error log; set admission - controller request size/limit to 9MB.' - - 'Controller behavior fixes: host/path overlap detection for multiple rules; - sync resiliency when node clock jumps to the future; avoid panic when `cpu.max` - is empty.' - - 'SSL/TLS passthrough & PROXY protocol: enable SSL passthrough earlier when - requested for HTTP-only hosts; use 4KiB buffers for PROXY protocol parsing - in TLS passthrough.' - - 'Annotations validation: tighter regex for `proxy-cookie-domain`; add anchors - to auth method regex; consider aliases in risk evaluation.' - - "Images/toolchain bumps: NGINX image to v2.2.5\u2013v2.2.8 across the series;\ - \ Alpine base to v3.23.x; Go runtime to v1.26.1 (and incremental 1.25.x bumps)." - - 'Docs/Project status: documentation updated to highlight retirement; PROXY - protocol limitation on GKE default load balancer clarified.' - features: - - Improved safety and correctness of generated NGINX config via broader quoting/escaping - in templates, reducing potential misparsing with special characters. - - More robust SSL passthrough/PROXY protocol handling in TLS passthrough mode - (buffer sizing and enabling behavior). - - Better annotation validation/interpretation (cookie domain regex, auth method - anchors, alias-aware risk evaluation). - breaking_changes: - - Project retirement notices were added; while not a code-breaking change, it - impacts long-term support planning and should be treated as an upgrade consideration. - - Template quoting/escaping changes can alter the rendered NGINX configuration; - if you rely on unusual `server_name`, `location`, or upstream formats, validate - rendered config and behavior in staging. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Template hardening/quoting improvements: quote all `location`/`server_name` + directives (and escape quotes/backslashes) and quote `proxy_pass` to reduce + config-generation edge cases.', 'Admission controller tweaks: remove an + obsolete error log; set admission controller request size/limit to 9MB.', + 'Controller behavior fixes: host/path overlap detection for multiple rules; + sync resiliency when node clock jumps to the future; avoid panic when `cpu.max` + is empty.', 'SSL/TLS passthrough & PROXY protocol: enable SSL passthrough + earlier when requested for HTTP-only hosts; use 4KiB buffers for PROXY protocol + parsing in TLS passthrough.', 'Annotations validation: tighter regex for + `proxy-cookie-domain`; add anchors to auth method regex; consider aliases + in risk evaluation.', "Images/toolchain bumps: NGINX image to v2.2.5\u2013\ + v2.2.8 across the series; Alpine base to v3.23.x; Go runtime to v1.26.1\ + \ (and incremental 1.25.x bumps).", 'Docs/Project status: documentation + updated to highlight retirement; PROXY protocol limitation on GKE default + load balancer clarified.'] + features: ['Improved safety and correctness of generated NGINX config via broader + quoting/escaping in templates, reducing potential misparsing with special + characters.', More robust SSL passthrough/PROXY protocol handling in TLS + passthrough mode (buffer sizing and enabling behavior)., 'Better annotation + validation/interpretation (cookie domain regex, auth method anchors, alias-aware + risk evaluation).'] + breaking_changes: ['Project retirement notices were added; while not a code-breaking + change, it impacts long-term support planning and should be treated as an + upgrade consideration.', 'Template quoting/escaping changes can alter the + rendered NGINX configuration; if you rely on unusual `server_name`, `location`, + or upstream formats, validate rendered config and behavior in staging.'] chart_version: 4.15.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.15.0@sha256:4eea9a4cc2cb6ddcb7da14d377aaf452e68bd3dbe87fe280755d225c4d5e7e4e - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.8@sha256:d7e8257f8d8bce64b6df55f81fba92011a6a77269b3350f8b997b152af348dba + images: ['registry.k8s.io/ingress-nginx/controller:v1.15.0@sha256:4eea9a4cc2cb6ddcb7da14d377aaf452e68bd3dbe87fe280755d225c4d5e7e4e', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.8@sha256:d7e8257f8d8bce64b6df55f81fba92011a6a77269b3350f8b997b152af348dba'] - version: 1.14.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -21803,45 +17790,33 @@ addons: \ changelog for the chart version you\u2019ll actually upgrade to (e.g., v4.13.x\ \ \u2192 v4.14.x). Before executing the upgrade, also review the **chart release\ \ notes** for the exact chart versions in use." - chart_updates: - - Controller image updated to v1.14.0 (and chroot variant), including NGINX - base bumps to v2.2.x and Alpine base bumps (3.22.x). - - 'Status handling improved: supports multiple Node IP addresses when publishing - ingress status.' - - 'Admission/webhook and chart plumbing updated: extra init containers are templatable; - webhook patch job gains volumes; new ServiceMonitor scrapeTimeout knob; resize - policy support; chart distribution via OCI.' - - 'Security and robustness improvements: panic handling in service deletion - handler; hardened socket creation; path validation nil-pointer fix; stronger - cipher preference ordering.' - features: - - SSL Proxy now supports **PROXY protocol v2**, enabling richer client connection - metadata when running behind compatible load balancers/proxies. - - Ingress status reporting can now handle **multiple node IPs**, improving correctness - on multi-NIC / multi-address nodes. - - Ingress path validation now allows a `.` character in `Exact` and `Prefix` - paths, expanding valid routing patterns. - - Chart adds optional `ServiceMonitor` `scrapeTimeout` configuration for Prometheus - Operator users. - breaking_changes: - - 'Removal of a default value: `proxy-busy-buffers-size` default was removed - (and related fixes followed). If you relied on the old implicit default, set - it explicitly in the ConfigMap/values to preserve behavior.' - - "\u201CBye bye, v1.11.\u201D indicates end-of-support for older Kubernetes/legacy\ - \ compatibility paths (exact minimum supported Kubernetes not stated in your\ - \ paste). Validate your cluster version meets the supported matrix for controller\ - \ v1.14.0 before upgrading." + chart_updates: ['Controller image updated to v1.14.0 (and chroot variant), including + NGINX base bumps to v2.2.x and Alpine base bumps (3.22.x).', 'Status handling + improved: supports multiple Node IP addresses when publishing ingress status.', + 'Admission/webhook and chart plumbing updated: extra init containers are templatable; + webhook patch job gains volumes; new ServiceMonitor scrapeTimeout knob; + resize policy support; chart distribution via OCI.', 'Security and robustness + improvements: panic handling in service deletion handler; hardened socket + creation; path validation nil-pointer fix; stronger cipher preference ordering.'] + features: ['SSL Proxy now supports **PROXY protocol v2**, enabling richer client + connection metadata when running behind compatible load balancers/proxies.', + 'Ingress status reporting can now handle **multiple node IPs**, improving + correctness on multi-NIC / multi-address nodes.', 'Ingress path validation + now allows a `.` character in `Exact` and `Prefix` paths, expanding valid + routing patterns.', Chart adds optional `ServiceMonitor` `scrapeTimeout` + configuration for Prometheus Operator users.] + breaking_changes: ['Removal of a default value: `proxy-busy-buffers-size` default + was removed (and related fixes followed). If you relied on the old implicit + default, set it explicitly in the ConfigMap/values to preserve behavior.', + "\u201CBye bye, v1.11.\u201D indicates end-of-support for older Kubernetes/legacy\ + \ compatibility paths (exact minimum supported Kubernetes not stated in\ + \ your paste). Validate your cluster version meets the supported matrix\ + \ for controller v1.14.0 before upgrading."] chart_version: 4.14.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:e4127065d0317bd11dc64c4dd38dcf7fb1c3d72e468110b4086e636dbaac943d - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4@sha256:bcfc926ed57831edf102d62c5c0e259572591df4796ef1420b87f9cf6092497f + images: ['registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:e4127065d0317bd11dc64c4dd38dcf7fb1c3d72e468110b4086e636dbaac943d', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4@sha256:bcfc926ed57831edf102d62c5c0e259572591df4796ef1420b87f9cf6092497f'] - version: 1.13.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -21881,56 +17856,43 @@ addons: \ values after the ServiceMonitor rework.\n- If you used PSP, remove PSP-related\ \ values/resources and ensure PSA policies allow the controller to run.\n\ - If you used OTel via init container/image, migrate to built-in module configuration.\n" - chart_updates: - - Controller image updated from v1.12.0 to v1.13.0 (new controller and chroot - images). - - NGINX/OpenResty base updated (OpenResty bumped to v1.27.1.x; NGINX base and - related images bumped through 2.x series). - - 'Chart additions: `controller.service.trafficDistribution`, service labels - for external/internal services, `runtimeClassName`, `activeDeadlineSeconds`, - and cert-manager admission webhook revisionHistoryLimit settings.' - - 'Chart maintenance: removed validation for an already-removed API; multiple - bumps of kube-webhook-certgen and test runner images.' - - Ongoing security and dependency updates (Go toolchain bumped to 1.24.x in - v1.13.0 line; controller includes several security fixes in 1.12.x). - features: - - Traffic distribution support added to the controller (and exposed via chart - value `controller.service.trafficDistribution`). - - NGINX now adds an `X-Original-Forwarded-Host` header to preserve the original - forwarded host. - - Improved client IP determination in NGINX for more accurate real client address - handling. - - NJS (NGINX JavaScript) support added to the NGINX build used by ingress-nginx. - - 'Annotations/security hardening: deny newlines in annotations; reload on custom - header changes (improves correctness when headers are updated).' - breaking_changes: - - Metrics are disabled by default (`--enable-metrics` now defaults to false). - If you scrape controller metrics, you must explicitly re-enable them via Helm - values/args. - - 'Security defaults were tightened in the 1.12 line: annotation validation - enabled by default, cross-namespace resources disallowed by default, stricter - path type validation enabled. This can break previously-working but unsafe - configurations.' - - Global rate limit feature was removed (config keys and related annotations - no longer exist). Any Ingress using those annotations will stop working as - intended. - - Third-party Lua plugin support was removed (`plugins` config and `/etc/nginx/lua/plugins` - loading). If you relied on custom Lua plugins, they will no longer be executed. - - PodSecurityPolicy resources were removed from the Helm chart; clusters depending - on PSP must migrate to PSA/other policy mechanisms. - - OpenTelemetry init container/image was removed from the deployment packaging; - OTel must be configured using the built-in module approach. + chart_updates: [Controller image updated from v1.12.0 to v1.13.0 (new controller + and chroot images)., NGINX/OpenResty base updated (OpenResty bumped to v1.27.1.x; + NGINX base and related images bumped through 2.x series)., 'Chart additions: + `controller.service.trafficDistribution`, service labels for external/internal + services, `runtimeClassName`, `activeDeadlineSeconds`, and cert-manager + admission webhook revisionHistoryLimit settings.', 'Chart maintenance: removed + validation for an already-removed API; multiple bumps of kube-webhook-certgen + and test runner images.', Ongoing security and dependency updates (Go toolchain + bumped to 1.24.x in v1.13.0 line; controller includes several security fixes + in 1.12.x).] + features: [Traffic distribution support added to the controller (and exposed + via chart value `controller.service.trafficDistribution`)., NGINX now adds + an `X-Original-Forwarded-Host` header to preserve the original forwarded + host., Improved client IP determination in NGINX for more accurate real + client address handling., NJS (NGINX JavaScript) support added to the NGINX + build used by ingress-nginx., 'Annotations/security hardening: deny newlines + in annotations; reload on custom header changes (improves correctness when + headers are updated).'] + breaking_changes: ['Metrics are disabled by default (`--enable-metrics` now + defaults to false). If you scrape controller metrics, you must explicitly + re-enable them via Helm values/args.', 'Security defaults were tightened + in the 1.12 line: annotation validation enabled by default, cross-namespace + resources disallowed by default, stricter path type validation enabled. + This can break previously-working but unsafe configurations.', Global rate + limit feature was removed (config keys and related annotations no longer + exist). Any Ingress using those annotations will stop working as intended., + 'Third-party Lua plugin support was removed (`plugins` config and `/etc/nginx/lua/plugins` + loading). If you relied on custom Lua plugins, they will no longer be executed.', + PodSecurityPolicy resources were removed from the Helm chart; clusters depending + on PSP must migrate to PSA/other policy mechanisms., OpenTelemetry init + container/image was removed from the deployment packaging; OTel must be + configured using the built-in module approach.] chart_version: 4.13.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.13.0@sha256:dc75a7baec7a3b827a5d7ab0acd10ab507904c7dad692365b3e3b596eca1afd2 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0@sha256:c9f76a75fd00e975416ea1b73300efd413116de0de8570346ed90766c5b5cefb + images: ['registry.k8s.io/ingress-nginx/controller:v1.13.0@sha256:dc75a7baec7a3b827a5d7ab0acd10ab507904c7dad692365b3e3b596eca1afd2', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0@sha256:c9f76a75fd00e975416ea1b73300efd413116de0de8570346ed90766c5b5cefb'] - version: 1.12.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -21967,52 +17929,37 @@ addons: \ behavior.\n\n### 8) Chart cleanup\n- Chart: Remove `isControllerTagValid`\ \ (internal chart validation).\n\n**Action:** if you had automation relying\ \ on that value, remove it from your values file.\n" - chart_updates: - - Metrics now disabled by default (controller flag default change). - - Controller image updated to v1.12.0; underlying base images bumped (notably - Alpine 3.21) and Go toolchain updates. - - 'Chart includes several operational enhancements: ServiceMonitor rework, more - unit tests, topology spread guidance, PDB alignment, and rollout deadline - option.' - - Security posture changes ship with 1.12.0 (annotation validation on by default, - stricter defaults). - features: - - Native histogram support for histogram metrics (improves Prometheus histogram - handling when enabled). - - New `--metrics-per-undefined-host` option to control metrics cardinality for - undefined hosts. - - CORS origins now allow any protocol (more flexible CORS configuration). - - New docs/guides added (e.g., maintenance page, Pod Security Admission, AWS - health check annotations). - breaking_changes: - - Metrics are disabled by default (`--enable-metrics` now defaults to false); - you must explicitly enable if you scrape metrics. - - "Security defaults tightened: annotation validation enabled by default; `allow-cross-namespace-resources`\ - \ disabled by default; `strict-validate-path-type` enabled by default; default\ - \ `annotations-risk-level` lowered to High\u2014this can cause previously-accepted\ - \ Ingresses/annotations to be rejected." - - Global rate limit feature removed (config keys and related annotations removed); - remove any usage before upgrading. - - 3rd-party Lua plugin support removed (the `plugins` config option and `/etc/nginx/lua/plugins` - user plugin mechanism no longer works). - - PodSecurityPolicy resources removed from the Helm chart; clusters depending - on PSP must migrate to PSA/other controls. - - s390x image support dropped; cannot run controller on s390x nodes. - - Metric `ingress_upstream_latency_seconds` removed; dashboards/alerts must - be updated if they reference it. - - OpenTelemetry init container/image removed from the chart; if you relied on - it, update your values and validate OTel configuration. + chart_updates: [Metrics now disabled by default (controller flag default change)., + Controller image updated to v1.12.0; underlying base images bumped (notably + Alpine 3.21) and Go toolchain updates., 'Chart includes several operational + enhancements: ServiceMonitor rework, more unit tests, topology spread guidance, + PDB alignment, and rollout deadline option.', 'Security posture changes + ship with 1.12.0 (annotation validation on by default, stricter defaults).'] + features: [Native histogram support for histogram metrics (improves Prometheus + histogram handling when enabled)., New `--metrics-per-undefined-host` option + to control metrics cardinality for undefined hosts., CORS origins now allow + any protocol (more flexible CORS configuration)., 'New docs/guides added + (e.g., maintenance page, Pod Security Admission, AWS health check annotations).'] + breaking_changes: [Metrics are disabled by default (`--enable-metrics` now defaults + to false); you must explicitly enable if you scrape metrics., "Security\ + \ defaults tightened: annotation validation enabled by default; `allow-cross-namespace-resources`\ + \ disabled by default; `strict-validate-path-type` enabled by default; default\ + \ `annotations-risk-level` lowered to High\u2014this can cause previously-accepted\ + \ Ingresses/annotations to be rejected.", Global rate limit feature removed + (config keys and related annotations removed); remove any usage before upgrading., + 3rd-party Lua plugin support removed (the `plugins` config option and `/etc/nginx/lua/plugins` + user plugin mechanism no longer works)., PodSecurityPolicy resources removed + from the Helm chart; clusters depending on PSP must migrate to PSA/other + controls., s390x image support dropped; cannot run controller on s390x nodes., + Metric `ingress_upstream_latency_seconds` removed; dashboards/alerts must + be updated if they reference it., 'OpenTelemetry init container/image removed + from the chart; if you relied on it, update your values and validate OTel + configuration.'] chart_version: 4.12.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 + images: ['registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4'] - version: 1.11.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -22036,47 +17983,31 @@ addons: \ and scaling objects after upgrade.\n- **Default backend:** topologySpreadConstraints\ \ support and related unit tests. If you run the default backend, confirm\ \ scheduling behavior matches expectations." - chart_updates: - - 'Chart: Remove `controller.enableWorkerSerialReloads`.' - - 'Chart: Make `controller.config` templatable.' - - 'Chart: Make pod affinity templatable.' - - 'Chart: Fix `IngressClass` annotations.' - - 'Chart: Make admission webhook patch job RBAC configurable.' - - 'Chart: Accept user-defined annotations in IngressClass; add IngressClass - aliases.' - - 'Chart: Render `controller.ingressClassResource.parameters` natively.' - - 'Chart: Align HPA & KEDA conditions; deploy PDB with KEDA.' - - 'Default backend: add topologySpreadConstraints support and sort HPA metrics.' - features: - - NGINX bumped to 1.25.5 and HTTP/3 module added (new capability; requires QUIC/UDP - 443 exposure and client support). - - New annotations for gRPC timeouts, plus ConfigMap support for gRPC buffer - size. - - New annotation allowing custom response headers to be added. - - GeoIP2 auto_reload configuration support. - - 'Leader election improvements: TTL configurable and option/flag to disable - leader election.' - breaking_changes: - - 'Do **not** use controller v1.11.0 with **OCSP stapling enabled** due to a - known serious issue; use a patched 1.11.x release containing the fix (referenced - PR #11594) instead.' - - Chart value `controller.enableWorkerSerialReloads` was removed; upgrades will - fail lint/templating if your values still reference it. - - 'TLS hardening change: TLSv1 and TLSv1.1 were removed; clients requiring those - protocols will no longer connect.' - - Minimum Kubernetes version requirement is stated as 1.21; clusters older than - that are unsupported. + chart_updates: ['Chart: Remove `controller.enableWorkerSerialReloads`.', 'Chart: + Make `controller.config` templatable.', 'Chart: Make pod affinity templatable.', + 'Chart: Fix `IngressClass` annotations.', 'Chart: Make admission webhook patch + job RBAC configurable.', 'Chart: Accept user-defined annotations in IngressClass; + add IngressClass aliases.', 'Chart: Render `controller.ingressClassResource.parameters` + natively.', 'Chart: Align HPA & KEDA conditions; deploy PDB with KEDA.', + 'Default backend: add topologySpreadConstraints support and sort HPA metrics.'] + features: [NGINX bumped to 1.25.5 and HTTP/3 module added (new capability; requires + QUIC/UDP 443 exposure and client support)., 'New annotations for gRPC timeouts, + plus ConfigMap support for gRPC buffer size.', New annotation allowing custom + response headers to be added., GeoIP2 auto_reload configuration support., + 'Leader election improvements: TTL configurable and option/flag to disable + leader election.'] + breaking_changes: ['Do **not** use controller v1.11.0 with **OCSP stapling enabled** + due to a known serious issue; use a patched 1.11.x release containing the + fix (referenced PR #11594) instead.', Chart value `controller.enableWorkerSerialReloads` + was removed; upgrades will fail lint/templating if your values still reference + it., 'TLS hardening change: TLSv1 and TLSv1.1 were removed; clients requiring + those protocols will no longer connect.', Minimum Kubernetes version requirement + is stated as 1.21; clusters older than that are unsupported.] chart_version: 4.11.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.11.0@sha256:a886e56d532d1388c77c8340261149d974370edca1093af4c97a96fb1467cb39 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366 + images: ['registry.k8s.io/ingress-nginx/controller:v1.11.0@sha256:a886e56d532d1388c77c8340261149d974370edca1093af4c97a96fb1467cb39', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366'] - version: 1.10.1 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -22093,117 +18024,85 @@ addons: \ confirm this doesn\u2019t conflict with any existing PDBs you manage.\n\ - No explicit required values changes were called out for 1.10.1 specifically;\ \ most 1.10.1 chart items are tests/docs/CI." - chart_updates: - - 'Chart: Render `controller.ingressClassResource.parameters` natively.' - - 'Chart: Align HPA & KEDA conditions.' - - 'Chart: Deploy `PodDisruptionBudget` with KEDA enabled.' - - 'Chart: Improve IngressClass documentation.' - - 'Chart: Add unit tests for default backend & topology spread constraints; - sort default backend HPA metrics (no functional change expected).' - features: - - Reintroduced/available **chroot controller image** in v1.10.1 (`controller-chroot:v1.10.1`), - addressing the 1.10.0 note that chroot was not supported. - - Improved admission controller logging to include `admissionTime` and `testedConfigurationSize` - for better troubleshooting. - breaking_changes: - - 'From **v1.10.0** (still relevant when upgrading to 1.10.1): chroot image - was not supported in 1.10.0 (fixed in 1.10.1).' - - 'From **v1.10.0**: Opentracing and Zipkin modules were removed; only OpenTelemetry - is supported.' - - 'From **v1.10.0**: PodSecurityPolicy support was dropped.' - - 'From **v1.10.0**: Legacy GeoIP was dropped; only GeoIP2 is supported.' + chart_updates: ['Chart: Render `controller.ingressClassResource.parameters` + natively.', 'Chart: Align HPA & KEDA conditions.', 'Chart: Deploy `PodDisruptionBudget` + with KEDA enabled.', 'Chart: Improve IngressClass documentation.', 'Chart: + Add unit tests for default backend & topology spread constraints; sort default + backend HPA metrics (no functional change expected).'] + features: ['Reintroduced/available **chroot controller image** in v1.10.1 (`controller-chroot:v1.10.1`), + addressing the 1.10.0 note that chroot was not supported.', Improved admission + controller logging to include `admissionTime` and `testedConfigurationSize` + for better troubleshooting.] + breaking_changes: ['From **v1.10.0** (still relevant when upgrading to 1.10.1): + chroot image was not supported in 1.10.0 (fixed in 1.10.1).', 'From **v1.10.0**: + Opentracing and Zipkin modules were removed; only OpenTelemetry is supported.', + 'From **v1.10.0**: PodSecurityPolicy support was dropped.', 'From **v1.10.0**: + Legacy GeoIP was dropped; only GeoIP2 is supported.'] chart_version: 4.10.1 - images: - - registry.k8s.io/ingress-nginx/controller:v1.10.1@sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366 + images: ['registry.k8s.io/ingress-nginx/controller:v1.10.1@sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.1@sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366'] - version: 1.10.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '**Chart behavior change (metrics flag):** The Helm chart now sets the controller - argument `--enable-metrics` based on `controller.metrics.enabled` (instead - of always/never or requiring manual extraArgs). This came in via PR #10959.' - - '**kube-webhook image tag fix:** Chart/release fixes the `kube-webhook-certgen` - image tag handling (PR #11033/#11034).' - - '**PrometheusRule manifest updated:** `controller-prometheusrules.yaml` updated - (PR #8902), which can change the resulting PrometheusRule resources if you - enable them.' - features: - - '**NGINX upgraded to 1.25:** Controller now ships with NGINX 1.25, bringing - the upstream NGINX changes/perf/security updates with it.' - - '**OCSP responder improvements:** Proper support for a TLS-wrapped OCSP responder, - improving TLS/OCSP stapling edge cases.' - - '**Annotation completeness:** Adds a missing `backend-protocol` annotation - option, improving compatibility with certain backend protocols/configs.' - - '**Dashboard/monitoring fixes:** Grafana dashboard datasource/exported namespace - variable fixes and updated Prometheus rules improve observability out of the - box.' - breaking_changes: - - '**No chroot image in 1.10.0:** The `controller-chroot` image is not supported - in this release (promised to return in a later minor patch).' - - '**Tracing modules removed:** OpenTracing and Zipkin NGINX modules were dropped; - only OpenTelemetry is supported moving forward.' - - '**PodSecurityPolicy removed:** PSP support is dropped; clusters relying on - PSP manifests/values must migrate to alternatives (e.g., PSA + RBAC).' - - '**Legacy GeoIP removed:** GeoIP (legacy) support is dropped; only GeoIP2 - is supported.' + kube: ['1.29', '1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['**Chart behavior change (metrics flag):** The Helm chart now + sets the controller argument `--enable-metrics` based on `controller.metrics.enabled` + (instead of always/never or requiring manual extraArgs). This came in via + PR #10959.', '**kube-webhook image tag fix:** Chart/release fixes the `kube-webhook-certgen` + image tag handling (PR #11033/#11034).', '**PrometheusRule manifest updated:** + `controller-prometheusrules.yaml` updated (PR #8902), which can change the + resulting PrometheusRule resources if you enable them.'] + features: ['**NGINX upgraded to 1.25:** Controller now ships with NGINX 1.25, + bringing the upstream NGINX changes/perf/security updates with it.', '**OCSP + responder improvements:** Proper support for a TLS-wrapped OCSP responder, + improving TLS/OCSP stapling edge cases.', '**Annotation completeness:** + Adds a missing `backend-protocol` annotation option, improving compatibility + with certain backend protocols/configs.', '**Dashboard/monitoring fixes:** + Grafana dashboard datasource/exported namespace variable fixes and updated + Prometheus rules improve observability out of the box.'] + breaking_changes: ['**No chroot image in 1.10.0:** The `controller-chroot` image + is not supported in this release (promised to return in a later minor patch).', + '**Tracing modules removed:** OpenTracing and Zipkin NGINX modules were dropped; + only OpenTelemetry is supported moving forward.', '**PodSecurityPolicy removed:** + PSP support is dropped; clusters relying on PSP manifests/values must migrate + to alternatives (e.g., PSA + RBAC).', '**Legacy GeoIP removed:** GeoIP (legacy) + support is dropped; only GeoIP2 is supported.'] chart_version: 4.10.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.10.0@sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334 + images: ['registry.k8s.io/ingress-nginx/controller:v1.10.0@sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334'] - version: 1.9.6 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Controller image changed from v1.9.0 to v1.9.6 (and corresponding chroot image - digest). - - Admission webhook cert generator updated to a newer release (v20231226-1a7112e06). - - 'Annotation validation tightened: regex validation added for the common-name - annotation; SSL cipher list validation expanded to include SECLEVEL and STRENGTH.' - - ModSecurity library version updated to 3.0.11. - - "Dependency bump: runc 1.1.10 \u2192 1.1.11." - - 'From 1.9.0 baseline: user snippets are disabled by default; controller base - image no longer includes curl; annotation validation framework introduced. - These are the main behavior-impacting changes to be aware of when moving off - 1.9.0.' - features: - - Stricter and more complete validation for annotations (including regex checks - and SSL cipher list fields), reducing risk of invalid config reaching NGINX. - - Updated admission webhook cert generation tooling, improving compatibility - and maintenance. - - Updated ModSecurity library version (3.0.11) for security/stability fixes. - breaking_changes: - - User-provided NGINX snippets are disabled by default starting in 1.9.0; any - Ingress relying on snippet annotations will stop working unless you explicitly - re-enable snippets via controller configuration/values. - - The controller image no longer includes curl (since 1.9.0); any custom scripts, - sidecars, or debug workflows that exec into the controller pod expecting curl - will fail. + kube: ['1.29', '1.28', '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Controller image changed from v1.9.0 to v1.9.6 (and corresponding + chroot image digest)., Admission webhook cert generator updated to a newer + release (v20231226-1a7112e06)., 'Annotation validation tightened: regex + validation added for the common-name annotation; SSL cipher list validation + expanded to include SECLEVEL and STRENGTH.', ModSecurity library version + updated to 3.0.11., "Dependency bump: runc 1.1.10 \u2192 1.1.11.", 'From + 1.9.0 baseline: user snippets are disabled by default; controller base image + no longer includes curl; annotation validation framework introduced. These + are the main behavior-impacting changes to be aware of when moving off 1.9.0.'] + features: ['Stricter and more complete validation for annotations (including + regex checks and SSL cipher list fields), reducing risk of invalid config + reaching NGINX.', 'Updated admission webhook cert generation tooling, improving + compatibility and maintenance.', Updated ModSecurity library version (3.0.11) + for security/stability fixes.] + breaking_changes: [User-provided NGINX snippets are disabled by default starting + in 1.9.0; any Ingress relying on snippet annotations will stop working unless + you explicitly re-enable snippets via controller configuration/values., + 'The controller image no longer includes curl (since 1.9.0); any custom scripts, + sidecars, or debug workflows that exec into the controller pod expecting + curl will fail.'] chart_version: 4.9.1 - images: - - registry.k8s.io/ingress-nginx/controller:v1.9.6@sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231226-1a7112e06@sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084 + images: ['registry.k8s.io/ingress-nginx/controller:v1.9.6@sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231226-1a7112e06@sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084'] - version: 1.9.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -22219,85 +18118,62 @@ addons: \ for Deployment/DaemonSet; if you set this, validate it renders as expected.\n\ - **KEDA interaction**: If you enable KEDA, the chart will ignore the Deployment\ \ template `replicas` field (replicas controlled by KEDA)." - chart_updates: - - Controller image updated from `registry.k8s.io/ingress-nginx/controller:v1.8.4` - to `v1.9.0` (and chroot variant accordingly). - - Base container image changed to remove `curl` (impacts any custom scripts/exec - probes relying on curl inside the controller container). - - AJP support was deprecated/removed in the 1.9.0 line (do not rely on AJP module). - - OpenTelemetry libs updated (OTel 1.11.0, gRPC updates) and Go bumped to 1.21.1 - (mostly build/runtime dependency changes). - features: - - User snippets are now **disabled by default**, improving security; they must - be explicitly enabled if you use snippet annotations. - - Ingress annotation validation was implemented; invalid annotations may now - be rejected or warned about instead of being silently accepted. - - "Optional auth access logs support (can reduce log volume if you don\u2019\ - t need auth subrequest logs)." - - New controller flag to enable/disable `aio_write` (advanced NGINX performance - tuning). - - 'Helm chart improvements: configurable `hostAliases`, templated service annotations - via `tpl`, and support for `topologySpreadConstraints` in Deployment/DaemonSet.' - breaking_changes: - - '**User snippets disabled by default**: if you use `nginx.ingress.kubernetes.io/*-snippet` - annotations, behavior will change until you explicitly re-enable snippets - in config.' - - '**`curl` removed from the controller image**: any in-container debugging, - init scripts, or exec probes that call `curl` will fail unless you add your - own tooling.' - - '**AJP support removed**: if you relied on AJP, you must migrate to HTTP/HTTPS - (or another supported protocol) before upgrading.' - - Annotation validation may cause previously-working but non-conformant annotations - to be rejected or ignored; test your Ingress manifests against the new validation - behavior. + chart_updates: ['Controller image updated from `registry.k8s.io/ingress-nginx/controller:v1.8.4` + to `v1.9.0` (and chroot variant accordingly).', Base container image changed + to remove `curl` (impacts any custom scripts/exec probes relying on curl + inside the controller container)., AJP support was deprecated/removed in + the 1.9.0 line (do not rely on AJP module)., 'OpenTelemetry libs updated + (OTel 1.11.0, gRPC updates) and Go bumped to 1.21.1 (mostly build/runtime + dependency changes).'] + features: ['User snippets are now **disabled by default**, improving security; + they must be explicitly enabled if you use snippet annotations.', Ingress + annotation validation was implemented; invalid annotations may now be rejected + or warned about instead of being silently accepted., "Optional auth access\ + \ logs support (can reduce log volume if you don\u2019t need auth subrequest\ + \ logs).", New controller flag to enable/disable `aio_write` (advanced NGINX + performance tuning)., 'Helm chart improvements: configurable `hostAliases`, + templated service annotations via `tpl`, and support for `topologySpreadConstraints` + in Deployment/DaemonSet.'] + breaking_changes: ['**User snippets disabled by default**: if you use `nginx.ingress.kubernetes.io/*-snippet` + annotations, behavior will change until you explicitly re-enable snippets + in config.', '**`curl` removed from the controller image**: any in-container + debugging, init scripts, or exec probes that call `curl` will fail unless + you add your own tooling.', '**AJP support removed**: if you relied on AJP, + you must migrate to HTTP/HTTPS (or another supported protocol) before upgrading.', + Annotation validation may cause previously-working but non-conformant annotations + to be rejected or ignored; test your Ingress manifests against the new validation + behavior.] chart_version: 4.8.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + images: ['registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b'] - version: 1.8.4 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Controller image updated from v1.7.1 to v1.8.4 (and chroot variant), including - intermediary 1.8.x patch releases. - - Go toolchain updated in the 1.8.x line (notably to Go 1.21.1). - - Auth access logging made optional (newer controller behavior/config surface). - - ModSecurity internal processing disabled in a way intended to improve handling - of large Ingress objects. - - OpenTelemetry init image promoted to distroless; image tagging/metadata process - updated. - - AJP module re-added as a dynamic module (affects those using AJP). - - Dependency bumps (e.g., golang.org/x/net) and assorted image bumps. - features: - - "Optional auth access logs, allowing you to reduce log volume/cost if you\ - \ don\u2019t need per-request auth logging." - - Improved behavior for large Ingress resources by changing how ModSecurity - is handled internally. - - Distroless OpenTelemetry init image promotion, which can improve security - posture and reduce image surface area. - - AJP support available again via a dynamic module for environments that still - rely on AJP upstreams. - breaking_changes: - - No explicit breaking changes are called out in the provided notes; however, - expect behavioral differences due to ModSecurity handling changes and auth - log defaults if you relied on previous implicit behavior. + kube: ['1.27', '1.26', '1.25', '1.24'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Controller image updated from v1.7.1 to v1.8.4 (and chroot + variant), including intermediary 1.8.x patch releases.', Go toolchain updated + in the 1.8.x line (notably to Go 1.21.1)., Auth access logging made optional + (newer controller behavior/config surface)., ModSecurity internal processing + disabled in a way intended to improve handling of large Ingress objects., + OpenTelemetry init image promoted to distroless; image tagging/metadata process + updated., AJP module re-added as a dynamic module (affects those using AJP)., + 'Dependency bumps (e.g., golang.org/x/net) and assorted image bumps.'] + features: ["Optional auth access logs, allowing you to reduce log volume/cost\ + \ if you don\u2019t need per-request auth logging.", Improved behavior for + large Ingress resources by changing how ModSecurity is handled internally., + 'Distroless OpenTelemetry init image promotion, which can improve security + posture and reduce image surface area.', AJP support available again via + a dynamic module for environments that still rely on AJP upstreams.] + breaking_changes: ['No explicit breaking changes are called out in the provided + notes; however, expect behavioral differences due to ModSecurity handling + changes and auth log defaults if you relied on previous implicit behavior.'] chart_version: 4.7.3 - images: - - registry.k8s.io/ingress-nginx/controller:v1.8.4@sha256:8d8ddf32b83ca3e74bd5f66369fa60d85353e18ff55fa7691b321aa4716f5ba9 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 + images: ['registry.k8s.io/ingress-nginx/controller:v1.8.4@sha256:8d8ddf32b83ca3e74bd5f66369fa60d85353e18ff55fa7691b321aa4716f5ba9', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80'] - version: 1.7.1 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' + kube: ['1.27', '1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -22314,36 +18190,26 @@ addons: \ notes, but you should diff your current `values.yaml` against the target\ \ chart\u2019s `values.yaml` for new defaults around metrics, admission, and\ \ service configuration._" - chart_updates: - - 'Add support for custom port configuration for the controller internal service - (PR #9846).' - - 'Adjust default HPA configuration to include explicit resource type to avoid - issues with Terraform Helm usage (PR #9803).' - - 'FastCGI ConfigMap is expected to be in the same namespace as the ingress - controller (PR #9863).' - - Docs/README updates and formatting fixes (multiple PRs). - features: - - Support a new `--container` flag for the controller, improving flexibility - in container/runtime-related scenarios. - - "Helm chart can now customize ports on the controller\u2019s internal Service,\ - \ enabling non-default port mappings when needed." - - HPA defaults were made more explicit to improve compatibility with Terraform-managed - Helm deployments. - breaking_changes: - - "InfluxDB support was deprecated and removed; if you were exporting metrics\ - \ to InfluxDB via built-in support, you\u2019ll need an alternative integration." - - The deprecated `secure-upstream` annotation was removed; any Ingresses using - it must be updated to supported annotations/configuration. + chart_updates: ['Add support for custom port configuration for the controller + internal service (PR #9846).', 'Adjust default HPA configuration to include + explicit resource type to avoid issues with Terraform Helm usage (PR #9803).', + 'FastCGI ConfigMap is expected to be in the same namespace as the ingress + controller (PR #9863).', Docs/README updates and formatting fixes (multiple + PRs).] + features: ['Support a new `--container` flag for the controller, improving flexibility + in container/runtime-related scenarios.', "Helm chart can now customize\ + \ ports on the controller\u2019s internal Service, enabling non-default\ + \ port mappings when needed.", HPA defaults were made more explicit to improve + compatibility with Terraform-managed Helm deployments.] + breaking_changes: ["InfluxDB support was deprecated and removed; if you were\ + \ exporting metrics to InfluxDB via built-in support, you\u2019ll need an\ + \ alternative integration.", The deprecated `secure-upstream` annotation + was removed; any Ingresses using it must be updated to supported annotations/configuration.] chart_version: 4.6.1 - images: - - registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + images: ['registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f'] - version: 1.6.4 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -22363,48 +18229,36 @@ addons: \ became configurable.\n - There was work around pathType validation toggles;\ \ check whether the chart exposes a value to disable/enable strict validation\ \ in your version.\n" - chart_updates: - - Controller image update to `registry.k8s.io/ingress-nginx/controller:v1.6.4` - (and chroot variant) from `v1.5.1`. - - CI/release pipeline and chart linting were added/adjusted (no runtime impact - but indicates chart packaging changes). - - Grafana dashboard templates were adjusted to remove hardcoded namespaces/datasources - (may affect how you import/use dashboards). - - HPA API version was bumped to `autoscaling/v2` (cluster must support it; Kubernetes - 1.23+ generally OK). - - RBAC was tightened by removing some ConfigMap-related permissions (may matter - if you had custom workflows expecting those permissions). - features: - - Support for Kubernetes topology-aware hints (can improve client-side load - distribution when using services that honor hints). - - New Prometheus metric for orphaned Ingress objects (`orphan_ingress`) to help - detect stale/unused Ingress resources. - - ConfigMap option exposed to disable gzip (`gzip-disable`) for easier response - compression control. - - New `ipdenylist` annotation to deny traffic from specified IP ranges at the - Ingress level. - - Ability to disable creation of sync events (reduces event noise in large clusters). - - Stream module gained `buildResolvers` (helps with DNS resolution behavior - for TCP/UDP stream configs). - - Profiler address became configurable (helps with debugging/performance profiling - when needed). - breaking_changes: - - If you are on an older Kubernetes version, HPA switching to `autoscaling/v2` - can break installs/updates (verify your cluster supports it). - - Stricter/changed behavior around Ingress `pathType` validation was introduced - and then partially reverted/toggled; if you relied on invalid/missing `pathType` - or regex path edge-cases, re-test your Ingress rules after upgrade. - - RBAC reduction (removal of some ConfigMap permissions) can break custom automation - that expected the controller service account to have broader access. + chart_updates: ['Controller image update to `registry.k8s.io/ingress-nginx/controller:v1.6.4` + (and chroot variant) from `v1.5.1`.', CI/release pipeline and chart linting + were added/adjusted (no runtime impact but indicates chart packaging changes)., + Grafana dashboard templates were adjusted to remove hardcoded namespaces/datasources + (may affect how you import/use dashboards)., HPA API version was bumped + to `autoscaling/v2` (cluster must support it; Kubernetes 1.23+ generally + OK)., RBAC was tightened by removing some ConfigMap-related permissions + (may matter if you had custom workflows expecting those permissions).] + features: [Support for Kubernetes topology-aware hints (can improve client-side + load distribution when using services that honor hints)., New Prometheus + metric for orphaned Ingress objects (`orphan_ingress`) to help detect stale/unused + Ingress resources., ConfigMap option exposed to disable gzip (`gzip-disable`) + for easier response compression control., New `ipdenylist` annotation to + deny traffic from specified IP ranges at the Ingress level., Ability to + disable creation of sync events (reduces event noise in large clusters)., + Stream module gained `buildResolvers` (helps with DNS resolution behavior + for TCP/UDP stream configs)., Profiler address became configurable (helps + with debugging/performance profiling when needed).] + breaking_changes: ['If you are on an older Kubernetes version, HPA switching + to `autoscaling/v2` can break installs/updates (verify your cluster supports + it).', 'Stricter/changed behavior around Ingress `pathType` validation was + introduced and then partially reverted/toggled; if you relied on invalid/missing + `pathType` or regex path edge-cases, re-test your Ingress rules after upgrade.', + RBAC reduction (removal of some ConfigMap permissions) can break custom automation + that expected the controller service account to have broader access.] chart_version: 4.5.2 - images: - - registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + images: ['registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] - version: 1.5.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -22421,96 +18275,72 @@ addons: \ can now set a `securityContext` for admission-webhook components via Helm\ \ values (PR #9186). This matters for hardened clusters/PSA where you need\ \ explicit settings.\n" - chart_updates: - - Controller switched to using **EndpointSlices** (introduced in v1.4.0); verify - your cluster has the EndpointSlice API enabled (default in modern Kubernetes) - and that any RBAC/network policies accommodate it. - - '**Prometheus metric names changed** (v1.4.0): new/updated histogram & counter - names, some deprecated/removed metrics. Update dashboards/alerts/scrape queries - accordingly.' - - Controller image registry is **registry.k8s.io** (noted around v1.4.0 timeframe); - ensure image allowlists, proxies, and mirroring are updated. - - 'Upgrades in dependencies/runtime: **NGINX 1.21.6** and **Go 1.19.2** by v1.5.1.' - - 'Bugfix: **Service name length** issue fixed (v1.5.1, PR #9245).' - - 'Security: includes fixes for **CVE-2022-32149**, **CVE-2022-27664**, **CVE-2022-1996** - (v1.5.1).' - features: - - EndpointSlice support (instead of Endpoints) to align with modern Kubernetes - service discovery and scalability (v1.4.0). - - New controller timing metrics split into request/connect/header/response duration - histograms to improve latency visibility (v1.4.0). - - Helm chart can now disable liveness/readiness probes for the controller (v1.5.1). - - Helm chart can now set a securityContext for admission-webhook resources to - support restricted/hardened clusters (v1.5.1). - breaking_changes: - - Prometheus metrics rename/removal in v1.4.0 can break existing Grafana dashboards - and alert rules; you must update metric names and types (some summaries removed/deprecated). - - "Kubernetes version support drops older clusters: 1.20\u20131.21 deprecated\ - \ in v1.4.0 and explicitly marked as no longer supported by the chart by v1.5.1;\ - \ upgrading on 1.21 may fail or be unsupported." + chart_updates: [Controller switched to using **EndpointSlices** (introduced + in v1.4.0); verify your cluster has the EndpointSlice API enabled (default + in modern Kubernetes) and that any RBAC/network policies accommodate it., + '**Prometheus metric names changed** (v1.4.0): new/updated histogram & counter + names, some deprecated/removed metrics. Update dashboards/alerts/scrape + queries accordingly.', 'Controller image registry is **registry.k8s.io** + (noted around v1.4.0 timeframe); ensure image allowlists, proxies, and mirroring + are updated.', 'Upgrades in dependencies/runtime: **NGINX 1.21.6** and **Go + 1.19.2** by v1.5.1.', 'Bugfix: **Service name length** issue fixed (v1.5.1, + PR #9245).', 'Security: includes fixes for **CVE-2022-32149**, **CVE-2022-27664**, + **CVE-2022-1996** (v1.5.1).'] + features: [EndpointSlice support (instead of Endpoints) to align with modern + Kubernetes service discovery and scalability (v1.4.0)., New controller timing + metrics split into request/connect/header/response duration histograms to + improve latency visibility (v1.4.0)., Helm chart can now disable liveness/readiness + probes for the controller (v1.5.1)., Helm chart can now set a securityContext + for admission-webhook resources to support restricted/hardened clusters + (v1.5.1).] + breaking_changes: [Prometheus metrics rename/removal in v1.4.0 can break existing + Grafana dashboards and alert rules; you must update metric names and types + (some summaries removed/deprecated)., "Kubernetes version support drops\ + \ older clusters: 1.20\u20131.21 deprecated in v1.4.0 and explicitly marked\ + \ as no longer supported by the chart by v1.5.1; upgrading on 1.21 may fail\ + \ or be unsupported."] chart_version: 4.4.2 - images: - - registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + images: ['registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] - version: 1.4.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Controller now uses EndpointSlices instead of Endpoints to discover backends. - - Leader election in 1.3.1 is Lease-only (no ConfigMaps); 1.3.0 was the transition - release. - - Prometheus metrics have been renamed/reshaped; several histograms added/updated, - some summaries/histograms deprecated/removed. - - "Kubernetes version support updated: 1.20\u20131.21 deprecated; 1.25 supported;\ - \ supported set called out as 1.23\u20131.25." - - Images moved/standardized to registry.k8s.io (note broader k8s.gcr.io -> registry.k8s.io - migration notice). - - Go toolchain bumped (1.19 in 1.3.1; 1.19.1 in 1.4.0); base image updates (Alpine - 3.16.2 in 1.3.1). - - New annotation added for sticky cookie domain. - - PSP-related job patch logic avoided on Kubernetes 1.25+. - - Metrics port name can be parameterized (relevant if you scrape by port name). - features: - - Backend discovery uses EndpointSlices, improving scalability on clusters with - many endpoints. - - New/updated Prometheus histograms for request/connect/header/response timings - and request/response sizes. - - New annotation to set the sticky session cookie domain. - breaking_changes: - - Prometheus metric names changed; some metrics were deprecated/removed (e.g., - ingress_upstream_header_seconds summary removed), so dashboards/alerts and - scrape rules may break until updated. - - "Clusters on Kubernetes 1.20\u20131.21 are now deprecated for this controller\ - \ line; plan to run on 1.23+ (and 1.25 supported) before/with the upgrade." - - Leader election behavior changed in 1.3.1 to Lease-only; if you ever skipped - 1.3.0 during the earlier migration window, validate no legacy ConfigMap lock - assumptions remain. + kube: ['1.25', '1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Controller now uses EndpointSlices instead of Endpoints to discover + backends., Leader election in 1.3.1 is Lease-only (no ConfigMaps); 1.3.0 + was the transition release., 'Prometheus metrics have been renamed/reshaped; + several histograms added/updated, some summaries/histograms deprecated/removed.', + "Kubernetes version support updated: 1.20\u20131.21 deprecated; 1.25 supported;\ + \ supported set called out as 1.23\u20131.25.", Images moved/standardized + to registry.k8s.io (note broader k8s.gcr.io -> registry.k8s.io migration + notice)., Go toolchain bumped (1.19 in 1.3.1; 1.19.1 in 1.4.0); base image + updates (Alpine 3.16.2 in 1.3.1)., New annotation added for sticky cookie + domain., PSP-related job patch logic avoided on Kubernetes 1.25+., Metrics + port name can be parameterized (relevant if you scrape by port name).] + features: ['Backend discovery uses EndpointSlices, improving scalability on + clusters with many endpoints.', New/updated Prometheus histograms for request/connect/header/response + timings and request/response sizes., New annotation to set the sticky session + cookie domain.] + breaking_changes: ['Prometheus metric names changed; some metrics were deprecated/removed + (e.g., ingress_upstream_header_seconds summary removed), so dashboards/alerts + and scrape rules may break until updated.', "Clusters on Kubernetes 1.20\u2013\ + 1.21 are now deprecated for this controller line; plan to run on 1.23+ (and\ + \ 1.25 supported) before/with the upgrade.", 'Leader election behavior changed + in 1.3.1 to Lease-only; if you ever skipped 1.3.0 during the earlier migration + window, validate no legacy ConfigMap lock assumptions remain.'] chart_version: 4.3.0 - images: - - registry.k8s.io/ingress-nginx/controller:v1.4.0@sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + images: ['registry.k8s.io/ingress-nginx/controller:v1.4.0@sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f'] - version: 1.3.1 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: null chart_version: 4.2.5 - images: - - registry.k8s.io/ingress-nginx/controller:v1.3.1@sha256:54f7fe2c6c5a9db9a0ebf1131797109bb7a4d91f56b9b362bde2abd237dd1974 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.3.0@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47 - name: ingress-nginx + images: ['registry.k8s.io/ingress-nginx/controller:v1.3.1@sha256:54f7fe2c6c5a9db9a0ebf1131797109bb7a4d91f56b9b362bde2abd237dd1974', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.3.0@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47'] - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/istio/plural/icons/istio.png?raw=true git_url: https://github.com/istio/istio release_url: https://github.com/istio/istio/releases/tag/{vsn} @@ -22519,453 +18349,320 @@ addons: eolApiSlug: istio versions: - version: 1.30.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are mostly metadata (assets, dates, links) for Istio - 1.30.0 vs 1.29.0; no functional change list is included in the text shared. - As a result, specific new features cannot be extracted from the provided notes. - breaking_changes: - - No breaking changes are listed in the provided release note text; you need - the 'Announcing 1.30' page content or detailed changelog to identify any. - Treat this as 'unknown' until validated from the official release notes/migration - guide. + features: ['Release notes provided are mostly metadata (assets, dates, links) + for Istio 1.30.0 vs 1.29.0; no functional change list is included in the + text shared. As a result, specific new features cannot be extracted from + the provided notes.'] + breaking_changes: [No breaking changes are listed in the provided release note + text; you need the 'Announcing 1.30' page content or detailed changelog + to identify any. Treat this as 'unknown' until validated from the official + release notes/migration guide.] chart_version: 1.30.0 - images: - - registry.istio.io/release/pilot:1.30.0 + images: ['registry.istio.io/release/pilot:1.30.0'] eolAt: '2026-12-31' - version: 1.29.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart changelog was provided in the notes shared (only upstream Istio - application release metadata and asset lists), so no chart template/value - changes can be identified from this input. - features: - - No concrete 1.29.0 feature items were included in the provided notes (only - links to the full release notes). Review the linked 1.29.0 announcement page - for user-facing features and improvements before upgrading. - breaking_changes: - - No breaking changes were included in the provided notes. You must review the - linked 1.29.0 release notes and any 'Upgrade Notes' section to identify removals, - behavior changes, or config deprecations that could affect your cluster. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['No Helm chart changelog was provided in the notes shared (only + upstream Istio application release metadata and asset lists), so no chart + template/value changes can be identified from this input.'] + features: [No concrete 1.29.0 feature items were included in the provided notes + (only links to the full release notes). Review the linked 1.29.0 announcement + page for user-facing features and improvements before upgrading.] + breaking_changes: ['No breaking changes were included in the provided notes. + You must review the linked 1.29.0 release notes and any ''Upgrade Notes'' + section to identify removals, behavior changes, or config deprecations that + could affect your cluster.'] chart_version: 1.29.0 - images: - - docker.io/istio/pilot:1.29.0 + images: ['docker.io/istio/pilot:1.29.0'] eolAt: '2026-10-31' - version: 1.28.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - New Istio release 1.28.0 published (see official release notes link provided). - - Updated istioctl and platform bundles are available for all supported OS/architectures - (linux/amd64, linux/arm64, linux/armv7, macOS, Windows). - breaking_changes: - - No breaking changes were included in the provided notes; review the official - 1.28.0 announcement for any upgrade-impacting changes not captured here. + features: [New Istio release 1.28.0 published (see official release notes link + provided)., 'Updated istioctl and platform bundles are available for all + supported OS/architectures (linux/amd64, linux/arm64, linux/armv7, macOS, + Windows).'] + breaking_changes: [No breaking changes were included in the provided notes; + review the official 1.28.0 announcement for any upgrade-impacting changes + not captured here.] chart_version: 1.28.0 - images: - - docker.io/istio/pilot:1.28.0 + images: ['docker.io/istio/pilot:1.28.0'] eolAt: '2026-07-01' - version: 1.27.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes links moved from 1.26.x to 1.27.x (new minor release), with - updated istioctl/istio artifacts for multiple platforms. - - Updated Istio and istioctl binaries/images to version 1.27.0 (new tarballs/zips - and SPDX files published). - breaking_changes: - - No breaking changes were included in the provided notes; verify the official - 1.27 upgrade notes for deprecations/removals before upgrading. + features: ['Release notes links moved from 1.26.x to 1.27.x (new minor release), + with updated istioctl/istio artifacts for multiple platforms.', Updated + Istio and istioctl binaries/images to version 1.27.0 (new tarballs/zips + and SPDX files published).] + breaking_changes: [No breaking changes were included in the provided notes; + verify the official 1.27 upgrade notes for deprecations/removals before + upgrading.] chart_version: 1.27.0 - images: - - docker.io/istio/pilot:1.27.0 + images: ['docker.io/istio/pilot:1.27.0'] eolAt: '2026-04-07' - version: 1.26.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Upgrade target is Istio 1.26.0 (published 2025-05-08); new istioctl/istio - binaries and artifacts are available for multiple platforms. - - No functional changes are described in the provided notes; only release metadata - and artifact listings are included. - breaking_changes: - - No breaking changes are listed in the provided release notes snippet; you - should review the official Istio 1.26.x announcement/changelog for deprecations, - API changes, and upgrade notes before proceeding. + features: [Upgrade target is Istio 1.26.0 (published 2025-05-08); new istioctl/istio + binaries and artifacts are available for multiple platforms., No functional + changes are described in the provided notes; only release metadata and artifact + listings are included.] + breaking_changes: ['No breaking changes are listed in the provided release notes + snippet; you should review the official Istio 1.26.x announcement/changelog + for deprecations, API changes, and upgrade notes before proceeding.'] chart_version: 1.26.0 - images: - - docker.io/istio/pilot:1.26.0 + images: ['docker.io/istio/pilot:1.26.0'] eolAt: '2025-12-22' - version: 1.25.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No actionable feature details were included in the provided notes beyond links - and artifact lists; refer to the official 1.25 release notes page for the - actual feature list before upgrading. - breaking_changes: - - No breaking-change details were included in the provided notes beyond links - and artifact lists; review the official 1.25 release notes and upgrade notes - for any behavior/config/API changes before proceeding. + features: [No actionable feature details were included in the provided notes + beyond links and artifact lists; refer to the official 1.25 release notes + page for the actual feature list before upgrading.] + breaking_changes: [No breaking-change details were included in the provided + notes beyond links and artifact lists; review the official 1.25 release + notes and upgrade notes for any behavior/config/API changes before proceeding.] chart_version: 1.25.0 - images: - - docker.io/istio/pilot:1.25.0 + images: ['docker.io/istio/pilot:1.25.0'] eolAt: '2025-09-30' - version: 1.24.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are just release metadata/assets links; no actual 1.24.0 - vs 1.23.0 feature list was included, so specific new features cannot be summarized - from the supplied text. - breaking_changes: - - No breaking-change details were included in the supplied notes (only release - metadata and artifact lists), so breaking changes cannot be identified from - this input. + features: ['Release notes provided are just release metadata/assets links; no + actual 1.24.0 vs 1.23.0 feature list was included, so specific new features + cannot be summarized from the supplied text.'] + breaking_changes: ['No breaking-change details were included in the supplied + notes (only release metadata and artifact lists), so breaking changes cannot + be identified from this input.'] chart_version: 1.24.0 - images: - - docker.io/istio/pilot:1.24.0 + images: ['docker.io/istio/pilot:1.24.0'] eolAt: '2025-06-24' - version: 1.23.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 1.23.0 is a new Istio minor release compared to 1.22.0; use the matching 1.23.0 - artifacts/istioctl and upgrade control plane + data plane in a coordinated - rollout. - breaking_changes: - - No specific breaking changes were provided in the pasted release notes (only - metadata and asset lists). Review the official 1.23.0 release notes link for - deprecations/behavior changes before upgrading. + features: [1.23.0 is a new Istio minor release compared to 1.22.0; use the matching + 1.23.0 artifacts/istioctl and upgrade control plane + data plane in a coordinated + rollout.] + breaking_changes: [No specific breaking changes were provided in the pasted + release notes (only metadata and asset lists). Review the official 1.23.0 + release notes link for deprecations/behavior changes before upgrading.] chart_version: 1.23.0 - images: - - docker.io/istio/pilot:1.23.0 + images: ['docker.io/istio/pilot:1.23.0'] eolAt: '2025-04-16' - version: 1.22.0 - kube: - - '1.30' - - '1.29' - - 1.28' - - '1.27' + kube: ['1.30', '1.29', 1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release note excerpt provided contains primarily metadata (dates, links, artifacts) - for Istio 1.21.0 and 1.22.0; no functional changes, new features, or upgrade-impacting - behavior changes are listed in the text you pasted. - - Both versions publish new istioctl and istio distribution artifacts for multiple - OS/arch combinations; your upgrade should use the matching 1.22.0 istioctl - to install/validate 1.22 control plane changes. - breaking_changes: - - No breaking changes are described in the provided text; to assess real breaking/behavior - changes you must review the linked Istio 1.22 release notes page (and especially - the 'Upgrade Notes' / 'Deprecations' sections). + features: ['Release note excerpt provided contains primarily metadata (dates, + links, artifacts) for Istio 1.21.0 and 1.22.0; no functional changes, new + features, or upgrade-impacting behavior changes are listed in the text you + pasted.', Both versions publish new istioctl and istio distribution artifacts + for multiple OS/arch combinations; your upgrade should use the matching + 1.22.0 istioctl to install/validate 1.22 control plane changes.] + breaking_changes: [No breaking changes are described in the provided text; to + assess real breaking/behavior changes you must review the linked Istio 1.22 + release notes page (and especially the 'Upgrade Notes' / 'Deprecations' + sections).] chart_version: 1.22.0 - images: - - docker.io/istio/pilot:1.22.0 + images: ['docker.io/istio/pilot:1.22.0'] eolAt: '2025-01-22' - version: 1.21.0 - kube: - - '1.29' - - 1.28' - - '1.27' - - '1.26' + kube: ['1.29', 1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided only include metadata and artifact lists for 1.20.0 - and 1.21.0, without the actual change log content; no concrete feature deltas - can be extracted from the text shared. - breaking_changes: - - No breaking changes can be determined from the provided release note excerpts - because they do not include the detailed changelog/upgrade notes. + features: ['Release notes provided only include metadata and artifact lists + for 1.20.0 and 1.21.0, without the actual change log content; no concrete + feature deltas can be extracted from the text shared.'] + breaking_changes: [No breaking changes can be determined from the provided release + note excerpts because they do not include the detailed changelog/upgrade + notes.] chart_version: 1.21.0 - images: - - docker.io/istio/pilot:1.21.0 + images: ['docker.io/istio/pilot:1.21.0'] eolAt: '2024-09-27' - version: 1.20.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided include artifact listings and links but do not include - the actual 1.20 feature list; review the official 1.20 announcement for specifics - (telemetry, ambient, gateway, security, and UX improvements are typical areas). - breaking_changes: - - No breaking changes were included in the provided excerpts; you must check - the 1.19 and 1.20 upgrade notes/Deprecations pages before upgrading from 1.18 - to 1.20. + features: ['Release notes provided include artifact listings and links but do + not include the actual 1.20 feature list; review the official 1.20 announcement + for specifics (telemetry, ambient, gateway, security, and UX improvements + are typical areas).'] + breaking_changes: [No breaking changes were included in the provided excerpts; + you must check the 1.19 and 1.20 upgrade notes/Deprecations pages before + upgrading from 1.18 to 1.20.] chart_version: 1.20.0 - images: - - docker.io/istio/pilot:1.20.0 + images: ['docker.io/istio/pilot:1.20.0'] eolAt: '2024-06-25' - version: 1.18.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' + kube: ['1.27', '1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided here mostly list artifacts and metadata; no concrete - feature list for 1.18.0 vs 1.17.0 is included in the pasted content. See the - linked Istio 1.18 announcement/release notes for the actual new features and - improvements (traffic management, security, telemetry, platform support). - breaking_changes: - - No breaking-change details are included in the pasted content; breaking changes - (if any) must be taken from the Istio 1.18 release notes / upgrade notes page - linked in the announcement. + features: ['Release notes provided here mostly list artifacts and metadata; + no concrete feature list for 1.18.0 vs 1.17.0 is included in the pasted + content. See the linked Istio 1.18 announcement/release notes for the actual + new features and improvements (traffic management, security, telemetry, + platform support).'] + breaking_changes: [No breaking-change details are included in the pasted content; + breaking changes (if any) must be taken from the Istio 1.18 release notes + / upgrade notes page linked in the announcement.] chart_version: 1.18.0 - images: - - docker.io/istio/pilot:1.18.0 + images: ['docker.io/istio/pilot:1.18.0'] eolAt: '2024-01-04' - version: 1.17.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - This note set you provided is mostly metadata (artifact links, file sizes, - download counts) for 1.16.0 and 1.17.0; it does not include the actual 1.17 - feature list. - - From the official 1.17 announcement page (linked), you should extract the - specific new features/fixes relevant to your cluster (ambient/sidecar behavior, - gateway changes, telemetry, security, etc.). - breaking_changes: - - No breaking changes can be reliably identified from the pasted content because - it doesn't include the 'upgrade notes'/deprecations section from the 1.17 - release notes. - - Check the 1.17 release notes for removals/deprecations and any required API/version - bumps (Kubernetes version support, Envoy, gateway APIs) before upgrading. + features: ['This note set you provided is mostly metadata (artifact links, file + sizes, download counts) for 1.16.0 and 1.17.0; it does not include the actual + 1.17 feature list.', 'From the official 1.17 announcement page (linked), + you should extract the specific new features/fixes relevant to your cluster + (ambient/sidecar behavior, gateway changes, telemetry, security, etc.).'] + breaking_changes: [No breaking changes can be reliably identified from the pasted + content because it doesn't include the 'upgrade notes'/deprecations section + from the 1.17 release notes., 'Check the 1.17 release notes for removals/deprecations + and any required API/version bumps (Kubernetes version support, Envoy, gateway + APIs) before upgrading.'] chart_version: 1.17.0 - images: - - docker.io/istio/pilot:1.17.0 + images: ['docker.io/istio/pilot:1.17.0'] eolAt: '2023-10-27' - version: 1.16.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Istio 1.16.0 is a new minor release over 1.14.0; expect updated control plane - and sidecar images, plus fixes and enhancements across traffic management, - security, and observability (details not included in provided notes). - breaking_changes: - - The provided release snippets do not include upgrade notes, deprecations, - or breaking changes; you must review the official 1.15.x and 1.16.x upgrade - notes before proceeding to catch any incompatible API/behavior changes. + features: ['Istio 1.16.0 is a new minor release over 1.14.0; expect updated + control plane and sidecar images, plus fixes and enhancements across traffic + management, security, and observability (details not included in provided + notes).'] + breaking_changes: ['The provided release snippets do not include upgrade notes, + deprecations, or breaking changes; you must review the official 1.15.x and + 1.16.x upgrade notes before proceeding to catch any incompatible API/behavior + changes.'] chart_version: 1.16.0 - images: - - docker.io/istio/pilot:1.16.0 + images: ['docker.io/istio/pilot:1.16.0'] eolAt: '2023-07-25' - version: 1.14.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are metadata (dates, assets, links) for Istio 1.14.0 - vs 1.13.0; no functional changes are listed in the excerpt. - - Upgrade involves moving Istio control plane and istioctl binaries to 1.14.0 - artifacts for your platform (amd64/arm64/armv7, etc.). - breaking_changes: - - No breaking changes can be determined from the provided notes because they - do not include feature/behavior/deprecation details. Review the linked Istio - 1.14.0 announcement and full release notes for breaking changes and upgrade - notes before proceeding. + features: ['Release notes provided are metadata (dates, assets, links) for Istio + 1.14.0 vs 1.13.0; no functional changes are listed in the excerpt.', 'Upgrade + involves moving Istio control plane and istioctl binaries to 1.14.0 artifacts + for your platform (amd64/arm64/armv7, etc.).'] + breaking_changes: [No breaking changes can be determined from the provided notes + because they do not include feature/behavior/deprecation details. Review + the linked Istio 1.14.0 announcement and full release notes for breaking + changes and upgrade notes before proceeding.] chart_version: 1.14.0 - images: - - docker.io/istio/pilot:1.14.0 + images: ['docker.io/istio/pilot:1.14.0'] eolAt: '2022-12-27' - version: 1.13.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Istio 1.13.0 is the target version for the upgrade from 1.12.0; the notes - provided here only include release metadata and artifact lists, not functional - changes. - - New build artifacts are published for Istio 1.13.0 across linux/osx/windows - and amd64/arm64/armv7, including separate istioctl bundles. - breaking_changes: - - No breaking changes were included in the provided release notes excerpt; consult - the official Istio 1.13.0 announcement/changelog and the 1.13 upgrade notes - for any removals, deprecations, or behavior changes. + features: ['Istio 1.13.0 is the target version for the upgrade from 1.12.0; + the notes provided here only include release metadata and artifact lists, + not functional changes.', 'New build artifacts are published for Istio 1.13.0 + across linux/osx/windows and amd64/arm64/armv7, including separate istioctl + bundles.'] + breaking_changes: ['No breaking changes were included in the provided release + notes excerpt; consult the official Istio 1.13.0 announcement/changelog + and the 1.13 upgrade notes for any removals, deprecations, or behavior changes.'] chart_version: 1.13.0 - images: - - docker.io/istio/pilot:1.13.0 + images: ['docker.io/istio/pilot:1.13.0'] eolAt: '2022-10-12' - version: 1.12.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 1.12.0 - images: - - docker.io/istio/pilot:1.12.0 + images: ['docker.io/istio/pilot:1.12.0'] eolAt: '2022-07-12' - version: 1.11.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null eolAt: '2022-03-25' - version: 1.9.0 - kube: - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null eolAt: '2021-10-08' - version: 1.8.0 - kube: - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null eolAt: '2021-05-12' - version: 1.7.0 - kube: - - '1.18' - - '1.17' - - '1.16' + kube: ['1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null eolAt: '2021-02-25' - version: 1.1.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null @@ -22977,455 +18674,187 @@ addons: eolApiSlug: jaeger versions: - version: 1.62.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', + '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.61.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', + '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.60.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', + '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.59.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.57.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.56.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.55.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.54.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.53.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 3.4.1 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.53.0 - - jaegertracing/jaeger-cassandra-schema:1.53.0 - - jaegertracing/jaeger-collector:1.53.0 - - jaegertracing/jaeger-query:1.53.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.53.0', 'jaegertracing/jaeger-cassandra-schema:1.53.0', + 'jaegertracing/jaeger-collector:1.53.0', 'jaegertracing/jaeger-query:1.53.0'] - version: 1.52.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.51.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.73.2 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.51.0 - - jaegertracing/jaeger-cassandra-schema:1.51.0 - - jaegertracing/jaeger-collector:1.51.0 - - jaegertracing/jaeger-query:1.51.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.51.0', 'jaegertracing/jaeger-cassandra-schema:1.51.0', + 'jaegertracing/jaeger-collector:1.51.0', 'jaegertracing/jaeger-query:1.51.0'] - version: 1.50.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.49.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.48.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.47.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.46.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.45.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.71.18 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.45.0 - - jaegertracing/jaeger-cassandra-schema:1.45.0 - - jaegertracing/jaeger-collector:1.45.0 - - jaegertracing/jaeger-query:1.45.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.45.0', 'jaegertracing/jaeger-cassandra-schema:1.45.0', + 'jaegertracing/jaeger-collector:1.45.0', 'jaegertracing/jaeger-query:1.45.0'] - version: 1.44.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.43.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.42.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.70.2 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.42.0 - - jaegertracing/jaeger-cassandra-schema:1.42.0 - - jaegertracing/jaeger-collector:1.42.0 - - jaegertracing/jaeger-query:1.42.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.42.0', 'jaegertracing/jaeger-cassandra-schema:1.42.0', + 'jaegertracing/jaeger-collector:1.42.0', 'jaegertracing/jaeger-query:1.42.0'] - version: 1.41.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.40.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.39.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.68.2 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.39.0 - - jaegertracing/jaeger-cassandra-schema:1.39.0 - - jaegertracing/jaeger-collector:1.39.0 - - jaegertracing/jaeger-query:1.39.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.39.0', 'jaegertracing/jaeger-cassandra-schema:1.39.0', + 'jaegertracing/jaeger-collector:1.39.0', 'jaegertracing/jaeger-query:1.39.0'] - version: 1.38.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.37.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Introduces a new remote-storage service to support remote storage backends - via a dedicated service endpoint. - - UI dependency is bumped by pinning the Jaeger UI to version 1.26.0 (from 1.25.0 - in 1.36.0). + features: [Introduces a new remote-storage service to support remote storage + backends via a dedicated service endpoint., UI dependency is bumped by pinning + the Jaeger UI to version 1.26.0 (from 1.25.0 in 1.36.0).] breaking_changes: [] chart_version: 0.65.1 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.37.0 - - jaegertracing/jaeger-cassandra-schema:1.37.0 - - jaegertracing/jaeger-collector:1.37.0 - - jaegertracing/jaeger-query:1.37.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.37.0', 'jaegertracing/jaeger-cassandra-schema:1.37.0', + 'jaegertracing/jaeger-collector:1.37.0', 'jaegertracing/jaeger-query:1.37.0'] - version: 1.36.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.57.1 - images: - - cassandra:3.11.6 - - jaegertracing/jaeger-agent:1.36.0 - - jaegertracing/jaeger-cassandra-schema:1.36.0 - - jaegertracing/jaeger-collector:1.36.0 - - jaegertracing/jaeger-query:1.36.0 + images: ['cassandra:3.11.6', 'jaegertracing/jaeger-agent:1.36.0', 'jaegertracing/jaeger-cassandra-schema:1.36.0', + 'jaegertracing/jaeger-collector:1.36.0', 'jaegertracing/jaeger-query:1.36.0'] - version: 1.35.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.34.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 1.33.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null @@ -23437,118 +18866,78 @@ addons: helm_values: settings.clusterName=example versions: - version: 1.13.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - '(From the notes provided: v1.13.0) Improved handling of IP unavailability - by working at the subnet level (ICE subnets) instead of only Availability - Zones, and added logic to skip EC2 API calls for zonally-shifted AZs.' - - (v1.13.0) More flexible IAM instance profile creation by allowing a custom - IAM path for instance profiles. - - (v1.13.0) New configuration knobs to control refresh intervals for AMIs and - subnets, letting operators tune AWS API churn vs freshness. - - (v1.13.0) Expanded EC2NodeClass capabilities, including nested virtualization - support and new connection-tracking-related fields. - - (v1.9.0) Added ICE filtering for MaxFleetCountExceeded errors and added support - for a tenancy label to influence/describe node tenancy. - - (v1.9.0) Added Windows Server 2025 (WS2025) support for Karpenter-managed - nodes. - breaking_changes: - - "No explicit breaking changes were shown in the provided excerpts for v1.9.0\ - \ or v1.13.0; however upgrading across multiple minor versions (1.9 \u2192\ - \ 1.13) typically implies CRD/schema and controller behavior changes\u2014\ - confirm by reviewing intermediate versions\u2019 upgrade guides and CRD diffs\ - \ before applying in production." + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['(From the notes provided: v1.13.0) Improved handling of IP unavailability + by working at the subnet level (ICE subnets) instead of only Availability + Zones, and added logic to skip EC2 API calls for zonally-shifted AZs.', + (v1.13.0) More flexible IAM instance profile creation by allowing a custom + IAM path for instance profiles., '(v1.13.0) New configuration knobs to control + refresh intervals for AMIs and subnets, letting operators tune AWS API churn + vs freshness.', '(v1.13.0) Expanded EC2NodeClass capabilities, including + nested virtualization support and new connection-tracking-related fields.', + (v1.9.0) Added ICE filtering for MaxFleetCountExceeded errors and added support + for a tenancy label to influence/describe node tenancy., (v1.9.0) Added + Windows Server 2025 (WS2025) support for Karpenter-managed nodes.] + breaking_changes: ["No explicit breaking changes were shown in the provided\ + \ excerpts for v1.9.0 or v1.13.0; however upgrading across multiple minor\ + \ versions (1.9 \u2192 1.13) typically implies CRD/schema and controller\ + \ behavior changes\u2014confirm by reviewing intermediate versions\u2019\ + \ upgrade guides and CRD diffs before applying in production."] chart_version: 1.13.0 - images: - - public.ecr.aws/karpenter/controller:1.13.0@sha256:ea731b0cd813add8b2947a76bfe861c38069d85922b01d0c1647d1466279b7fe + images: ['public.ecr.aws/karpenter/controller:1.13.0@sha256:ea731b0cd813add8b2947a76bfe861c38069d85922b01d0c1647d1466279b7fe'] - version: 1.9.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Controller IAM policy was split into multiple policies; review any automation - that installs/patches the controller policy and ensure you apply the new policy - documents before/with the upgrade. - - Max supported Kubernetes version bumped to 1.35; if you run 1.35, ensure you - are on v1.9.0+ and validate AMI/test matrix changes accordingly. - - 'Monitoring: ServiceMonitor gained a `sampleLimit` option; if you manage Prometheus - Operator manifests, consider whether you need to set/override this value.' - features: - - Adds ICE filtering for the `MaxFleetCountExceeded` condition to improve capacity - selection behavior under fleet limits. - - Adds support for labeling tenancy in AWS and improves related validation handling. - - Adds Windows Server 2025 (WS2025) support. - - Makes the controller policy helper script POSIX compliant (quality-of-life - for install/upgrade automation). - breaking_changes: - - Controller IAM policies were split; upgrades may fail or the controller may - be under-permissioned until the new set of policies is applied/reconciled. - Treat this as an upgrade prerequisite and verify permissions before rolling - out. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Controller IAM policy was split into multiple policies; review + any automation that installs/patches the controller policy and ensure you + apply the new policy documents before/with the upgrade., 'Max supported + Kubernetes version bumped to 1.35; if you run 1.35, ensure you are on v1.9.0+ + and validate AMI/test matrix changes accordingly.', 'Monitoring: ServiceMonitor + gained a `sampleLimit` option; if you manage Prometheus Operator manifests, + consider whether you need to set/override this value.'] + features: [Adds ICE filtering for the `MaxFleetCountExceeded` condition to improve + capacity selection behavior under fleet limits., Adds support for labeling + tenancy in AWS and improves related validation handling., Adds Windows Server + 2025 (WS2025) support., Makes the controller policy helper script POSIX + compliant (quality-of-life for install/upgrade automation).] + breaking_changes: [Controller IAM policies were split; upgrades may fail or + the controller may be under-permissioned until the new set of policies is + applied/reconciled. Treat this as an upgrade prerequisite and verify permissions + before rolling out.] chart_version: 1.9.0 - images: - - public.ecr.aws/karpenter/controller:1.9.0@sha256:30a506c64fbb1d8026cbfd9a1d662be3ab6e33a7999290a104085d78b49a69d7 + images: ['public.ecr.aws/karpenter/controller:1.9.0@sha256:30a506c64fbb1d8026cbfd9a1d662be3ab6e33a7999290a104085d78b49a69d7'] - version: 1.8.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Helm chart updated to reflect new CLI options (noted in v1.8.0 chores: \u201C\ - Update helm chart for new CLI options\u201D)." - features: - - Delayed registration support for AWS KWOK (v1.6.0), improving KWOK-based testing/virtual - node flows. - - Capacity Block support (v1.6.0) for provisioning into EC2 Capacity Blocks. - - Temporarily ICE an AZ when its subnets run out of IPs (v1.6.0), reducing thrash - when IP capacity is exhausted. - - Additional Bottlerocket log settings support (v1.6.0). - - Auto-relaxing minimum values support (v1.6.0) to reduce configuration friction - around minimum constraints. - - Ability to set `spec.IpPrefixCount` to pre-warm IP prefixes (v1.8.0), helping - reduce pod IP allocation latency on new nodes. - - Support `InstanceMatchCriteria` in `CapacityReservationSelectorTerms` (v1.8.0), - improving targeting of Capacity Reservations. - - 'Bottlerocket change: use default ephemeral storage bind command (v1.8.0).' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Helm chart updated to reflect new CLI options (noted in v1.8.0\ + \ chores: \u201CUpdate helm chart for new CLI options\u201D)."] + features: ['Delayed registration support for AWS KWOK (v1.6.0), improving KWOK-based + testing/virtual node flows.', Capacity Block support (v1.6.0) for provisioning + into EC2 Capacity Blocks., 'Temporarily ICE an AZ when its subnets run out + of IPs (v1.6.0), reducing thrash when IP capacity is exhausted.', Additional + Bottlerocket log settings support (v1.6.0)., Auto-relaxing minimum values + support (v1.6.0) to reduce configuration friction around minimum constraints., + 'Ability to set `spec.IpPrefixCount` to pre-warm IP prefixes (v1.8.0), helping + reduce pod IP allocation latency on new nodes.', 'Support `InstanceMatchCriteria` + in `CapacityReservationSelectorTerms` (v1.8.0), improving targeting of Capacity + Reservations.', 'Bottlerocket change: use default ephemeral storage bind + command (v1.8.0).'] breaking_changes: [] chart_version: 1.8.0 - images: - - public.ecr.aws/karpenter/controller:1.8.0@sha256:f913075cdd31cfcdfaa9726ca7a0b264832fc42e8a48eb573a2a0f454b38b112 + images: ['public.ecr.aws/karpenter/controller:1.8.0@sha256:f913075cdd31cfcdfaa9726ca7a0b264832fc42e8a48eb573a2a0f454b38b112'] - version: 1.6.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -23564,39 +18953,29 @@ addons: \ removed in chart**: the chart **removed `runAsNonRoot`** to support more\ \ restricted pod security profiles. If you relied on `runAsNonRoot: true`,\ \ you may need to explicitly set your own security context via values.\n" - chart_updates: - - Improved default security context in the Helm chart. - - Chart now validates configuration and fails installation if `settings.clusterName` - is missing. - - ServiceMonitor template extended to support `relabelings` and `metricRelabelings`. - - Chart securityContext defaults adjusted (including removal of `runAsNonRoot`). - features: - - Support for AWS KWOK, including delayed registration support for simulated - nodes. - - Capacity Block support (useful for reserving/using pre-purchased EC2 capacity - blocks). - - "Automatically \u201CICE\u201D (temporarily exclude) AZs when subnets in that\ - \ AZ run out of available IPs, improving resilience during IP exhaustion events." - - Additional Bottlerocket configuration options, including more log settings - and soft eviction support. - - '`volumeInitializationRate` support for EBS `blockDeviceMappings`, allowing - control of EBS initialization performance.' - - "Support for automatically relaxing minimum values in certain scheduling/validation\ - \ paths (reduces unnecessary failures when strict mins can\u2019t be met)." - breaking_changes: - - Kubernetes **1.25 support is dropped**. Clusters on 1.25 must upgrade Kubernetes - before upgrading Karpenter provider to v1.6.0. - - Helm chart now **requires `settings.clusterName`**; upgrades/installs will - fail if it is not provided. + chart_updates: [Improved default security context in the Helm chart., Chart + now validates configuration and fails installation if `settings.clusterName` + is missing., ServiceMonitor template extended to support `relabelings` and + `metricRelabelings`., Chart securityContext defaults adjusted (including + removal of `runAsNonRoot`).] + features: ['Support for AWS KWOK, including delayed registration support for + simulated nodes.', Capacity Block support (useful for reserving/using pre-purchased + EC2 capacity blocks)., "Automatically \u201CICE\u201D (temporarily exclude)\ + \ AZs when subnets in that AZ run out of available IPs, improving resilience\ + \ during IP exhaustion events.", 'Additional Bottlerocket configuration + options, including more log settings and soft eviction support.', '`volumeInitializationRate` + support for EBS `blockDeviceMappings`, allowing control of EBS initialization + performance.', "Support for automatically relaxing minimum values in certain\ + \ scheduling/validation paths (reduces unnecessary failures when strict\ + \ mins can\u2019t be met)."] + breaking_changes: [Kubernetes **1.25 support is dropped**. Clusters on 1.25 + must upgrade Kubernetes before upgrading Karpenter provider to v1.6.0., + Helm chart now **requires `settings.clusterName`**; upgrades/installs will + fail if it is not provided.] chart_version: 1.6.0 - images: - - public.ecr.aws/karpenter/controller:1.6.0@sha256:37c761a3a0b485fd34db1390317ef6149141f532c5a699c528b98fb8f9cc722a + images: ['public.ecr.aws/karpenter/controller:1.6.0@sha256:37c761a3a0b485fd34db1390317ef6149141f532c5a699c528b98fb8f9cc722a'] - version: 1.5.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -23612,74 +18991,55 @@ addons: If you previously relied on running as root or looser permissions, verify pod security settings/PSA/PSP compatibility and override `securityContext`/`podSecurityContext` only if needed.' - chart_updates: - - Improved/tightened default controller pod security context. - - Chart validates presence of `settings.clusterName` and fails installation - if missing. - - ServiceMonitor template updated to support `relabelings` and `metricRelabelings` - fields (Prometheus Operator users). - features: - - Stricter/safer Helm chart defaults (security context) and better chart validation - (requires `settings.clusterName`). - - 'Bottlerocket support improvements: soft eviction support and a new `single-process-oom-kill` - setting, plus additional kubelet configuration test coverage.' - - 'New NodeClass storage option: `volumeInitializationRate` on EBS `blockDeviceMappings`, - enabling more control over EBS volume initialization performance.' - breaking_changes: - - Kubernetes 1.25 support was dropped; clusters running 1.25 must be upgraded - before moving to these versions. - - Helm chart installation/upgrade can fail if `settings.clusterName` is not - set; this is an intentional enforcement change. + chart_updates: [Improved/tightened default controller pod security context., + Chart validates presence of `settings.clusterName` and fails installation + if missing., ServiceMonitor template updated to support `relabelings` and + `metricRelabelings` fields (Prometheus Operator users).] + features: [Stricter/safer Helm chart defaults (security context) and better + chart validation (requires `settings.clusterName`)., 'Bottlerocket support + improvements: soft eviction support and a new `single-process-oom-kill` + setting, plus additional kubelet configuration test coverage.', 'New NodeClass + storage option: `volumeInitializationRate` on EBS `blockDeviceMappings`, + enabling more control over EBS volume initialization performance.'] + breaking_changes: [Kubernetes 1.25 support was dropped; clusters running 1.25 + must be upgraded before moving to these versions., Helm chart installation/upgrade + can fail if `settings.clusterName` is not set; this is an intentional enforcement + change.] chart_version: 1.5.0 - images: - - public.ecr.aws/karpenter/controller:1.5.0@sha256:339aef3f5ecdf6f94d1c7cc9d0e1d359c281b4f9b842877bdbf2acd3fa360521 + images: ['public.ecr.aws/karpenter/controller:1.5.0@sha256:339aef3f5ecdf6f94d1c7cc9d0e1d359c281b4f9b842877bdbf2acd3fa360521'] - version: 1.2.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Supports IAM role paths (useful if your org creates roles like /team/role-name - instead of flat names). - - CRDs can now be installed with optional custom annotations. - - Adds support for a Node Monitoring Agent feature area (node health/repair - related integrations). + features: [Supports IAM role paths (useful if your org creates roles like /team/role-name + instead of flat names)., CRDs can now be installed with optional custom + annotations., Adds support for a Node Monitoring Agent feature area (node + health/repair related integrations).] breaking_changes: [] chart_version: 1.2.0 - images: - - public.ecr.aws/karpenter/controller:1.2.0@sha256:24b8fe57f02b70fc4ab3cd6d5aa0d73a6f3d0c62ca5d23d7ffc8853eac01e324 + images: ['public.ecr.aws/karpenter/controller:1.2.0@sha256:24b8fe57f02b70fc4ab3cd6d5aa0d73a6f3d0c62ca5d23d7ffc8853eac01e324'] - version: 1.0.5 - kube: - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - v0.37.0 introduces a readiness condition on the EC2NodeClass, requiring a - CRD upgrade; follow the upstream upgrade guide. - - 'v1.0.5 is a patch release primarily with a bug fix: migration controllers - are enabled when webhooks are enabled.' - features: - - 'v0.37.0: Ability to select instances by EBS Maximum Bandwidth.' - - 'v0.37.0: Adds nodepool label to the karpenter_interruption_actions_performed - metric.' - - 'v0.37.0: Adds extra fields to the Bottlerocket Kubernetes configuration.' - breaking_changes: - - 'v0.37.0: EC2NodeClass gains a readiness condition, which requires upgrading - CRDs as part of the upgrade.' + kube: ['1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['v0.37.0 introduces a readiness condition on the EC2NodeClass, + requiring a CRD upgrade; follow the upstream upgrade guide.', 'v1.0.5 is + a patch release primarily with a bug fix: migration controllers are enabled + when webhooks are enabled.'] + features: ['v0.37.0: Ability to select instances by EBS Maximum Bandwidth.', + 'v0.37.0: Adds nodepool label to the karpenter_interruption_actions_performed + metric.', 'v0.37.0: Adds extra fields to the Bottlerocket Kubernetes configuration.'] + breaking_changes: ['v0.37.0: EC2NodeClass gains a readiness condition, which + requires upgrading CRDs as part of the upgrade.'] chart_version: 1.0.5 - images: - - public.ecr.aws/karpenter/controller:1.0.5@sha256:f2df98735b232b143d37f0c6819a6cae2be4740e3c8b38297bceb365cf3f668b + images: ['public.ecr.aws/karpenter/controller:1.0.5@sha256:f2df98735b232b143d37f0c6819a6cae2be4740e3c8b38297bceb365cf3f668b'] - version: 0.37.0 - kube: - - '1.30' + kube: ['1.30'] requirements: [] incompatibilities: [] summary: @@ -23701,97 +19061,70 @@ addons: \ chart** for your target controller.\n\n> You didn\u2019t include the intermediate\ \ v0.35.x/v0.36.x Helm changelog text, so double-check Helm values diffs for\ \ those versions as well when you run the upgrade." - chart_updates: - - 'v0.37.0: Adds a readiness condition to `EC2NodeClass` (CRD update required).' - - 'v0.37.0: Chart bug fix for ServiceMonitor indentation (Prometheus Operator - users should validate rendered manifests).' - - 'v0.37.0: Chart change to avoid duplicating AH config in the rendered release - (verify related values/templating in your environment).' - - 'v0.34.0: Release includes fixes related to Helm chart generation issues present - in v0.33.0 (mostly historical but emphasizes using the correct chart/version).' - features: - - '`build_info` Prometheus metric added (version/sha/golang_version labels) - to help with observability and troubleshooting.' - - Support for mounted instance-store ephemeral storage (useful for workloads - needing local ephemeral disks). - - Ability to select instance types by **EBS maximum bandwidth** (more precise - performance-based scheduling). - - Interruption action metric now includes a **nodepool label** (better attribution - of interruption handling). - - Additional Bottlerocket Kubernetes configuration fields supported (more flexibility - for Bottlerocket nodes). - breaking_changes: - - v0.37.0 requires a **CRD upgrade** because `EC2NodeClass` gains a **readiness - condition**; upgrading the controller without updating CRDs can break reconciliation - or leave resources in an unexpected state. - - 'Release notes mention a **BREAKING CHANGE: Refactor NodeClass controller** - (internal behavior around NodeClass reconciliation may change; validate NodeClass/NodePool - lifecycle in a staging cluster and watch logs/events after upgrade).' + chart_updates: ['v0.37.0: Adds a readiness condition to `EC2NodeClass` (CRD + update required).', 'v0.37.0: Chart bug fix for ServiceMonitor indentation + (Prometheus Operator users should validate rendered manifests).', 'v0.37.0: + Chart change to avoid duplicating AH config in the rendered release (verify + related values/templating in your environment).', 'v0.34.0: Release includes + fixes related to Helm chart generation issues present in v0.33.0 (mostly + historical but emphasizes using the correct chart/version).'] + features: ['`build_info` Prometheus metric added (version/sha/golang_version + labels) to help with observability and troubleshooting.', Support for mounted + instance-store ephemeral storage (useful for workloads needing local ephemeral + disks)., Ability to select instance types by **EBS maximum bandwidth** (more + precise performance-based scheduling)., Interruption action metric now includes + a **nodepool label** (better attribution of interruption handling)., Additional + Bottlerocket Kubernetes configuration fields supported (more flexibility + for Bottlerocket nodes).] + breaking_changes: [v0.37.0 requires a **CRD upgrade** because `EC2NodeClass` + gains a **readiness condition**; upgrading the controller without updating + CRDs can break reconciliation or leave resources in an unexpected state., + 'Release notes mention a **BREAKING CHANGE: Refactor NodeClass controller** + (internal behavior around NodeClass reconciliation may change; validate + NodeClass/NodePool lifecycle in a staging cluster and watch logs/events + after upgrade).'] chart_version: 0.37.0 - images: - - public.ecr.aws/karpenter/controller:0.37.0@sha256:157f478f5db1fe999f5e2d27badcc742bf51cc470508b3cebe78224d0947674f + images: ['public.ecr.aws/karpenter/controller:0.37.0@sha256:157f478f5db1fe999f5e2d27badcc742bf51cc470508b3cebe78224d0947674f'] - version: 0.34.0 - kube: - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Introduced container-level default `securityContext` (previously pod-level), - which is a potential breaking change for how the controller pod runs/PSA compliance - is handled. - - Helm chart generation fixes were made after v0.33.0 (chart packaging/build - pipeline reliability improvements). - - 'RBAC tightened: removed `create node` permission from the controller ClusterRole; - additional scoping around launch template access and list calls tagged with - `EC2NodeClass`.' - features: - - Mounted instance-store (ephemeral) storage is now supported for nodes that - have instance-store volumes. - - A new `build_info` Prometheus metric is added that exposes version, git SHA, - and Go version labels for easier observability and debugging. - breaking_changes: - - Default `securityContext` moved from the Pod spec to the container spec, which - can affect pod security admission/override behavior and may require updating - custom manifests/Helm values if you were relying on the old placement. + kube: ['1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Introduced container-level default `securityContext` (previously + pod-level), which is a potential breaking change for how the controller + pod runs/PSA compliance is handled.', Helm chart generation fixes were made + after v0.33.0 (chart packaging/build pipeline reliability improvements)., + 'RBAC tightened: removed `create node` permission from the controller ClusterRole; + additional scoping around launch template access and list calls tagged with + `EC2NodeClass`.'] + features: [Mounted instance-store (ephemeral) storage is now supported for nodes + that have instance-store volumes., 'A new `build_info` Prometheus metric + is added that exposes version, git SHA, and Go version labels for easier + observability and debugging.'] + breaking_changes: ['Default `securityContext` moved from the Pod spec to the + container spec, which can affect pod security admission/override behavior + and may require updating custom manifests/Helm values if you were relying + on the old placement.'] chart_version: 0.34.0 images: [] - version: 0.31.0 - kube: - - '1.28' + kube: ['1.28'] requirements: [] incompatibilities: [] summary: null chart_version: 0.31.0 images: [] - version: 0.28.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 0.25.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - name: karpenter - icon: https://avatars.githubusercontent.com/u/49917779?s=48&v=4 git_url: https://github.com/kedacore/keda release_url: https://github.com/kedacore/keda/releases/tag/v{vsn} @@ -23799,150 +19132,96 @@ addons: eolApiSlug: keda versions: - version: 2.20.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 2.20.0 - version: 2.19.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 2.19.0 - version: 2.18.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 2.18.0 eolAt: '2026-06-01' - version: 2.17.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null chart_version: 2.17.0 eolAt: '2026-02-02' - version: 2.16.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null chart_version: 2.16.0 eolAt: '2025-10-08' - version: 2.15.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: null chart_version: 2.15.0 eolAt: '2025-04-07' - version: 2.14.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 2.14.2 eolAt: '2024-11-07' - version: 2.13.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 2.13.1 eolAt: '2024-08-01' - version: 2.12.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: null chart_version: 2.12.0 eolAt: '2024-04-25' - version: 2.11.0 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null chart_version: 2.11.0 eolAt: '2024-01-18' - version: 2.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 2.10.1 eolAt: '2023-09-28' - version: 2.9.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 2.9.0 eolAt: '2023-06-22' - version: 2.8.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null chart_version: 2.8.1 eolAt: '2023-03-09' - version: 2.7.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null @@ -23957,94 +19236,46 @@ addons: chart_changelog_url: https://raw.githubusercontent.com/prometheus-community/helm-charts/refs/heads/main/charts/kube-prometheus-stack/UPGRADE.md versions: - version: 90.0.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Adds secret-based auth support for control-plane ServiceMonitors (new capability - in kube-prometheus-stack templates/values). - - Grafana subchart was updated to v13.2.1 in 89.2.2 (already in your starting - version). - features: - - Secret-based authentication can now be configured for the control-plane ServiceMonitors, - enabling scraping secured endpoints using credentials stored in Kubernetes - Secrets. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Adds secret-based auth support for control-plane ServiceMonitors + (new capability in kube-prometheus-stack templates/values)., Grafana subchart + was updated to v13.2.1 in 89.2.2 (already in your starting version).] + features: ['Secret-based authentication can now be configured for the control-plane + ServiceMonitors, enabling scraping secured endpoints using credentials stored + in Kubernetes Secrets.'] breaking_changes: [] chart_version: 90.0.0 - images: - - docker.io/grafana/grafana:13.2.1-distroless - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 - - quay.io/kiwigrid/k8s-sidecar:2.11.2 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', + 'quay.io/kiwigrid/k8s-sidecar:2.11.2', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 89.2.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Grafana dependency updated to v13.2.1 in kube-prometheus-stack 89.2.2. - - kube-prometheus-stack 89.1.0 includes non-major dependency updates (unspecified - components). - features: - - Updated bundled Grafana Helm chart/dependency to v13.2.1 (likely includes - bugfixes/minor improvements from Grafana chart). - - Refreshed several non-major dependencies in 89.1.0 (patch/minor bumps). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Grafana dependency updated to v13.2.1 in kube-prometheus-stack + 89.2.2., kube-prometheus-stack 89.1.0 includes non-major dependency updates + (unspecified components).] + features: [Updated bundled Grafana Helm chart/dependency to v13.2.1 (likely + includes bugfixes/minor improvements from Grafana chart)., Refreshed several + non-major dependencies in 89.1.0 (patch/minor bumps).] breaking_changes: [] chart_version: 89.2.2 - images: - - docker.io/grafana/grafana:13.2.1-distroless - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 - - quay.io/kiwigrid/k8s-sidecar:2.11.2 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', + 'quay.io/kiwigrid/k8s-sidecar:2.11.2', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 89.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -24057,151 +19288,79 @@ addons: the timeout fields you intend to set). ' - chart_updates: - - '89.1.0: Bumps kube-prometheus-stack chart dependencies with non-major updates - (Renovate). No other chart-level changes mentioned in the provided notes.' - - '88.6.0: Adds support for configuring HTTPRoute timeouts (Gateway API HTTPRoute).' - features: - - HTTPRoute timeout support (useful if exposing components via Gateway API and - you need request/response timeout tuning). + chart_updates: ['89.1.0: Bumps kube-prometheus-stack chart dependencies with + non-major updates (Renovate). No other chart-level changes mentioned in + the provided notes.', '88.6.0: Adds support for configuring HTTPRoute timeouts + (Gateway API HTTPRoute).'] + features: [HTTPRoute timeout support (useful if exposing components via Gateway + API and you need request/response timeout tuning).] breaking_changes: [] chart_version: 89.1.0 - images: - - docker.io/grafana/grafana:13.2.1-distroless - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.8 - - quay.io/kiwigrid/k8s-sidecar:2.10.3 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.1-distroless', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.8', + 'quay.io/kiwigrid/k8s-sidecar:2.10.3', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 88.6.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Adds support for configuring HTTPRoute timeout in kube-prometheus-stack (Gateway - API HTTPRoute) via chart values/templates. - features: - - 'HTTPRoute timeout support: you can now set timeouts on Gateway API HTTPRoute - resources managed/rendered by the chart, improving control over request/response - handling for routed traffic (e.g., to Grafana/Prometheus endpoints behind - a Gateway).' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Adds support for configuring HTTPRoute timeout in kube-prometheus-stack + (Gateway API HTTPRoute) via chart values/templates.] + features: ['HTTPRoute timeout support: you can now set timeouts on Gateway API + HTTPRoute resources managed/rendered by the chart, improving control over + request/response handling for routed traffic (e.g., to Grafana/Prometheus + endpoints behind a Gateway).'] breaking_changes: [] chart_version: 88.6.0 - images: - - docker.io/grafana/grafana:13.2.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.7 - - quay.io/kiwigrid/k8s-sidecar:2.10.1 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.7', + 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 88.5.4 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped kube-state-metrics subchart/release to **v8.4.0** (as of kube-prometheus-stack - 88.5.0). - - Bumped Grafana subchart/release to **v12.11.2** (as of kube-prometheus-stack - 88.5.4). - features: - - kube-state-metrics dependency update to v8.4.0 (may include new/changed metrics - depending on your KSM configuration). - - Grafana dependency update to v12.11.2 (brings Grafana upstream fixes/changes). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped kube-state-metrics subchart/release to **v8.4.0** (as + of kube-prometheus-stack 88.5.0)., Bumped Grafana subchart/release to **v12.11.2** + (as of kube-prometheus-stack 88.5.4).] + features: [kube-state-metrics dependency update to v8.4.0 (may include new/changed + metrics depending on your KSM configuration)., Grafana dependency update + to v12.11.2 (brings Grafana upstream fixes/changes).] breaking_changes: [] chart_version: 88.5.4 - images: - - docker.io/grafana/grafana:13.2.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.7 - - quay.io/kiwigrid/k8s-sidecar:2.10.1 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.7', + 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 88.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Supports TLS-aware `externalUrl` generation/handling for the stack (per chart - change in PR #7121).' - - 'Bumps the bundled `kube-state-metrics` Helm dependency release to v8.4.0 - (PR #7199).' - features: - - Improved handling of `externalUrl` so it can work correctly when TLS is involved - (e.g., producing/accepting an https external URL in common TLS-terminated - setups). - - Updated kube-state-metrics subchart to v8.4.0, which may bring new/updated - metrics and fixes from kube-state-metrics. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Supports TLS-aware `externalUrl` generation/handling for the + stack (per chart change in PR #7121).', 'Bumps the bundled `kube-state-metrics` + Helm dependency release to v8.4.0 (PR #7199).'] + features: ['Improved handling of `externalUrl` so it can work correctly when + TLS is involved (e.g., producing/accepting an https external URL in common + TLS-terminated setups).', 'Updated kube-state-metrics subchart to v8.4.0, + which may bring new/updated metrics and fixes from kube-state-metrics.'] breaking_changes: [] chart_version: 88.5.0 - images: - - docker.io/grafana/grafana:13.2.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.1 - - quay.io/prometheus-operator/prometheus-operator:v0.93.1 - - quay.io/prometheus/alertmanager:v0.34.0 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.14.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + images: ['docker.io/grafana/grafana:13.2.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.1', + 'quay.io/prometheus/alertmanager:v0.34.0', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.14.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0'] - version: 88.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -24211,526 +19370,269 @@ addons: by the chart. ' - chart_updates: - - '`externalUrl` handling was updated to support TLS configuration (PR #7121).' - features: - - '`externalUrl` can now be configured to support TLS (e.g., HTTPS-related settings) - for exposed component URLs.' + chart_updates: ['`externalUrl` handling was updated to support TLS configuration + (PR #7121).'] + features: ['`externalUrl` can now be configured to support TLS (e.g., HTTPS-related + settings) for exposed component URLs.'] breaking_changes: [] chart_version: 88.3.0 - images: - - docker.io/grafana/grafana:13.1.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.1 - - quay.io/prometheus-operator/prometheus-operator:v0.93.0 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.2-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 88.2.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps the kube-state-metrics subchart dependency from v8.1.3 (in 88.1.3) to - v8.2.0 (in 88.2.0). - features: - - Includes kube-state-metrics v8.2.0 via subchart update. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps the kube-state-metrics subchart dependency from v8.1.3 + (in 88.1.3) to v8.2.0 (in 88.2.0).] + features: [Includes kube-state-metrics v8.2.0 via subchart update.] breaking_changes: [] chart_version: 88.2.0 - images: - - docker.io/grafana/grafana:13.1.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.1 - - quay.io/prometheus-operator/prometheus-operator:v0.93.0 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.2-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.1', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 88.1.3 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped the kube-state-metrics subchart/dependency to v8.1.3 (via renovate). - - 88.0.1 contained only routine non-major dependency updates; no functional - chart changes called out beyond dependency bumps. - features: - - Updated bundled kube-state-metrics chart to v8.1.3 (may include incremental - fixes/metrics changes from kube-state-metrics upstream). + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped the kube-state-metrics subchart/dependency to v8.1.3 + (via renovate)., 88.0.1 contained only routine non-major dependency updates; + no functional chart changes called out beyond dependency bumps.] + features: [Updated bundled kube-state-metrics chart to v8.1.3 (may include incremental + fixes/metrics changes from kube-state-metrics upstream).] breaking_changes: [] chart_version: 88.1.3 - images: - - docker.io/grafana/grafana:13.1.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.0 - - quay.io/prometheus-operator/prometheus-operator:v0.93.0 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.2-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 88.0.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '88.0.1: Bumped kube-prometheus-stack chart dependencies with non-major updates - (details in PR #7153).' - - '87.21.0: Updated bundled Grafana Helm release to v12.10.0 (PR #7139).' - - '87.21.0: CI-only change updating docker/login-action to v4.5.2 (PR #7138); - no runtime impact.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['88.0.1: Bumped kube-prometheus-stack chart dependencies with + non-major updates (details in PR #7153).', '87.21.0: Updated bundled Grafana + Helm release to v12.10.0 (PR #7139).', '87.21.0: CI-only change updating + docker/login-action to v4.5.2 (PR #7138); no runtime impact.'] features: [] breaking_changes: [] chart_version: 88.0.1 - images: - - docker.io/grafana/grafana:13.1.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.0 - - quay.io/prometheus-operator/prometheus-operator:v0.93.0 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.2-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.93.0', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.2-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.21.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'CI-only change: updated `docker/login-action` used in the chart repo workflows - to v4.5.2 (no runtime impact).' - - Updated the Grafana subchart dependency to `grafana` Helm chart v12.10.0 (affects - the Grafana component deployed by kube-prometheus-stack if enabled). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['CI-only change: updated `docker/login-action` used in the chart + repo workflows to v4.5.2 (no runtime impact).', Updated the Grafana subchart + dependency to `grafana` Helm chart v12.10.0 (affects the Grafana component + deployed by kube-prometheus-stack if enabled).] features: [] breaking_changes: [] chart_version: 87.21.0 - images: - - docker.io/grafana/grafana:13.1.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.10.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.10.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.20.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps kube-prometheus-stack chart dependencies with non-major (patch/minor) - updates (via renovate). No functional chart behavior changes are called out - in the release notes beyond dependency refresh. - features: - - Dependency refresh for the kube-prometheus-stack chart (non-major updates). + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps kube-prometheus-stack chart dependencies with non-major + (patch/minor) updates (via renovate). No functional chart behavior changes + are called out in the release notes beyond dependency refresh.] + features: [Dependency refresh for the kube-prometheus-stack chart (non-major + updates).] breaking_changes: [] chart_version: 87.20.0 - images: - - docker.io/grafana/grafana:13.1.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.5 - - quay.io/kiwigrid/k8s-sidecar:2.9.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.5', + 'quay.io/kiwigrid/k8s-sidecar:2.9.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Grafana subchart/container version updated to **v12.8.0** (via chart dependency - update). - - Added scraping of **kube-scheduler resource metrics** (new/updated ServiceMonitor/metrics - config for kube-scheduler). - features: - - kube-prometheus-stack now scrapes kube-scheduler *resource* metrics, improving - visibility into scheduler performance and resource usage. - - Grafana is bumped to v12.8.0, bringing the latest Grafana fixes/features included - by that version. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Grafana subchart/container version updated to **v12.8.0** (via + chart dependency update)., Added scraping of **kube-scheduler resource metrics** + (new/updated ServiceMonitor/metrics config for kube-scheduler).] + features: ['kube-prometheus-stack now scrapes kube-scheduler *resource* metrics, + improving visibility into scheduler performance and resource usage.', 'Grafana + is bumped to v12.8.0, bringing the latest Grafana fixes/features included + by that version.'] breaking_changes: [] chart_version: 87.19.0 - images: - - docker.io/grafana/grafana:13.1.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.17.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Adds scraping of kube-scheduler resource metrics (new/updated ServiceMonitor/metrics - config for kube-scheduler). - features: - - Kube-prometheus-stack now scrapes kube-scheduler resource metrics, improving - visibility into scheduler performance and resource usage. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Adds scraping of kube-scheduler resource metrics (new/updated + ServiceMonitor/metrics config for kube-scheduler).] + features: ['Kube-prometheus-stack now scrapes kube-scheduler resource metrics, + improving visibility into scheduler performance and resource usage.'] breaking_changes: [] chart_version: 87.17.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.16.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps kube-state-metrics chart dependency to v7.8.1 (in 87.15.1). - - Bumps prometheus-node-exporter chart dependency to v4.56.1 (in 87.16.1). - features: - - 'Updated embedded dependencies: kube-state-metrics to v7.8.1 and prometheus-node-exporter - to v4.56.1.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps kube-state-metrics chart dependency to v7.8.1 (in 87.15.1)., + Bumps prometheus-node-exporter chart dependency to v4.56.1 (in 87.16.1).] + features: ['Updated embedded dependencies: kube-state-metrics to v7.8.1 and + prometheus-node-exporter to v4.56.1.'] breaking_changes: [] chart_version: 87.16.1 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.15.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Bumped the bundled/managed kube-state-metrics Helm dependency from v7.8.0 - to v7.8.1 (via prometheus-community/helm-charts PR #7102).' - features: - - Includes kube-state-metrics v7.8.1, which contains minor fixes/updates compared - to v7.8.0. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Bumped the bundled/managed kube-state-metrics Helm dependency + from v7.8.0 to v7.8.1 (via prometheus-community/helm-charts PR #7102).'] + features: ['Includes kube-state-metrics v7.8.1, which contains minor fixes/updates + compared to v7.8.0.'] breaking_changes: [] chart_version: 87.15.1 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.12.0-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.12.0-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.14.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'PrometheusRule: etcd alert/runbook annotations updated (runbook_url).' - - 'Dependency update: kube-state-metrics chart/release bumped to v7.8.0.' - features: - - Updated bundled kube-state-metrics dependency to v7.8.0 (may include new metrics/labels/fixes - from that component). + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['PrometheusRule: etcd alert/runbook annotations updated (runbook_url).', + 'Dependency update: kube-state-metrics chart/release bumped to v7.8.0.'] + features: [Updated bundled kube-state-metrics dependency to v7.8.0 (may include + new metrics/labels/fixes from that component).] breaking_changes: [] chart_version: 87.14.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.13.1-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.1-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.12.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped Alertmanager image tag to `quay.io/prometheus/alertmanager:v0.33.1` - (as of kube-prometheus-stack 87.10.1). - - Updated the etcd `PrometheusRule` annotation `runbook_url` (as of kube-prometheus-stack - 87.12.1). - features: - - Updated/standardized etcd alert runbook URL annotation in PrometheusRule manifests. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Bumped Alertmanager image tag to `quay.io/prometheus/alertmanager:v0.33.1` + (as of kube-prometheus-stack 87.10.1).', Updated the etcd `PrometheusRule` + annotation `runbook_url` (as of kube-prometheus-stack 87.12.1).] + features: [Updated/standardized etcd alert runbook URL annotation in PrometheusRule + manifests.] breaking_changes: [] chart_version: 87.12.1 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.13.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.10.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'CI maintenance: docker/login-action bumped to v4.4.0.' - - Dependency non-major updates in kube-prometheus-stack chart (details not listed - in provided notes). - - Alertmanager image tag updated to quay.io/prometheus/alertmanager v0.33.1. - features: - - Bumps bundled Alertmanager container image to v0.33.1. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['CI maintenance: docker/login-action bumped to v4.4.0.', Dependency + non-major updates in kube-prometheus-stack chart (details not listed in + provided notes)., Alertmanager image tag updated to quay.io/prometheus/alertmanager + v0.33.1.] + features: [Bumps bundled Alertmanager container image to v0.33.1.] breaking_changes: [] chart_version: 87.10.1 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.13.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'CI pipeline maintenance: updated `docker/login-action` to v4.4.0 (no runtime - impact).' - - Chart dependencies received non-major updates via Renovate (may bump subchart - patch/minor versions). - features: - - No user-facing features called out; this release is primarily dependency/CI - maintenance. - breaking_changes: - - No breaking changes mentioned in the provided notes. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['CI pipeline maintenance: updated `docker/login-action` to v4.4.0 + (no runtime impact).', Chart dependencies received non-major updates via + Renovate (may bump subchart patch/minor versions).] + features: [No user-facing features called out; this release is primarily dependency/CI + maintenance.] + breaking_changes: [No breaking changes mentioned in the provided notes.] chart_version: 87.6.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.1 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.13.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.1', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Containers and initContainers are now rendered with `tpl`, allowing templating - inside those values. - - Prometheus container image tag updated to `quay.io/prometheus/prometheus:v3.13.0`. - features: - - Chart now supports Helm templating (`tpl`) within `containers`/`initContainers` - blocks, enabling dynamic values (e.g., names, env vars) from `.Values`. - breaking_changes: - - If you previously had literal strings containing `{{ ... }}` in `containers`/`initContainers`, - they may now be evaluated as templates; escape them or adjust values to avoid - unintended rendering. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Containers and initContainers are now rendered with `tpl`, + allowing templating inside those values.', 'Prometheus container image tag + updated to `quay.io/prometheus/prometheus:v3.13.0`.'] + features: ['Chart now supports Helm templating (`tpl`) within `containers`/`initContainers` + blocks, enabling dynamic values (e.g., names, env vars) from `.Values`.'] + breaking_changes: ['If you previously had literal strings containing `{{ ... + }}` in `containers`/`initContainers`, they may now be evaluated as templates; + escape them or adjust values to avoid unintended rendering.'] chart_version: 87.5.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.1 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.13.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.1', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.13.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -24741,303 +19643,161 @@ addons: and `initContainers` fields using `tpl`, meaning strings in those sections may now be evaluated as Helm templates. Re-check any custom values you set under these fields for unintended template rendering or escaping needs.' - chart_updates: - - 'Templates updated to render `containers` and `initContainers` using Helm - `tpl` (PR #7040).' - - '87.2.1 included routine non-major dependency updates via Renovate (PR #7035).' - features: - - You can now use templating in values that populate `containers` and `initContainers`, - enabling dynamic references to other values, release name/namespace, etc. - when defining extra containers. - breaking_changes: - - 'Potential breaking/behavioral change: values under `containers`/`initContainers` - that previously were treated as literal strings may now be interpreted as - Helm templates via `tpl`, which can change rendered manifests or fail rendering - if the content contains `{{ ... }}` unintentionally.' + chart_updates: ['Templates updated to render `containers` and `initContainers` + using Helm `tpl` (PR #7040).', '87.2.1 included routine non-major dependency + updates via Renovate (PR #7035).'] + features: ['You can now use templating in values that populate `containers` + and `initContainers`, enabling dynamic references to other values, release + name/namespace, etc. when defining extra containers.'] + breaking_changes: ['Potential breaking/behavioral change: values under `containers`/`initContainers` + that previously were treated as literal strings may now be interpreted as + Helm templates via `tpl`, which can change rendered manifests or fail rendering + if the content contains `{{ ... }}` unintentionally.'] chart_version: 87.3.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.0 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.2.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Adds an "agent" skill to support/promote automated Prometheus Operator version - bumps. - - Updates kube-prometheus-stack chart dependencies with non-major (patch/minor) - bumps (performed in both 87.1.0 and 87.2.1). - features: - - "Routine chart maintenance: adds support metadata/automation (\u201Cagent\ - \ skill\u201D) around Prometheus Operator bumps." - - Dependency refreshes for subcharts/components (non-major updates). + chart_updates: [Adds an "agent" skill to support/promote automated Prometheus + Operator version bumps., Updates kube-prometheus-stack chart dependencies + with non-major (patch/minor) bumps (performed in both 87.1.0 and 87.2.1).] + features: ["Routine chart maintenance: adds support metadata/automation (\u201C\ + agent skill\u201D) around Prometheus Operator bumps.", Dependency refreshes + for subcharts/components (non-major updates).] breaking_changes: [] chart_version: 87.2.1 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.0 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.1.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Adds an ''agent skill'' to help automate/streamline Prometheus Operator version - bumps (per PR #7013).' - - 'Updates kube-prometheus-stack chart dependencies with non-major (patch/minor) - updates (per PR #7020).' - features: - - Improved support for handling Prometheus Operator version bumps via a newly - added 'agent skill' in the chart tooling/workflow. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Adds an ''agent skill'' to help automate/streamline Prometheus + Operator version bumps (per PR #7013).', 'Updates kube-prometheus-stack + chart dependencies with non-major (patch/minor) updates (per PR #7020).'] + features: [Improved support for handling Prometheus Operator version bumps via + a newly added 'agent skill' in the chart tooling/workflow.] breaking_changes: [] chart_version: 87.1.0 - images: - - docker.io/grafana/grafana:13.1.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.8.0 - - quay.io/prometheus-operator/prometheus-operator:v0.92.0 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.1.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.8.0', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 87.0.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Both 86.3.2 and 87.0.1 are chart-only releases that primarily bump kube-prometheus-stack - chart dependencies via Renovate (non-major updates). - - No explicit template/CRD/value changes are called out in the provided notes; - treat this as a low-risk patch-level chart maintenance change despite the - version jump crossing a major boundary in the chart number. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Both 86.3.2 and 87.0.1 are chart-only releases that primarily + bump kube-prometheus-stack chart dependencies via Renovate (non-major updates)., + No explicit template/CRD/value changes are called out in the provided notes; + treat this as a low-risk patch-level chart maintenance change despite the + version jump crossing a major boundary in the chart number.] features: [] breaking_changes: [] chart_version: 87.0.1 - images: - - docker.io/grafana/grafana:13.0.2 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.7.4 - - quay.io/prometheus-operator/prometheus-operator:v0.92.0 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.0.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.7.4', 'quay.io/prometheus-operator/prometheus-operator:v0.92.0', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 86.3.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Both 86.2.0 and 86.3.2 releases only mention \u201CUpdate kube-prometheus-stack\ - \ dependency non-major updates\u201D, indicating dependency patch/minor bumps\ - \ within the chart; no explicit template/CRD/value changes are called out\ - \ in the provided notes." - features: - - No new user-facing features are described in the provided release notes; changes - appear limited to dependency non-major updates. - breaking_changes: - - "No breaking changes are mentioned in the provided release notes; however,\ - \ dependency bumps can still introduce behavioral changes\u2014verify component\ - \ image/app versions after the upgrade." + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Both 86.2.0 and 86.3.2 releases only mention \u201CUpdate kube-prometheus-stack\ + \ dependency non-major updates\u201D, indicating dependency patch/minor\ + \ bumps within the chart; no explicit template/CRD/value changes are called\ + \ out in the provided notes."] + features: [No new user-facing features are described in the provided release + notes; changes appear limited to dependency non-major updates.] + breaking_changes: ["No breaking changes are mentioned in the provided release\ + \ notes; however, dependency bumps can still introduce behavioral changes\u2014\ + verify component image/app versions after the upgrade."] chart_version: 86.3.2 - images: - - docker.io/grafana/grafana:13.0.2 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.91.0 - - quay.io/prometheus/alertmanager:v0.33.0 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 + images: ['docker.io/grafana/grafana:13.0.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.4', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', + 'quay.io/prometheus/alertmanager:v0.33.0', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1'] - version: 86.2.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped kube-prometheus-stack chart dependencies with non-major updates (Renovate - automation). No explicit template/value changes called out in the provided - release notes. - features: - - Dependency refresh (non-major) for the kube-prometheus-stack chart and/or - its subcharts/components; expect minor fixes and small improvements coming - from upstream dependencies. - breaking_changes: - - None mentioned in the provided 86.2.0/86.1.0 release notes; still review subchart/component - release notes for hidden breaking changes. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped kube-prometheus-stack chart dependencies with non-major + updates (Renovate automation). No explicit template/value changes called + out in the provided release notes.] + features: [Dependency refresh (non-major) for the kube-prometheus-stack chart + and/or its subcharts/components; expect minor fixes and small improvements + coming from upstream dependencies.] + breaking_changes: [None mentioned in the provided 86.2.0/86.1.0 release notes; + still review subchart/component release notes for hidden breaking changes.] chart_version: 86.2.0 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.91.0 - - quay.io/prometheus/alertmanager:v0.32.2 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', + 'quay.io/prometheus/alertmanager:v0.32.2', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] - version: 86.1.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps kube-prometheus-stack dependency set to latest non-major versions (Renovate-driven). - No explicit values changes called out in the release notes; expect only patch/minor - dependency updates within the chart. - - (Context from prior release in range) 86.0.0 bumped the prometheus-operator - dependency to v0.91.0; 86.1.0 builds on that with non-major dependency refreshes. - features: - - Routine dependency refresh (non-major) which may include minor fixes/updates - in subcharts (e.g., Grafana, Prometheus, exporters) without introducing new - top-level features called out. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps kube-prometheus-stack dependency set to latest non-major + versions (Renovate-driven). No explicit values changes called out in the + release notes; expect only patch/minor dependency updates within the chart., + (Context from prior release in range) 86.0.0 bumped the prometheus-operator + dependency to v0.91.0; 86.1.0 builds on that with non-major dependency refreshes.] + features: ['Routine dependency refresh (non-major) which may include minor fixes/updates + in subcharts (e.g., Grafana, Prometheus, exporters) without introducing + new top-level features called out.'] breaking_changes: [] chart_version: 86.1.0 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.91.0 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.12.0-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.12.0-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] - version: 86.0.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped embedded/managed Prometheus Operator (prometheus-operator) to v0.91.0 - (via chart dependency/version update). - features: - - Uses Prometheus Operator v0.91.0 (may include upstream Operator fixes and - enhancements). - breaking_changes: - - Potential breaking changes may come from Prometheus Operator v0.91.0; review - Operator v0.91.0 release notes and CRD compatibility before upgrading. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped embedded/managed Prometheus Operator (prometheus-operator) + to v0.91.0 (via chart dependency/version update).] + features: [Uses Prometheus Operator v0.91.0 (may include upstream Operator fixes + and enhancements).] + breaking_changes: [Potential breaking changes may come from Prometheus Operator + v0.91.0; review Operator v0.91.0 release notes and CRD compatibility before + upgrading.] chart_version: 86.0.0 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.91.0 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.91.0', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] - version: 85.4.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25048,243 +19808,125 @@ addons: PromQL-related options; if you manage the Prometheus Operator admission webhook via chart values, review the new options and decide whether to set them explicitly (otherwise defaults apply).' - chart_updates: - - 'Added admission webhook PromQL options (PR #6945).' - - 'Minor documentation/comment grammar fix in 85.3.3 (PR #6940).' - features: - - Support for configuring PromQL-related options on the Prometheus Operator - admission webhook (new chart values/options). + chart_updates: ['Added admission webhook PromQL options (PR #6945).', 'Minor + documentation/comment grammar fix in 85.3.3 (PR #6940).'] + features: [Support for configuring PromQL-related options on the Prometheus + Operator admission webhook (new chart values/options).] breaking_changes: [] chart_version: 85.4.0 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] - version: 85.3.3 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Fix comment grammar (no functional change). - - Update kubernetes-mixin digest to 1a2f5ad (brings updated dashboards/alerts/rules - from kubernetes-mixin). - features: - - Updated Kubernetes monitoring mixin content (dashboards/recording rules/alerts) - via new kubernetes-mixin digest. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Fix comment grammar (no functional change)., Update kubernetes-mixin + digest to 1a2f5ad (brings updated dashboards/alerts/rules from kubernetes-mixin).] + features: [Updated Kubernetes monitoring mixin content (dashboards/recording + rules/alerts) via new kubernetes-mixin digest.] breaking_changes: [] chart_version: 85.3.3 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.3 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.3', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0'] - version: 85.2.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Updated the kubernetes-mixin (kubernetes-monitoring/kubernetes-mixin) digest - to `1a2f5ad` (rule/dashboards mixin refresh). - features: - - Refreshed bundled Kubernetes mixin content (dashboards/rules/alerts) to the - kubernetes-mixin digest `1a2f5ad`, which may adjust metrics, labels, and alerts - to match upstream. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Updated the kubernetes-mixin (kubernetes-monitoring/kubernetes-mixin) + digest to `1a2f5ad` (rule/dashboards mixin refresh).] + features: ['Refreshed bundled Kubernetes mixin content (dashboards/rules/alerts) + to the kubernetes-mixin digest `1a2f5ad`, which may adjust metrics, labels, + and alerts to match upstream.'] breaking_changes: [] chart_version: 85.2.0 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 85.1.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Grafana subchart/container release updated to **v12.3.3** (via renovate) in - kube-prometheus-stack **85.1.1**. - - 'Fix/cleanup: avoid duplicate **Thanos image** key in values/templates in - kube-prometheus-stack **85.0.1** (prevents conflicting image settings).' - - 'Misc/CI only: .codespellrc ignore list updated (no runtime impact).' - features: - - Grafana version bump to v12.3.3 (brings upstream Grafana fixes and improvements; - behavior changes depend on Grafana release notes). + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Grafana subchart/container release updated to **v12.3.3** (via + renovate) in kube-prometheus-stack **85.1.1**., 'Fix/cleanup: avoid duplicate + **Thanos image** key in values/templates in kube-prometheus-stack **85.0.1** + (prevents conflicting image settings).', 'Misc/CI only: .codespellrc ignore + list updated (no runtime impact).'] + features: [Grafana version bump to v12.3.3 (brings upstream Grafana fixes and + improvements; behavior changes depend on Grafana release notes).] breaking_changes: [] chart_version: 85.1.1 - images: - - docker.io/grafana/grafana:13.0.1-security-01 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.3 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1-security-01', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.3', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 85.0.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Fix: avoid duplicate `Thanos` image key in rendered manifests (85.0.1).' - - 'Maintenance: update `.codespellrc` in CI (no runtime impact).' - - '84.5.0: dependency non-major updates via Renovate (internal dependency bumps).' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Fix: avoid duplicate `Thanos` image key in rendered manifests + (85.0.1).', 'Maintenance: update `.codespellrc` in CI (no runtime impact).', + '84.5.0: dependency non-major updates via Renovate (internal dependency bumps).'] features: [] breaking_changes: [] chart_version: 85.0.1 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.1 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1-distroless - - quay.io/prometheus/prometheus:v3.11.3-distroless - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1-distroless', + 'quay.io/prometheus/prometheus:v3.11.3-distroless', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 84.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps kube-prometheus-stack chart dependencies with non-major updates (Renovate-driven). - - Previous patch (84.4.0) updated the Grafana subchart to v12.3.0; 84.5.0 follows - with additional dependency patch/minor bumps. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps kube-prometheus-stack chart dependencies with non-major + updates (Renovate-driven)., Previous patch (84.4.0) updated the Grafana + subchart to v12.3.0; 84.5.0 follows with additional dependency patch/minor + bumps.] features: [] breaking_changes: [] chart_version: 84.5.0 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.1 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.1 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.1', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 84.4.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped the Grafana subchart (Helm release) to **Grafana v12.3.0**. - features: - - Grafana dependency updated to v12.3.0 as part of the kube-prometheus-stack - chart release. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped the Grafana subchart (Helm release) to **Grafana v12.3.0**.] + features: [Grafana dependency updated to v12.3.0 as part of the kube-prometheus-stack + chart release.] breaking_changes: [] chart_version: 84.4.0 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.1 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 84.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25294,43 +19936,25 @@ addons: \ setting this explicitly to avoid label mismatches.\n- **84.3.0:** No explicit\ \ Helm values changes called out in the provided notes; it is described as\ \ \u201Cdependency non-major updates\u201D." - chart_updates: - - '84.1.0: Added support for `kubeApiServer.jobNameOverride` (chart template - change for the kube-apiserver scrape config).' - - '84.3.0: Bumped kube-prometheus-stack chart dependencies with non-major updates - (per Renovate PR #6871).' - features: - - Ability to override the kube-apiserver Prometheus job name via `kubeApiServer.jobNameOverride`, - which can help align job labels with existing alerting/dashboards or avoid - collisions. - breaking_changes: - - "No breaking changes were indicated in the provided release notes for 84.1.0\ - \ \u2192 84.3.0. However, dependency bumps (even non-major) can still cause\ - \ minor behavioral changes; validate alerts/dashboards and scrape targets\ - \ in a staging environment." + chart_updates: ['84.1.0: Added support for `kubeApiServer.jobNameOverride` (chart + template change for the kube-apiserver scrape config).', '84.3.0: Bumped + kube-prometheus-stack chart dependencies with non-major updates (per Renovate + PR #6871).'] + features: ['Ability to override the kube-apiserver Prometheus job name via `kubeApiServer.jobNameOverride`, + which can help align job labels with existing alerting/dashboards or avoid + collisions.'] + breaking_changes: ["No breaking changes were indicated in the provided release\ + \ notes for 84.1.0 \u2192 84.3.0. However, dependency bumps (even non-major)\ + \ can still cause minor behavioral changes; validate alerts/dashboards and\ + \ scrape targets in a staging environment."] chart_version: 84.3.0 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.7.1 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.7.1', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 84.1.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25339,36 +19963,20 @@ addons: - **Optional**: a new value/field was added for the API server scrape config: `kubeApiServer.jobNameOverride` (name inferred from the PR title). Use it only if you need to control the generated Prometheus job name for kube-apiserver.' - chart_updates: - - Adds support for overriding the Prometheus scrape job name for kube-apiserver - via a new `jobNameOverride` setting. - features: - - New option to override the kube-apiserver scrape job name (useful when you - need the job label to match existing dashboards/alerts or to avoid collisions). + chart_updates: [Adds support for overriding the Prometheus scrape job name for + kube-apiserver via a new `jobNameOverride` setting.] + features: [New option to override the kube-apiserver scrape job name (useful + when you need the job label to match existing dashboards/alerts or to avoid + collisions).] breaking_changes: [] chart_version: 84.1.0 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.2 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.2', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 84.0.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25379,74 +19987,40 @@ addons: schema before upgrading. ' - chart_updates: - - Updated the bundled Grafana Helm dependency to **Grafana chart v12**. - features: - - Grafana is now deployed via the Grafana Helm chart v12, bringing whatever - new defaults/fixes that chart version includes. - breaking_changes: - - Potential breaking changes may come from the **Grafana Helm chart major version - bump (v12)**; existing `values.yaml` overrides for Grafana may no longer be - valid or may change behavior. Validate your Grafana configuration and run - a dry-run/templating diff before applying. + chart_updates: [Updated the bundled Grafana Helm dependency to **Grafana chart + v12**.] + features: ['Grafana is now deployed via the Grafana Helm chart v12, bringing + whatever new defaults/fixes that chart version includes.'] + breaking_changes: [Potential breaking changes may come from the **Grafana Helm + chart major version bump (v12)**; existing `values.yaml` overrides for Grafana + may no longer be valid or may change behavior. Validate your Grafana configuration + and run a dry-run/templating diff before applying.] chart_version: 84.0.0 - images: - - docker.io/grafana/grafana:13.0.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:13.0.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 83.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Updated bundled kubernetes-mixin content to digest `afc9733` (Prometheus rules, - alerts, recording rules, and Grafana dashboards derived from the mixin). - features: - - Refreshes the upstream kubernetes-mixin bundle, which may add/adjust dashboards - and Prometheus rules shipped with the chart. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Updated bundled kubernetes-mixin content to digest `afc9733` + (Prometheus rules, alerts, recording rules, and Grafana dashboards derived + from the mixin).'] + features: ['Refreshes the upstream kubernetes-mixin bundle, which may add/adjust + dashboards and Prometheus rules shipped with the chart.'] breaking_changes: [] chart_version: 83.7.0 - images: - - docker.io/grafana/grafana:12.4.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 83.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25458,36 +20032,19 @@ addons: - If you enabled/used Alertmanager `sessionPersistence` introduced in `83.5.0`, ensure your values still match your ingress/service setup after upgrading (no new notes for `83.6.0`).' - chart_updates: - - 'Bumped the embedded `kube-prometheus` (prometheus-operator/kube-prometheus) - content digest to `ac9a509` (chart content refresh: manifests/dashboards/rules).' - features: - - Updated the bundled kube-prometheus assets (manifests/rules/dashboards) to - the upstream digest `ac9a509`. + chart_updates: ['Bumped the embedded `kube-prometheus` (prometheus-operator/kube-prometheus) + content digest to `ac9a509` (chart content refresh: manifests/dashboards/rules).'] + features: [Updated the bundled kube-prometheus assets (manifests/rules/dashboards) + to the upstream digest `ac9a509`.] breaking_changes: [] chart_version: 83.6.0 - images: - - docker.io/grafana/grafana:12.4.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.1 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.1', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 83.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -25498,622 +20055,319 @@ addons: Service/ingress layer, review the new `alertmanager.sessionPersistence` (or similarly named) values introduced by the chart and enable/configure it to match your ingress/load balancer behavior.' - chart_updates: - - 'Added support for Alertmanager session persistence (stickiness) in the chart - (PR #6847).' - features: - - Alertmanager can now be configured with session persistence, which helps keep - client sessions pinned to the same backend when behind a load balancer/ingress. + chart_updates: ['Added support for Alertmanager session persistence (stickiness) + in the chart (PR #6847).'] + features: ['Alertmanager can now be configured with session persistence, which + helps keep client sessions pinned to the same backend when behind a load + balancer/ingress.'] breaking_changes: [] chart_version: 83.5.0 - images: - - docker.io/grafana/grafana:12.4.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.4.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 83.4.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Prometheus image tag updated: `quay.io/prometheus/prometheus` -> `v3.11.2` - (in kube-prometheus-stack chart 83.4.1).' - - (Context from start version) 82.18.0 updated the `prometheus-node-exporter` - subchart to `v4.53.0`. - features: - - Prometheus upgraded to v3.11.2 via image tag bump, which may include upstream - Prometheus fixes/improvements. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Prometheus image tag updated: `quay.io/prometheus/prometheus` + -> `v3.11.2` (in kube-prometheus-stack chart 83.4.1).', (Context from start + version) 82.18.0 updated the `prometheus-node-exporter` subchart to `v4.53.0`.] + features: ['Prometheus upgraded to v3.11.2 via image tag bump, which may include + upstream Prometheus fixes/improvements.'] breaking_changes: [] chart_version: 83.4.1 - images: - - docker.io/grafana/grafana:12.4.2 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 - - quay.io/kiwigrid/k8s-sidecar:2.6.0 - - quay.io/prometheus-operator/prometheus-operator:v0.90.1 - - quay.io/prometheus/alertmanager:v0.32.0 - - quay.io/prometheus/node-exporter:v1.11.1 - - quay.io/prometheus/prometheus:v3.11.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.4.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', + 'quay.io/kiwigrid/k8s-sidecar:2.6.0', 'quay.io/prometheus-operator/prometheus-operator:v0.90.1', + 'quay.io/prometheus/alertmanager:v0.32.0', 'quay.io/prometheus/node-exporter:v1.11.1', + 'quay.io/prometheus/prometheus:v3.11.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 82.18.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Prometheus Operator dependency bumped to v0.89.0 (chart 82.0.0). - - prometheus-node-exporter subchart updated to v4.53.0 (chart 82.18.0). - features: - - Upgrades Prometheus Operator to 0.89.0, bringing its upstream fixes and improvements - into the stack. - - Updates node-exporter chart to 4.53.0, which may include new metrics/flags - and bugfixes from that chart release. - breaking_changes: - - No explicit breaking changes are mentioned in the provided release notes; - verify Prometheus Operator 0.89.0 and node-exporter 4.53.0 upstream changelogs - for any deprecations that could affect existing CRs/flags/values. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Prometheus Operator dependency bumped to v0.89.0 (chart 82.0.0)., + prometheus-node-exporter subchart updated to v4.53.0 (chart 82.18.0).] + features: ['Upgrades Prometheus Operator to 0.89.0, bringing its upstream fixes + and improvements into the stack.', 'Updates node-exporter chart to 4.53.0, + which may include new metrics/flags and bugfixes from that chart release.'] + breaking_changes: [No explicit breaking changes are mentioned in the provided + release notes; verify Prometheus Operator 0.89.0 and node-exporter 4.53.0 + upstream changelogs for any deprecations that could affect existing CRs/flags/values.] chart_version: 82.18.0 - images: - - docker.io/grafana/grafana:12.4.2 - - ghcr.io/jkroepke/kube-webhook-certgen:1.8.0 - - quay.io/kiwigrid/k8s-sidecar:2.5.4 - - quay.io/prometheus-operator/prometheus-operator:v0.89.0 - - quay.io/prometheus/alertmanager:v0.31.1 - - quay.io/prometheus/node-exporter:v1.11.0 - - quay.io/prometheus/prometheus:v3.11.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.4.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.8.0', + 'quay.io/kiwigrid/k8s-sidecar:2.5.4', 'quay.io/prometheus-operator/prometheus-operator:v0.89.0', + 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.11.0', + 'quay.io/prometheus/prometheus:v3.11.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 82.0.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps Prometheus Operator to **v0.89.0** (via chart 82.0.0). - - "Between 81.6.1 and 82.0.0 there are intermediate patch releases (81.6.2\u2026\ - 81.6.9) referenced by the compare link; review the full diff if you need to\ - \ account for any additional chart-level changes beyond the operator bump." - features: - - Updated Prometheus Operator to 0.89.0, which may include new CRD fields/behavior - and bug fixes from the operator project. - breaking_changes: - - Potential breaking changes may be introduced indirectly by the Prometheus - Operator 0.89.0 bump (e.g., CRD schema/validation changes). Validate CRDs - and reconcile behavior in a staging cluster before upgrading in production. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps Prometheus Operator to **v0.89.0** (via chart 82.0.0)., + "Between 81.6.1 and 82.0.0 there are intermediate patch releases (81.6.2\u2026\ + 81.6.9) referenced by the compare link; review the full diff if you need\ + \ to account for any additional chart-level changes beyond the operator\ + \ bump."] + features: ['Updated Prometheus Operator to 0.89.0, which may include new CRD + fields/behavior and bug fixes from the operator project.'] + breaking_changes: ['Potential breaking changes may be introduced indirectly + by the Prometheus Operator 0.89.0 bump (e.g., CRD schema/validation changes). + Validate CRDs and reconcile behavior in a staging cluster before upgrading + in production.'] chart_version: 82.0.0 - images: - - docker.io/grafana/grafana:12.3.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.7 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.89.0 - - quay.io/prometheus/alertmanager:v0.31.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.3.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.7', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.89.0', + 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.6.9 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Fix admission webhook DNS name rendering (affects how the webhook Service/endpoint - DNS name is templated/rendered). - - Bump bundled Grafana Helm release to v11.1.5. - - 81.6.1 includes various non-major dependency updates via Renovate (unspecified - individual components). - features: - - No new user-facing features noted; changes are primarily bugfix + dependency - updates. - - Grafana chart/app version update to v11.1.5 is included in 81.6.9. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Fix admission webhook DNS name rendering (affects how the webhook + Service/endpoint DNS name is templated/rendered)., Bump bundled Grafana + Helm release to v11.1.5., 81.6.1 includes various non-major dependency updates + via Renovate (unspecified individual components).] + features: [No new user-facing features noted; changes are primarily bugfix + + dependency updates., Grafana chart/app version update to v11.1.5 is included + in 81.6.9.] breaking_changes: [] chart_version: 81.6.9 - images: - - docker.io/grafana/grafana:12.3.3 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.7 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.88.1 - - quay.io/prometheus/alertmanager:v0.31.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/grafana/grafana:12.3.3', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.7', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', + 'quay.io/prometheus/alertmanager:v0.31.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.6.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Dependency non-major updates only (Renovate/autoclosed PRs); chart package\ - \ size changed slightly (853 KB \u2192 850 KB)." + chart_updates: ["Dependency non-major updates only (Renovate/autoclosed PRs);\ + \ chart package size changed slightly (853 KB \u2192 850 KB)."] features: [] breaking_changes: [] chart_version: 81.6.1 - images: - - docker.io/bats/bats:1.13.0 - - docker.io/grafana/grafana:12.3.2 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.6 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.88.1 - - quay.io/prometheus/alertmanager:v0.31.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/bats/bats:1.13.0', 'docker.io/grafana/grafana:12.3.2', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.6', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', + 'quay.io/prometheus/alertmanager:v0.31.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '81.4.2: Patch job now handles `IgnoreOnInstallOnly` `failurePolicy` correctly - (fix in admission/patching logic).' - - '81.5.0: Bumps kube-prometheus-stack chart dependencies with non-major updates - (Renovate).' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['81.4.2: Patch job now handles `IgnoreOnInstallOnly` `failurePolicy` + correctly (fix in admission/patching logic).', '81.5.0: Bumps kube-prometheus-stack + chart dependencies with non-major updates (Renovate).'] features: [] breaking_changes: [] chart_version: 81.5.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.88.1 - - quay.io/prometheus/alertmanager:v0.31.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', + 'quay.io/prometheus/alertmanager:v0.31.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.4.2 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Patch/upgrade job now handles `IgnoreOnInstallOnly` `failurePolicy` correctly - when patching resources (fix for install/upgrade edge cases). - - 81.3.0 included non-major dependency bumps via Renovate (exact sub-chart/component - versions not listed in the provided notes). - features: - - 'Improved robustness of the patch job when encountering `failurePolicy: IgnoreOnInstallOnly`, - reducing upgrade/install failures in some clusters.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Patch/upgrade job now handles `IgnoreOnInstallOnly` `failurePolicy` + correctly when patching resources (fix for install/upgrade edge cases)., + 81.3.0 included non-major dependency bumps via Renovate (exact sub-chart/component + versions not listed in the provided notes).] + features: ['Improved robustness of the patch job when encountering `failurePolicy: + IgnoreOnInstallOnly`, reducing upgrade/install failures in some clusters.'] breaking_changes: [] chart_version: 81.4.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.88.1 - - quay.io/prometheus/alertmanager:v0.30.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', + 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped kube-prometheus-stack chart dependencies with non-major updates (Renovate). - No chart template/values changes called out in the provided notes. - features: - - 'Maintenance release: refreshes subchart/dependency versions with non-major - updates; no user-facing features were highlighted in the provided release - notes.' - breaking_changes: - - "None mentioned in the provided release notes; treat as low-risk, but dependency\ - \ bumps can still introduce behavior changes\u2014validate in staging." + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped kube-prometheus-stack chart dependencies with non-major + updates (Renovate). No chart template/values changes called out in the provided + notes.] + features: ['Maintenance release: refreshes subchart/dependency versions with + non-major updates; no user-facing features were highlighted in the provided + release notes.'] + breaking_changes: ["None mentioned in the provided release notes; treat as low-risk,\ + \ but dependency bumps can still introduce behavior changes\u2014validate\ + \ in staging."] chart_version: 81.3.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.5.0 - - quay.io/prometheus-operator/prometheus-operator:v0.88.1 - - quay.io/prometheus/alertmanager:v0.30.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.5.0', 'quay.io/prometheus-operator/prometheus-operator:v0.88.1', + 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 81.2.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Both 80.14.4 and 81.2.0 releases are Renovate-driven dependency bumps only; - no functional chart template changes are called out in the release notes provided. - - '80.14.4: CI dependency update (helm/helm to v4.0.5) plus non-major kube-prometheus-stack - dependency updates.' - - '81.2.0: non-major kube-prometheus-stack dependency updates.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Both 80.14.4 and 81.2.0 releases are Renovate-driven dependency + bumps only; no functional chart template changes are called out in the release + notes provided., '80.14.4: CI dependency update (helm/helm to v4.0.5) plus + non-major kube-prometheus-stack dependency updates.', '81.2.0: non-major + kube-prometheus-stack dependency updates.'] features: [] breaking_changes: [] chart_version: 81.2.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.2.1 - - quay.io/prometheus-operator/prometheus-operator:v0.88.0 - - quay.io/prometheus/alertmanager:v0.30.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.2.1', 'quay.io/prometheus-operator/prometheus-operator:v0.88.0', + 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0'] - version: 80.14.4 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '80.10.0: Updated etcd-io/etcd image digest to 65b1be4 (dependency bump via - Renovate).' - - '80.14.4: CI dependency bump helm/helm to v4.0.5.' - - '80.14.4: Non-major dependency updates for kube-prometheus-stack chart (Renovate).' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['80.10.0: Updated etcd-io/etcd image digest to 65b1be4 (dependency + bump via Renovate).', '80.14.4: CI dependency bump helm/helm to v4.0.5.', + '80.14.4: Non-major dependency updates for kube-prometheus-stack chart (Renovate).'] features: [] breaking_changes: [] chart_version: 80.14.4 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.2.1 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.1 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.9.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.2.1', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.1', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.9.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.10.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Updated etcd image digest to `65b1be4` (chart maintenance/renovate-driven - change). - - Updated kube-prometheus-stack chart dependencies (non-major updates) via Renovate. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Updated etcd image digest to `65b1be4` (chart maintenance/renovate-driven + change)., Updated kube-prometheus-stack chart dependencies (non-major updates) + via Renovate.] features: [] breaking_changes: [] chart_version: 80.10.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.9.2 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Grafana Operator YAML dashboards: add `folderRef` and `folderUID` fields - (80.8.0).' - - Dependency bumps / non-major dependency updates via Renovate (80.9.2). - features: - - Grafana Operator dashboard manifests now support `folderRef`/`folderUID`, - enabling dashboards to be organized into specific Grafana folders when using - the Grafana Operator. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Grafana Operator YAML dashboards: add `folderRef` and `folderUID` + fields (80.8.0).', Dependency bumps / non-major dependency updates via Renovate + (80.9.2).] + features: ['Grafana Operator dashboard manifests now support `folderRef`/`folderUID`, + enabling dashboards to be organized into specific Grafana folders when using + the Grafana Operator.'] breaking_changes: [] chart_version: 80.9.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.1 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.4 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.1', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.4', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.8.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Grafana Operator YAML dashboards now include `folderRef` and `folderUID` - fields (PR #6428).' - - "No other chart template/value changes are mentioned in the 80.7.0\u219280.8.0\ - \ release notes; 80.7.0 was primarily CI/dependency non-major updates." - features: - - Grafana Operator dashboard resources can now set/retain the target folder - via `folderRef`/`folderUID`, improving organization and reducing reliance - on default folder placement. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Grafana Operator YAML dashboards now include `folderRef` and + `folderUID` fields (PR #6428).', "No other chart template/value changes\ + \ are mentioned in the 80.7.0\u219280.8.0 release notes; 80.7.0 was primarily\ + \ CI/dependency non-major updates."] + features: ['Grafana Operator dashboard resources can now set/retain the target + folder via `folderRef`/`folderUID`, improving organization and reducing + reliance on default folder placement.'] breaking_changes: [] chart_version: 80.8.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.7.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Dependency updates only (non-major) for kube-prometheus-stack in 80.7.0 (PR - #6437).' - - 'CI-only change: super-linter action bumped to v8.3.2 (PR #6436); no runtime - impact.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Dependency updates only (non-major) for kube-prometheus-stack + in 80.7.0 (PR #6437).', 'CI-only change: super-linter action bumped to v8.3.2 + (PR #6436); no runtime impact.'] features: [] breaking_changes: [] chart_version: 80.7.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Chart release 80.6.0 only includes non-major dependency updates via Renovate - (PR #6426).' - features: - - No user-facing features called out in the release notes; this is a dependency - refresh. - breaking_changes: - - No breaking changes mentioned in the provided release notes. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Chart release 80.6.0 only includes non-major dependency updates + via Renovate (PR #6426).'] + features: [No user-facing features called out in the release notes; this is + a dependency refresh.] + breaking_changes: [No breaking changes mentioned in the provided release notes.] chart_version: 80.6.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Bumps the kube-prometheus-stack chart\u2019s dependencies with non-major\ - \ updates (Renovate PR #6425). No chart template/logic changes called out\ - \ in the release notes beyond dependency updates." - features: - - No new end-user features are mentioned in the 80.5.0 chart release notes; - this appears to be a dependency refresh. - breaking_changes: - - No breaking changes are mentioned in the 80.5.0 chart release notes. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Bumps the kube-prometheus-stack chart\u2019s dependencies with\ + \ non-major updates (Renovate PR #6425). No chart template/logic changes\ + \ called out in the release notes beyond dependency updates."] + features: [No new end-user features are mentioned in the 80.5.0 chart release + notes; this appears to be a dependency refresh.] + breaking_changes: [No breaking changes are mentioned in the 80.5.0 chart release + notes.] chart_version: 80.5.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.4.2 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -26123,40 +20377,22 @@ addons: \ Prometheus Operator is **v0.87.0** in 80.x and CRDs must be upgraded (either\ \ via `crds.upgradeJob.enabled` or manual `kubectl apply --server-side` of\ \ the CRDs)." - chart_updates: - - '**80.4.1**: Allow unsetting the Prometheus service reloader port (chart template - change).' - - '**80.4.2**: Dependency non-major updates for kube-prometheus-stack (renovate-driven).' - - "**80.4.2**: CI-only change (super-linter action bump) \u2014 no runtime impact." - features: - - "Prometheus Service: you can now unset/omit the config-reloader port on the\ - \ Prometheus Service (useful if you don\u2019t want that port exposed/allocated)." - breaking_changes: - - "None mentioned for 80.4.1 \u2192 80.4.2; this is a patch-level release with\ - \ CI and dependency non-major updates." + chart_updates: ['**80.4.1**: Allow unsetting the Prometheus service reloader + port (chart template change).', '**80.4.2**: Dependency non-major updates + for kube-prometheus-stack (renovate-driven).', "**80.4.2**: CI-only change\ + \ (super-linter action bump) \u2014 no runtime impact."] + features: ["Prometheus Service: you can now unset/omit the config-reloader port\ + \ on the Prometheus Service (useful if you don\u2019t want that port exposed/allocated)."] + breaking_changes: ["None mentioned for 80.4.1 \u2192 80.4.2; this is a patch-level\ + \ release with CI and dependency non-major updates."] chart_version: 80.4.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.30.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.30.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.4.1 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25'] requirements: [] incompatibilities: [] summary: @@ -26178,44 +20414,25 @@ addons: kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml\n\ kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml\n\ ```\n" - chart_updates: - - 80.x line uses Prometheus Operator v0.87.0 (drives the CRD update requirement). - - '80.2.0: kube-state-metrics Helm subchart updated to major version v7 (review - if you override kube-state-metrics values heavily).' - - '80.4.1: allows unsetting the **prometheus service reloader port** (minor - chart behavior/templating change).' - features: - - kube-state-metrics subchart bumped to v7 (potentially newer kube-state-metrics - behavior and defaults). - - "Option to unset the reloader port on the Prometheus Service (helps when you\ - \ don\u2019t want that port exposed/created)." - breaking_changes: - - "No breaking changes were explicitly listed for 80.2.0\u201380.4.1 in the\ - \ provided notes. The main operational risk is **CRD mismatch** if you upgrade\ - \ the operator to v0.87.0 without upgrading the CRDs first." + chart_updates: [80.x line uses Prometheus Operator v0.87.0 (drives the CRD update + requirement)., '80.2.0: kube-state-metrics Helm subchart updated to major + version v7 (review if you override kube-state-metrics values heavily).', + '80.4.1: allows unsetting the **prometheus service reloader port** (minor + chart behavior/templating change).'] + features: [kube-state-metrics subchart bumped to v7 (potentially newer kube-state-metrics + behavior and defaults)., "Option to unset the reloader port on the Prometheus\ + \ Service (helps when you don\u2019t want that port exposed/created)."] + breaking_changes: ["No breaking changes were explicitly listed for 80.2.0\u2013\ + 80.4.1 in the provided notes. The main operational risk is **CRD mismatch**\ + \ if you upgrade the operator to v0.87.0 without upgrading the CRDs first."] chart_version: 80.4.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - ghcr.io/jkroepke/kube-webhook-certgen:1.7.3 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.1 - - quay.io/prometheus/alertmanager:v0.29.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'ghcr.io/jkroepke/kube-webhook-certgen:1.7.3', + 'quay.io/kiwigrid/k8s-sidecar:2.1.2', 'quay.io/prometheus-operator/prometheus-operator:v0.87.1', + 'quay.io/prometheus/alertmanager:v0.29.0', 'quay.io/prometheus/node-exporter:v1.10.2', + 'quay.io/prometheus/prometheus:v3.8.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 80.2.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25'] requirements: [] incompatibilities: [] summary: @@ -26237,316 +20454,162 @@ addons: \ kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.87.0/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml\n\ \ ```\n\n- **No other values changes are called out in the provided 79.x\ \ \u2192 80.x upgrade notes.**\n" - chart_updates: - - Prometheus Operator bumped to **v0.87.0** in the 80.x line (from the 79.x - line). - - 'Subchart dependency update in 80.2.0: **kube-state-metrics Helm release bumped - to v7**.' - features: - - Optional **CRD upgrade job** (`crds.upgradeJob.enabled`) remains available - as an alternative to manually applying CRDs during upgrades. - - Updated bundled components via dependency bumps (notably kube-state-metrics - chart v7 in 80.2.0). - breaking_changes: - - '**CRD version change with Prometheus Operator v0.87.0**: you must upgrade - the `monitoring.coreos.com` CRDs before upgrading the chart, otherwise the - operator may not start or reconcile resources correctly.' - - "Potential behavior changes from **kube-state-metrics chart v7** (dependency\ - \ bump); if you have custom kube-state-metrics values, review that subchart\u2019\ - s changelog for any renamed/removed settings." + chart_updates: [Prometheus Operator bumped to **v0.87.0** in the 80.x line (from + the 79.x line)., 'Subchart dependency update in 80.2.0: **kube-state-metrics + Helm release bumped to v7**.'] + features: [Optional **CRD upgrade job** (`crds.upgradeJob.enabled`) remains + available as an alternative to manually applying CRDs during upgrades., + Updated bundled components via dependency bumps (notably kube-state-metrics + chart v7 in 80.2.0).] + breaking_changes: ['**CRD version change with Prometheus Operator v0.87.0**: + you must upgrade the `monitoring.coreos.com` CRDs before upgrading the chart, + otherwise the operator may not start or reconcile resources correctly.', + "Potential behavior changes from **kube-state-metrics chart v7** (dependency\ + \ bump); if you have custom kube-state-metrics values, review that subchart\u2019\ + s changelog for any renamed/removed settings."] chart_version: 80.2.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.87.0 - - quay.io/prometheus/alertmanager:v0.29.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:2.1.2', + 'quay.io/prometheus-operator/prometheus-operator:v0.87.0', 'quay.io/prometheus/alertmanager:v0.29.0', + 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.8.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 79.12.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'kube-prometheus-stack: updated etcd image digest to `cf5a571` (PR #6381).' - - 'kube-prometheus-stack 79.8.2: bumped `prometheus-node-exporter` chart dependency - to `v4.49.2` (PR #6358).' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['kube-prometheus-stack: updated etcd image digest to `cf5a571` + (PR #6381).', 'kube-prometheus-stack 79.8.2: bumped `prometheus-node-exporter` + chart dependency to `v4.49.2` (PR #6358).'] features: [] breaking_changes: [] chart_version: 79.12.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - quay.io/kiwigrid/k8s-sidecar:2.1.2 - - quay.io/prometheus-operator/prometheus-operator:v0.86.2 - - quay.io/prometheus/alertmanager:v0.29.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.8.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:2.1.2', + 'quay.io/prometheus-operator/prometheus-operator:v0.86.2', 'quay.io/prometheus/alertmanager:v0.29.0', + 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.8.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.5', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 79.8.2 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25'] requirements: [] incompatibilities: [] summary: null chart_version: 79.8.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.3.0 - - quay.io/kiwigrid/k8s-sidecar:1.30.10 - - quay.io/prometheus-operator/prometheus-operator:v0.86.2 - - quay.io/prometheus/alertmanager:v0.29.0 - - quay.io/prometheus/node-exporter:v1.10.2 - - quay.io/prometheus/prometheus:v3.7.3 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.3.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', + 'quay.io/prometheus-operator/prometheus-operator:v0.86.2', 'quay.io/prometheus/alertmanager:v0.29.0', + 'quay.io/prometheus/node-exporter:v1.10.2', 'quay.io/prometheus/prometheus:v3.7.3', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 79.5.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25'] requirements: [] incompatibilities: [] summary: null - version: 78.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No chart-specific changes are called out in the provided release notes for\ - \ either endpoint version; both releases are described only as \u201CUpdate\ - \ kube-prometheus-stack dependency non-major updates\u201D." - - Plan for routine dependency bumps across subcharts/images/dashboards/rules; - validate rendered manifests diff and run a canary upgrade in a non-prod cluster. - features: - - No explicit new features are listed in the provided notes; changes appear - to be dependency non-major updates only. - breaking_changes: - - No breaking changes are mentioned in the provided notes; treat as low-risk - but still verify CRDs and component compatibility after dependency bumps. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No chart-specific changes are called out in the provided release\ + \ notes for either endpoint version; both releases are described only as\ + \ \u201CUpdate kube-prometheus-stack dependency non-major updates\u201D.", + Plan for routine dependency bumps across subcharts/images/dashboards/rules; + validate rendered manifests diff and run a canary upgrade in a non-prod + cluster.] + features: [No explicit new features are listed in the provided notes; changes + appear to be dependency non-major updates only.] + breaking_changes: [No breaking changes are mentioned in the provided notes; + treat as low-risk but still verify CRDs and component compatibility after + dependency bumps.] chart_version: 78.5.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.2.0 - - quay.io/kiwigrid/k8s-sidecar:1.30.10 - - quay.io/prometheus-operator/prometheus-operator:v0.86.1 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.7.2 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', + 'quay.io/prometheus-operator/prometheus-operator:v0.86.1', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.7.2', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 77.14.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Both 76.5.1 and 77.14.0 release notes only mention \u201CUpdate kube-prometheus-stack\ - \ dependency non-major updates\u201D via Renovate; no explicit chart template/resource\ - \ changes are called out in the provided notes." - features: - - No new user-facing features are described in the provided release notes; changes - are limited to non-major dependency updates. - breaking_changes: - - No breaking changes are mentioned in the provided release notes. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Both 76.5.1 and 77.14.0 release notes only mention \u201CUpdate\ + \ kube-prometheus-stack dependency non-major updates\u201D via Renovate;\ + \ no explicit chart template/resource changes are called out in the provided\ + \ notes."] + features: [No new user-facing features are described in the provided release + notes; changes are limited to non-major dependency updates.] + breaking_changes: [No breaking changes are mentioned in the provided release + notes.] chart_version: 77.14.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.1.1 - - quay.io/kiwigrid/k8s-sidecar:1.30.10 - - quay.io/prometheus-operator/prometheus-operator:v0.85.0 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.6.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.10', + 'quay.io/prometheus-operator/prometheus-operator:v0.85.0', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.6.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0'] - version: 76.5.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '75.18.1: Fixes the `prometheus.additionalScrapeConfigs` example in chart - documentation/templates (no functional behavior change unless you were copying - the broken example).' - - "76.5.1: Updates kube-prometheus-stack chart dependencies with non-major version\ - \ bumps (via Renovate). This can change the rendered manifests due to upstream\ - \ chart changes even if this chart\u2019s own values schema is unchanged." + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['75.18.1: Fixes the `prometheus.additionalScrapeConfigs` example + in chart documentation/templates (no functional behavior change unless you + were copying the broken example).', "76.5.1: Updates kube-prometheus-stack\ + \ chart dependencies with non-major version bumps (via Renovate). This can\ + \ change the rendered manifests due to upstream chart changes even if this\ + \ chart\u2019s own values schema is unchanged."] features: [] breaking_changes: [] chart_version: 76.5.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.1.0 - - quay.io/kiwigrid/k8s-sidecar:1.30.3 - - quay.io/prometheus-operator/prometheus-operator:v0.84.1 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.5.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.3', + 'quay.io/prometheus-operator/prometheus-operator:v0.84.1', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.5.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 75.18.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '74.2.2: Bumps etcd image digest; CI/Chart.yaml bump behavior change; dependency - non-major updates via renovate.' - - '75.18.1: Fixes the Prometheus `additionalScrapeConfigs` example in the chart. - (Release notes only mention this change.)' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['74.2.2: Bumps etcd image digest; CI/Chart.yaml bump behavior + change; dependency non-major updates via renovate.', '75.18.1: Fixes the + Prometheus `additionalScrapeConfigs` example in the chart. (Release notes + only mention this change.)'] features: [] breaking_changes: [] chart_version: 75.18.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.1.0 - - quay.io/kiwigrid/k8s-sidecar:1.30.3 - - quay.io/prometheus-operator/prometheus-operator:v0.83.0 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.5.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.1.0', 'quay.io/kiwigrid/k8s-sidecar:1.30.3', + 'quay.io/prometheus-operator/prometheus-operator:v0.83.0', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.5.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 74.2.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Chart includes maintenance-level updates: updated etcd image digest; refreshed - kube-prometheus-stack dependency versions (non-major updates); CI/packaging - change to bump Chart.yaml when only subdirectories change.' - - 'From 73.2.3: changed default behavior to ignore EROFS (read-only filesystem) - errors by default (likely affects node-exporter/collector error handling).' - features: - - Improved robustness by ignoring EROFS errors by default (reduces noisy scrape/collector - errors on read-only filesystems). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Chart includes maintenance-level updates: updated etcd image + digest; refreshed kube-prometheus-stack dependency versions (non-major updates); + CI/packaging change to bump Chart.yaml when only subdirectories change.', + 'From 73.2.3: changed default behavior to ignore EROFS (read-only filesystem) + errors by default (likely affects node-exporter/collector error handling).'] + features: [Improved robustness by ignoring EROFS errors by default (reduces + noisy scrape/collector errors on read-only filesystems).] breaking_changes: [] chart_version: 74.2.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.0.1 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.83.0 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.4.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.83.0', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.4.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 73.2.3 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -26557,48 +20620,23 @@ addons: \ filesystem collector tweak**: Chart now **ignores `erofs` by default** (73.2.3).\ \ If you previously relied on `erofs` metrics, you may need to override the\ \ node-exporter filesystem ignore/mount filtering values to re-include it.\n" - chart_updates: - - Added ability to specify `matchConditions` for admission webhooks objects. - - Adjusted node-exporter defaults to ignore `erofs` filesystem type by default - (bugfix/defaults change). - features: - - Configurable `matchConditions` for admission webhooks, enabling more precise - selection of which API requests the webhook should evaluate. - breaking_changes: - - 'Potential behavior change: node-exporter will no longer report filesystem - metrics for `erofs` by default; environments using EROFS (e.g., some container/image - setups) may see those metrics disappear unless you override the ignore settings.' + chart_updates: [Added ability to specify `matchConditions` for admission webhooks + objects., Adjusted node-exporter defaults to ignore `erofs` filesystem type + by default (bugfix/defaults change).] + features: ['Configurable `matchConditions` for admission webhooks, enabling + more precise selection of which API requests the webhook should evaluate.'] + breaking_changes: ['Potential behavior change: node-exporter will no longer + report filesystem metrics for `erofs` by default; environments using EROFS + (e.g., some container/image setups) may see those metrics disappear unless + you override the ignore settings.'] chart_version: 73.2.3 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.0.1 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.82.2 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.4.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.82.2', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.4.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 72.9.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -26607,399 +20645,186 @@ addons: \ the chart\u2019s admission webhooks, review/extend your values to include\ \ this field where needed.\n\n_No other Helm values changes are called out\ \ in the provided notes._" - chart_updates: - - 'Chart **72.9.1**: adds support for configuring `matchConditions` on admission - webhook objects.' - - 'Chart **71.2.0**: CI tooling change (GitHub action version bump) and routine - non-major dependency updates (no functional chart behavior called out).' - features: - - Ability to set `matchConditions` for admission webhooks, allowing more granular - control over when the webhook is invoked. + chart_updates: ['Chart **72.9.1**: adds support for configuring `matchConditions` + on admission webhook objects.', 'Chart **71.2.0**: CI tooling change (GitHub + action version bump) and routine non-major dependency updates (no functional + chart behavior called out).'] + features: ['Ability to set `matchConditions` for admission webhooks, allowing + more granular control over when the webhook is invoked.'] breaking_changes: [] chart_version: 72.9.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:12.0.0-security-01 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.82.2 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.4.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:12.0.0-security-01', + 'quay.io/kiwigrid/k8s-sidecar:1.30.0', 'quay.io/prometheus-operator/prometheus-operator:v0.82.2', + 'quay.io/prometheus/alertmanager:v0.28.1', 'quay.io/prometheus/node-exporter:v1.9.1', + 'quay.io/prometheus/prometheus:v3.4.1', 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 71.2.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "The 70.10.0 \u2192 71.2.0 chart bump is primarily dependency refreshes (non\u2011\ - major) and CI workflow updates; no functional chart template changes are called\ - \ out in the provided release snippets." - features: - - No user-facing features are described in the provided 70.10.0 and 71.2.0 release - notes; changes are dependency/automation related. - breaking_changes: - - No breaking changes are mentioned in the provided release notes. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["The 70.10.0 \u2192 71.2.0 chart bump is primarily dependency\ + \ refreshes (non\u2011major) and CI workflow updates; no functional chart\ + \ template changes are called out in the provided release snippets."] + features: [No user-facing features are described in the provided 70.10.0 and + 71.2.0 release notes; changes are dependency/automation related.] + breaking_changes: [No breaking changes are mentioned in the provided release + notes.] chart_version: 71.2.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.6.1 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.82.0 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.3.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.6.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.82.0', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.3.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 70.10.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No chart template/value changes called out in the provided release notes for - this version jump. - - 70.10.0 notes indicate CI maintenance (actions/setup-python bump) and routine - dependency non-major updates via Renovate. - - 69.8.2 notes indicate an Alertmanager image/version bump to 0.28.1. - features: - - Alertmanager version updated to 0.28.1 (from the 69.8.2 notes in your snippets). - - Ongoing dependency refreshes in 70.10.0 (non-major) which may include patch/minor - updates of subcharts/images. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [No chart template/value changes called out in the provided release + notes for this version jump., 70.10.0 notes indicate CI maintenance (actions/setup-python + bump) and routine dependency non-major updates via Renovate., 69.8.2 notes + indicate an Alertmanager image/version bump to 0.28.1.] + features: [Alertmanager version updated to 0.28.1 (from the 69.8.2 notes in + your snippets)., Ongoing dependency refreshes in 70.10.0 (non-major) which + may include patch/minor updates of subcharts/images.] breaking_changes: [] chart_version: 70.10.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.6.1 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.81.0 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.1 - - quay.io/prometheus/prometheus:v3.3.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.6.1', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.81.0', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.1', 'quay.io/prometheus/prometheus:v3.3.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 69.8.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Regenerated kube-prometheus mixins as part of the chart content (dashboards/rules) - to fix the mixin update script and ensure generated artifacts are up to date - (68.5.0). - - Bumped bundled Alertmanager version to v0.28.1 (69.8.2). - features: - - Alertmanager updated to v0.28.1 as shipped with the chart (may include upstream - bugfixes and minor improvements from Alertmanager). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Regenerated kube-prometheus mixins as part of the chart content + (dashboards/rules) to fix the mixin update script and ensure generated artifacts + are up to date (68.5.0)., Bumped bundled Alertmanager version to v0.28.1 + (69.8.2).] + features: [Alertmanager updated to v0.28.1 as shipped with the chart (may include + upstream bugfixes and minor improvements from Alertmanager).] breaking_changes: [] chart_version: 69.8.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.5.2 - - quay.io/kiwigrid/k8s-sidecar:1.30.0 - - quay.io/prometheus-operator/prometheus-operator:v0.80.1 - - quay.io/prometheus/alertmanager:v0.28.1 - - quay.io/prometheus/node-exporter:v1.9.0 - - quay.io/prometheus/prometheus:v3.2.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.5.2', 'quay.io/kiwigrid/k8s-sidecar:1.30.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.80.1', 'quay.io/prometheus/alertmanager:v0.28.1', + 'quay.io/prometheus/node-exporter:v1.9.0', 'quay.io/prometheus/prometheus:v3.2.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 68.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '68.5.0: Fix the mixin update/regeneration script and regenerate mixins (dashboards/rules - artifacts).' - - '67.11.0: Add a configurable kubelet scrape flag (new chart option affecting - kubelet scraping configuration).' - features: - - New kubelet scrape flag option added (lets you control how/if kubelet is scraped). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['68.5.0: Fix the mixin update/regeneration script and regenerate + mixins (dashboards/rules artifacts).', '67.11.0: Add a configurable kubelet + scrape flag (new chart option affecting kubelet scraping configuration).'] + features: [New kubelet scrape flag option added (lets you control how/if kubelet + is scraped).] breaking_changes: [] chart_version: 68.5.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.4.1 - - quay.io/kiwigrid/k8s-sidecar:1.28.0 - - quay.io/prometheus-operator/prometheus-operator:v0.79.2 - - quay.io/prometheus/alertmanager:v0.28.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v3.1.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.79.2', 'quay.io/prometheus/alertmanager:v0.28.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v3.1.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] - version: 67.11.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '66.7.1: Chore/maintenance change to the kubelet ServiceMonitor (PR #5061) - to improve it (e.g., scraping/labels/endpoints behavior may be adjusted).' - - '67.11.0: Add a configurable kubelet scrape flag (PR #5136), enabling/disabling - kubelet scraping via values without needing to patch templates.' - features: - - New kubelet scrape flag/option so you can explicitly enable or disable kubelet - scraping from the chart values. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['66.7.1: Chore/maintenance change to the kubelet ServiceMonitor + (PR #5061) to improve it (e.g., scraping/labels/endpoints behavior may be + adjusted).', '67.11.0: Add a configurable kubelet scrape flag (PR #5136), + enabling/disabling kubelet scraping via values without needing to patch + templates.'] + features: [New kubelet scrape flag/option so you can explicitly enable or disable + kubelet scraping from the chart values.] breaking_changes: [] chart_version: 67.11.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.4.0 - - quay.io/kiwigrid/k8s-sidecar:1.28.0 - - quay.io/prometheus-operator/prometheus-operator:v0.79.2 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v3.1.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.79.2', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v3.1.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] - version: 66.7.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '65.8.1: Adds more information to the selector fields for `additionalPodMonitors` - and `additionalServiceMonitors` (PR #4974).' - - '66.7.1: Chore/change to improve the kubelet `ServiceMonitor` (PR #5061).' - features: - - Richer selector metadata/fields for `additionalPodMonitors` and `additionalServiceMonitors`, - which can make targeting and debugging custom monitors clearer. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['65.8.1: Adds more information to the selector fields for `additionalPodMonitors` + and `additionalServiceMonitors` (PR #4974).', '66.7.1: Chore/change to improve + the kubelet `ServiceMonitor` (PR #5061).'] + features: ['Richer selector metadata/fields for `additionalPodMonitors` and + `additionalServiceMonitors`, which can make targeting and debugging custom + monitors clearer.'] breaking_changes: [] chart_version: 66.7.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.4.0 - - quay.io/kiwigrid/k8s-sidecar:1.28.0 - - quay.io/prometheus-operator/prometheus-operator:v0.79.0 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v2.55.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.28.0', + 'quay.io/prometheus-operator/prometheus-operator:v0.79.0', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.55.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0'] - version: 65.8.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '64.0.0: Reverted the change "Add downward compat for Prom CRD" (#4883). This - affects how Prometheus CRD compatibility logic is handled in the chart/templates.' - - '65.8.1: Improved selector information for `additionalPodMonitors` and `additionalServiceMonitors` - (#4974), making selectors more explicit/verbose in rendered resources.' - features: - - More detailed/explicit selector fields for `additionalPodMonitors` and `additionalServiceMonitors`, - which can make monitor selection behavior easier to understand and troubleshoot. - breaking_changes: - - Potential behavioral change around Prometheus CRD "downward compatibility" - due to the revert in 64.0.0; if you relied on the previously-added compatibility - behavior, verify CRD versions/fields against your cluster and Prometheus Operator - expectations before upgrading. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['64.0.0: Reverted the change "Add downward compat for Prom CRD" + (#4883). This affects how Prometheus CRD compatibility logic is handled + in the chart/templates.', '65.8.1: Improved selector information for `additionalPodMonitors` + and `additionalServiceMonitors` (#4974), making selectors more explicit/verbose + in rendered resources.'] + features: ['More detailed/explicit selector fields for `additionalPodMonitors` + and `additionalServiceMonitors`, which can make monitor selection behavior + easier to understand and troubleshoot.'] + breaking_changes: ['Potential behavioral change around Prometheus CRD "downward + compatibility" due to the revert in 64.0.0; if you relied on the previously-added + compatibility behavior, verify CRD versions/fields against your cluster + and Prometheus Operator expectations before upgrading.'] chart_version: 65.8.1 images: [] - version: 64.0.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Reverted the prior change that added \u201Cdownward compatibility\u201D for\ - \ Prometheus CRDs (PR #4883 reverting PR #4818). This means the chart is no\ - \ longer attempting to accommodate older/newer Prometheus Operator CRD schemas\ - \ automatically; you must ensure your cluster CRDs match the operator/chart\ - \ expectations before/when upgrading." - features: - - (From 63.1.0) Added support for configuring `alertmanager.cluster.label` via - the chart, enabling better labeling/identification of Alertmanager clusters - in HA setups. - breaking_changes: - - Potential CRD compatibility impact due to reverting the Prometheus CRD downward-compatibility - logic; if you relied on that behavior for smoother upgrades/downgrades across - CRD versions, you may need to manage CRD upgrades explicitly and validate - Prometheus Operator/CRD versions during this chart upgrade. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Reverted the prior change that added \u201Cdownward compatibility\u201D\ + \ for Prometheus CRDs (PR #4883 reverting PR #4818). This means the chart\ + \ is no longer attempting to accommodate older/newer Prometheus Operator\ + \ CRD schemas automatically; you must ensure your cluster CRDs match the\ + \ operator/chart expectations before/when upgrading."] + features: ['(From 63.1.0) Added support for configuring `alertmanager.cluster.label` + via the chart, enabling better labeling/identification of Alertmanager clusters + in HA setups.'] + breaking_changes: ['Potential CRD compatibility impact due to reverting the + Prometheus CRD downward-compatibility logic; if you relied on that behavior + for smoother upgrades/downgrades across CRD versions, you may need to manage + CRD upgrades explicitly and validate Prometheus Operator/CRD versions during + this chart upgrade.'] chart_version: 64.0.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.2.1 - - quay.io/kiwigrid/k8s-sidecar:1.27.4 - - quay.io/prometheus-operator/prometheus-operator:v0.76.1 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v2.54.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.1', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', + 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] - version: 63.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -27012,47 +20837,22 @@ addons: \ an Alertmanager `cluster.label` (exact key not shown in the provided notes;\ \ confirm against the chart\u2019s `values.yaml` or PR #4877 if you plan to\ \ use it)." - chart_updates: - - '62.7.0: Added the ability to set ServiceAccount annotations for the Prometheus - Operator (PR #4820).' - - '63.1.0: Added support for Alertmanager `cluster.label` (PR #4877).' - features: - - Ability to add annotations to the Prometheus Operator ServiceAccount (useful - for workload identity/IAM bindings). - - Support for configuring an Alertmanager `cluster.label` to label cluster identity - in Alertmanager setups. + chart_updates: ['62.7.0: Added the ability to set ServiceAccount annotations + for the Prometheus Operator (PR #4820).', '63.1.0: Added support for Alertmanager + `cluster.label` (PR #4877).'] + features: [Ability to add annotations to the Prometheus Operator ServiceAccount + (useful for workload identity/IAM bindings)., Support for configuring an + Alertmanager `cluster.label` to label cluster identity in Alertmanager setups.] breaking_changes: [] chart_version: 63.1.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.2.0 - - quay.io/kiwigrid/k8s-sidecar:1.27.4 - - quay.io/prometheus-operator/prometheus-operator:v0.76.1 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v2.54.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', + 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] - version: 62.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -27063,92 +20863,42 @@ addons: \ 61.9.0 notes mention bumping Grafana chart dependencies to `8.4.*`. If your\ \ cluster pins/overrides Grafana chart versions, re-check that your overrides\ \ still apply cleanly after upgrading." - chart_updates: - - 'Added ability to set ServiceAccount annotations for the Prometheus Operator - (PR #4820).' - - Grafana chart dependency bumped to 8.4.* (noted in 61.9.0). - features: - - Can configure annotations on the Prometheus Operator ServiceAccount (useful - for IAM roles for service accounts, workload identity, custom auditing labels, - etc.). + chart_updates: ['Added ability to set ServiceAccount annotations for the Prometheus + Operator (PR #4820).', Grafana chart dependency bumped to 8.4.* (noted in + 61.9.0).] + features: ['Can configure annotations on the Prometheus Operator ServiceAccount + (useful for IAM roles for service accounts, workload identity, custom auditing + labels, etc.).'] breaking_changes: [] chart_version: 62.7.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.2.0 - - quay.io/kiwigrid/k8s-sidecar:1.27.4 - - quay.io/prometheus-operator/prometheus-operator:v0.76.1 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v2.54.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.2.0', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', + 'quay.io/prometheus-operator/prometheus-operator:v0.76.1', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] - version: 61.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Grafana dependency chart bumped to the 8.4.* series (as pulled in by kube-prometheus-stack - chart). - - Grafana subchart/templates updated to support dual-stack clusters (IPv4/IPv6) - in Grafana-related resources. - features: - - Grafana components now support dual-stack Kubernetes clusters (IPv4/IPv6) - via updated chart handling. - - Grafana dependency updated to 8.4.*, bringing in upstream fixes and improvements - from the Grafana Helm chart. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Grafana dependency chart bumped to the 8.4.* series (as pulled + in by kube-prometheus-stack chart)., Grafana subchart/templates updated + to support dual-stack clusters (IPv4/IPv6) in Grafana-related resources.] + features: [Grafana components now support dual-stack Kubernetes clusters (IPv4/IPv6) + via updated chart handling., 'Grafana dependency updated to 8.4.*, bringing + in upstream fixes and improvements from the Grafana Helm chart.'] breaking_changes: [] chart_version: 61.9.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.1.3 - - quay.io/kiwigrid/k8s-sidecar:1.27.4 - - quay.io/prometheus-operator/prometheus-operator:v0.75.2 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.2 - - quay.io/prometheus/prometheus:v2.54.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.1.3', 'quay.io/kiwigrid/k8s-sidecar:1.27.4', + 'quay.io/prometheus-operator/prometheus-operator:v0.75.2', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.2', 'quay.io/prometheus/prometheus:v2.54.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0'] - version: 60.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -27162,173 +20912,78 @@ addons: (IPv4/IPv6) clusters** in Grafana-related configuration (PR #4638). If you run dual-stack, validate/adjust Grafana service/network settings accordingly; otherwise no values change is typically required.' - chart_updates: - - Prometheus Operator integration updated to expose a PVC claim retention configuration - option (adds corresponding chart templating/values wiring). - - Grafana templates updated to better support dual-stack Kubernetes clusters. - features: - - Ability to configure PVC claim retention behavior through Prometheus Operator - settings (more control over whether PVCs are retained or deleted on resource - removal). - - Improved Grafana support for dual-stack Kubernetes clusters (better compatibility - in IPv4/IPv6 environments). + chart_updates: [Prometheus Operator integration updated to expose a PVC claim + retention configuration option (adds corresponding chart templating/values + wiring)., Grafana templates updated to better support dual-stack Kubernetes + clusters.] + features: [Ability to configure PVC claim retention behavior through Prometheus + Operator settings (more control over whether PVCs are retained or deleted + on resource removal)., Improved Grafana support for dual-stack Kubernetes + clusters (better compatibility in IPv4/IPv6 environments).] breaking_changes: [] chart_version: 60.5.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:11.0.0 - - quay.io/kiwigrid/k8s-sidecar:1.26.1 - - quay.io/prometheus-operator/prometheus-operator:v0.74.0 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.1 - - quay.io/prometheus/prometheus:v2.53.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:11.0.0', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', + 'quay.io/prometheus-operator/prometheus-operator:v0.74.0', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.1', 'quay.io/prometheus/prometheus:v2.53.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] - version: 59.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Adds support for setting the Prometheus Operator PVC claim retention field - via chart values (new option exposed by the chart). - - Fixes chart templating so `alertmanager.alertmanagerSpec.version` is set correctly - from values. - features: - - 'Prometheus Operator: chart now exposes a PVC claim retention setting so you - can control how Prometheus persistent volume claims are retained during scale-down/deletion - scenarios.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Adds support for setting the Prometheus Operator PVC claim retention + field via chart values (new option exposed by the chart)., Fixes chart templating + so `alertmanager.alertmanagerSpec.version` is set correctly from values.] + features: ['Prometheus Operator: chart now exposes a PVC claim retention setting + so you can control how Prometheus persistent volume claims are retained + during scale-down/deletion scenarios.'] breaking_changes: [] chart_version: 59.1.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.4.1 - - quay.io/kiwigrid/k8s-sidecar:1.26.1 - - quay.io/prometheus-operator/prometheus-operator:v0.74.0 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.0 - - quay.io/prometheus/prometheus:v2.52.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', + 'quay.io/prometheus-operator/prometheus-operator:v0.74.0', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.0', 'quay.io/prometheus/prometheus:v2.52.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] - version: 58.7.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - '57.2.1: Fixes an issue when using kube-state-metrics 2.11.0 (chart change - to restore compatibility).' - - '58.7.2: Fixes Alertmanager version wiring by correctly setting `alertManagerSpec.version`.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['57.2.1: Fixes an issue when using kube-state-metrics 2.11.0 + (chart change to restore compatibility).', '58.7.2: Fixes Alertmanager version + wiring by correctly setting `alertManagerSpec.version`.'] features: [] breaking_changes: [] chart_version: 58.7.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.4.1 - - quay.io/kiwigrid/k8s-sidecar:1.26.1 - - quay.io/prometheus-operator/prometheus-operator:v0.73.2 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.8.0 - - quay.io/prometheus/prometheus:v2.52.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.1', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', + 'quay.io/prometheus-operator/prometheus-operator:v0.73.2', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.8.0', 'quay.io/prometheus/prometheus:v2.52.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] - version: 57.2.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Fix issue with kube-state-metrics 2.11.0 (PR #4419).' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Fix issue with kube-state-metrics 2.11.0 (PR #4419).'] features: [] breaking_changes: [] chart_version: 57.2.1 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.4.0 - - quay.io/kiwigrid/k8s-sidecar:1.26.1 - - quay.io/prometheus-operator/prometheus-operator:v0.72.0 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.7.0 - - quay.io/prometheus/prometheus:v2.51.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.4.0', 'quay.io/kiwigrid/k8s-sidecar:1.26.1', + 'quay.io/prometheus-operator/prometheus-operator:v0.72.0', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.51.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0'] - version: 56.21.4 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -27341,103 +20996,49 @@ addons: bumps. ' - chart_updates: - - '55.11.0: Bumped the Grafana subchart to the 7.2.x series.' - - '56.21.4: Fixed the CoreDNS Grafana dashboard variables (removed circular - label filtering; refresh values on time range change).' - features: - - Grafana dependency updated to 7.2.x (via the kube-prometheus-stack chart). - - 'Improved CoreDNS Grafana dashboard behavior: variables no longer have circular - label filtering and refresh when the time range changes.' + chart_updates: ['55.11.0: Bumped the Grafana subchart to the 7.2.x series.', + '56.21.4: Fixed the CoreDNS Grafana dashboard variables (removed circular + label filtering; refresh values on time range change).'] + features: [Grafana dependency updated to 7.2.x (via the kube-prometheus-stack + chart)., 'Improved CoreDNS Grafana dashboard behavior: variables no longer + have circular label filtering and refresh when the time range changes.'] breaking_changes: [] chart_version: 56.21.4 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.3.3 - - quay.io/kiwigrid/k8s-sidecar:1.25.2 - - quay.io/prometheus-operator/prometheus-operator:v0.71.2 - - quay.io/prometheus/alertmanager:v0.27.0 - - quay.io/prometheus/node-exporter:v1.7.0 - - quay.io/prometheus/prometheus:v2.50.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.3.3', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', + 'quay.io/prometheus-operator/prometheus-operator:v0.71.2', 'quay.io/prometheus/alertmanager:v0.27.0', + 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.50.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] - version: 55.11.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped the Grafana subchart dependency to the 7.2.x series (kube-prometheus-stack - 55.11.0). - features: - - Grafana subchart updated to 7.2.x (new Grafana chart defaults/features may - apply). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped the Grafana subchart dependency to the 7.2.x series (kube-prometheus-stack + 55.11.0).] + features: [Grafana subchart updated to 7.2.x (new Grafana chart defaults/features + may apply).] breaking_changes: [] chart_version: 55.11.0 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.2.3 - - quay.io/kiwigrid/k8s-sidecar:1.25.2 - - quay.io/prometheus-operator/prometheus-operator:v0.70.0 - - quay.io/prometheus/alertmanager:v0.26.0 - - quay.io/prometheus/node-exporter:v1.7.0 - - quay.io/prometheus/prometheus:v2.48.1 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.2.3', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', + 'quay.io/prometheus-operator/prometheus-operator:v0.70.0', 'quay.io/prometheus/alertmanager:v0.26.0', + 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.48.1', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] - version: 54.2.2 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 54.2.2 - images: - - docker.io/bats/bats:v1.4.1 - - docker.io/grafana/grafana:10.1.5 - - quay.io/kiwigrid/k8s-sidecar:1.25.2 - - quay.io/prometheus-operator/prometheus-operator:v0.69.1 - - quay.io/prometheus/alertmanager:v0.26.0 - - quay.io/prometheus/node-exporter:v1.7.0 - - quay.io/prometheus/prometheus:v2.48.0 - - registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 - name: kube-prometheus-stack + images: ['docker.io/bats/bats:v1.4.1', 'docker.io/grafana/grafana:10.1.5', 'quay.io/kiwigrid/k8s-sidecar:1.25.2', + 'quay.io/prometheus-operator/prometheus-operator:v0.69.1', 'quay.io/prometheus/alertmanager:v0.26.0', + 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.48.0', + 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', + 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] - icon: https://avatars.githubusercontent.com/u/68448710?s=48&v=4 git_url: https://github.com/kyverno/kyverno release_url: https://github.com/kyverno/kyverno/releases/tag/v{vsn} @@ -27445,11 +21046,7 @@ addons: eolApiSlug: kyverno versions: - version: 1.16.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -27473,46 +21070,33 @@ addons: if you had workarounds for scoping issues, re-check your values overrides. ' - chart_updates: - - Introduced a standalone CRDs subchart/package for Kyverno CRDs, changing how - CRDs may be installed/managed during upgrades. - - Helm hooks were cleaned up and hook names shortened (less clutter, but may - affect scripts that referenced them). - - Helm chart gained configurable podAnnotations for Kyverno test pods. - - Migration job template updated to include new policy types. - - Fixed/adjusted helm templating to make a value global (scoping fix). - features: - - 'New namespaced policy types were introduced: NamespacedValidatingPolicy, - NamespacedImageValidatingPolicy, and NamespacedDeletingPolicy (useful for - delegating policy ownership to namespaces).' - - CEL policy API surface expanded with v1beta1 versions for ValidatingPolicy/ImageValidatingPolicy/MutatingPolicy/GeneratingPolicy/DeletingPolicy - and fine-grained CEL exceptions support. - - Webhooks can now be built using matchLabels defined in policy, and CEL policy - performance metrics were added for observability. - - Kyverno can bind to a hostIP when running in hostNetwork mode, improving flexibility - for networking constraints. - breaking_changes: - - Deprecated webhook was removed; if you relied on it (or had network policies/allowlists - targeting it), you must update to the supported webhook endpoints/configuration. - - UpdateRequest v1beta1 is now unserved; any clients/manifests still using that - version must be updated to a served version before/with the upgrade. + chart_updates: ['Introduced a standalone CRDs subchart/package for Kyverno CRDs, + changing how CRDs may be installed/managed during upgrades.', 'Helm hooks + were cleaned up and hook names shortened (less clutter, but may affect scripts + that referenced them).', Helm chart gained configurable podAnnotations for + Kyverno test pods., Migration job template updated to include new policy + types., Fixed/adjusted helm templating to make a value global (scoping fix).] + features: ['New namespaced policy types were introduced: NamespacedValidatingPolicy, + NamespacedImageValidatingPolicy, and NamespacedDeletingPolicy (useful for + delegating policy ownership to namespaces).', CEL policy API surface expanded + with v1beta1 versions for ValidatingPolicy/ImageValidatingPolicy/MutatingPolicy/GeneratingPolicy/DeletingPolicy + and fine-grained CEL exceptions support., 'Webhooks can now be built using + matchLabels defined in policy, and CEL policy performance metrics were added + for observability.', 'Kyverno can bind to a hostIP when running in hostNetwork + mode, improving flexibility for networking constraints.'] + breaking_changes: ['Deprecated webhook was removed; if you relied on it (or + had network policies/allowlists targeting it), you must update to the supported + webhook endpoints/configuration.', UpdateRequest v1beta1 is now unserved; + any clients/manifests still using that version must be updated to a served + version before/with the upgrade.] chart_version: 3.6.0 - images: - - curlimages/curl:8.10.1 - - reg.kyverno.io/kyverno/background-controller:v1.16.0 - - reg.kyverno.io/kyverno/cleanup-controller:v1.16.0 - - reg.kyverno.io/kyverno/kyverno-cli:v1.16.0 - - reg.kyverno.io/kyverno/kyverno:v1.16.0 - - reg.kyverno.io/kyverno/kyvernopre:v1.16.0 - - reg.kyverno.io/kyverno/reports-controller:v1.16.0 - - registry.k8s.io/kubectl:v1.32.7 + images: ['curlimages/curl:8.10.1', 'reg.kyverno.io/kyverno/background-controller:v1.16.0', + 'reg.kyverno.io/kyverno/cleanup-controller:v1.16.0', 'reg.kyverno.io/kyverno/kyverno-cli:v1.16.0', + 'reg.kyverno.io/kyverno/kyverno:v1.16.0', 'reg.kyverno.io/kyverno/kyvernopre:v1.16.0', + 'reg.kyverno.io/kyverno/reports-controller:v1.16.0', 'registry.k8s.io/kubectl:v1.32.7'] eolAt: '2026-08-20' - version: 1.15.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -27546,45 +21130,33 @@ addons: your downstream tooling consumes it. ' - chart_updates: - - Adds ServiceMonitor annotation support. - - Includes `mpol` and `gpol` CRDs in the Helm chart (and related CRD packaging - updates). - - Adds PDB `unhealthyPodEvictionPolicy` support. - - Adds ability to disable ServiceAccount token automount; adds `automountServiceAccountToken` - for Kyverno controllers. - - Adds Service `trafficDistribution` support (K8s 1.31+). - - Adds nodeSelector/tolerations support for test pod templates. - - Renders OpenReports resources and wires values to flags. - - 'Tooling bumps: helm/helm-docs version updates.' - features: - - 'Introduces new policy types/flows: **MutatingPolicy**, **GeneratingPolicy**, - and **DeletingPolicy** with admission flow, background reporting, and CLI - support (mutate existing, generate existing, cleanup).' - - Policy reports can be emitted in **OpenReports** format (alpha), replacing/transitioning - from prior report mechanisms. - - 'CLI improvements: `skipColor`, more test output formats (json/yaml/markdown/junit), - improved apply/test behaviors, and support for additional admission policy - types.' - breaking_changes: - - '**ValidatingAdmissionPolicy generation is enabled by default** in v1.15.0; - this can create additional Kubernetes resources and requires cluster permissions - and API availability.' - - "CEL function/operator rename: `image()` \u2192 `parseImageReference`, which\ - \ can break existing CEL expressions in policies." - - CLI deprecated APIs removed; older scripts/automation invoking removed flags/APIs - may need updates. - - Context is disabled when using CEL expressions in `validate` rules; policies - that depended on context + CEL together may behave differently. + chart_updates: [Adds ServiceMonitor annotation support., Includes `mpol` and + `gpol` CRDs in the Helm chart (and related CRD packaging updates)., Adds + PDB `unhealthyPodEvictionPolicy` support., Adds ability to disable ServiceAccount + token automount; adds `automountServiceAccountToken` for Kyverno controllers., + Adds Service `trafficDistribution` support (K8s 1.31+)., Adds nodeSelector/tolerations + support for test pod templates., Renders OpenReports resources and wires + values to flags., 'Tooling bumps: helm/helm-docs version updates.'] + features: ['Introduces new policy types/flows: **MutatingPolicy**, **GeneratingPolicy**, + and **DeletingPolicy** with admission flow, background reporting, and CLI + support (mutate existing, generate existing, cleanup).', 'Policy reports + can be emitted in **OpenReports** format (alpha), replacing/transitioning + from prior report mechanisms.', 'CLI improvements: `skipColor`, more test + output formats (json/yaml/markdown/junit), improved apply/test behaviors, + and support for additional admission policy types.'] + breaking_changes: ['**ValidatingAdmissionPolicy generation is enabled by default** + in v1.15.0; this can create additional Kubernetes resources and requires + cluster permissions and API availability.', "CEL function/operator rename:\ + \ `image()` \u2192 `parseImageReference`, which can break existing CEL expressions\ + \ in policies.", CLI deprecated APIs removed; older scripts/automation invoking + removed flags/APIs may need updates., Context is disabled when using CEL + expressions in `validate` rules; policies that depended on context + CEL + together may behave differently.] chart_version: 3.5.0 images: [] eolAt: '2026-04-29' - version: 1.14.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -27623,59 +21195,45 @@ addons: \ to `serviceAccountName`.\n- If you use custom RBAC patterns, review the\ \ new \u201Caggregate roles\u201D toggle.\n- If you want autoscaling for admission-controller,\ \ evaluate the new HPA values.\n" - chart_updates: - - 'Kyverno v1.13.0: chart removed wildcard view permissions and changed default - exception settings; multiple reporting/cleanup/report-type changes landed - including removal of old report types and disabling cleanup jobs by default.' - - 'Kyverno v1.13.0: Helm chart removed `cleanupJobs` values keys; added multiple - new configuration knobs (hostNetwork, global tolerations, imagePullSecrets, - resync periods, ports, annotations).' - - 'Kyverno v1.14.0: Helm chart added admission-controller HPA support, added - `dnsconfig`, switched to `serviceAccountName`, and introduced a toggle for - aggregating user-facing roles with Kyverno RBAC.' - features: - - 'v1.14: Introduced new policy types `ValidatingPolicy` and `ImageValidatingPolicy`, - including JSON payload support and auto-generation of Kubernetes `ValidatingAdmissionPolicy` - where applicable.' - - 'v1.14: Extended CEL support (libraries and the ability to reference `PolicyException` - in CEL), increasing expressiveness for validation logic.' - - 'v1.13: Significant enhancements to image verification (Cosign features like - TSA chain, signature algorithms, OCI 1.1 signatures, bundle verification) - and policy authoring (new `validate.assert`, `foreach` for generate, labelSelectors - for mutate targets).' - - 'v1.13: Reporting enhancements including richer results (custom data, more - rule types covered), new controller circuit breaker, and additional tunables - for report aggregation workers.' - breaking_changes: - - 'v1.13: RBAC hardening removed wildcard view permissions; Kyverno may no longer - be able to read all resources/CRDs by default. This can affect reports and - mutate/generate on custom resources unless additional RBAC is granted.' - - 'v1.13: Policy Exceptions are no longer enabled by default for all namespaces - due to CVE-2024-48921. If you relied on cluster-wide exceptions, you must - explicitly configure allowed namespaces.' - - 'v1.13: Several API migrations/deprecations occurred (e.g., moving validationFailureAction - fields into per-rule `validate.failureAction` and removal of `validatingadmissionpolicies` - v1alpha1). Validate CRDs and policy manifests against the new schema.' - - 'v1.13: Report types and cleanup behavior changed (old intermediate report - types removed; cleanup jobs disabled by default; some cleanup cronjobs removed). - If you had automation depending on those objects/jobs, update it.' + chart_updates: ['Kyverno v1.13.0: chart removed wildcard view permissions and + changed default exception settings; multiple reporting/cleanup/report-type + changes landed including removal of old report types and disabling cleanup + jobs by default.', 'Kyverno v1.13.0: Helm chart removed `cleanupJobs` values + keys; added multiple new configuration knobs (hostNetwork, global tolerations, + imagePullSecrets, resync periods, ports, annotations).', 'Kyverno v1.14.0: + Helm chart added admission-controller HPA support, added `dnsconfig`, switched + to `serviceAccountName`, and introduced a toggle for aggregating user-facing + roles with Kyverno RBAC.'] + features: ['v1.14: Introduced new policy types `ValidatingPolicy` and `ImageValidatingPolicy`, + including JSON payload support and auto-generation of Kubernetes `ValidatingAdmissionPolicy` + where applicable.', 'v1.14: Extended CEL support (libraries and the ability + to reference `PolicyException` in CEL), increasing expressiveness for validation + logic.', 'v1.13: Significant enhancements to image verification (Cosign + features like TSA chain, signature algorithms, OCI 1.1 signatures, bundle + verification) and policy authoring (new `validate.assert`, `foreach` for + generate, labelSelectors for mutate targets).', 'v1.13: Reporting enhancements + including richer results (custom data, more rule types covered), new controller + circuit breaker, and additional tunables for report aggregation workers.'] + breaking_changes: ['v1.13: RBAC hardening removed wildcard view permissions; + Kyverno may no longer be able to read all resources/CRDs by default. This + can affect reports and mutate/generate on custom resources unless additional + RBAC is granted.', 'v1.13: Policy Exceptions are no longer enabled by default + for all namespaces due to CVE-2024-48921. If you relied on cluster-wide + exceptions, you must explicitly configure allowed namespaces.', 'v1.13: + Several API migrations/deprecations occurred (e.g., moving validationFailureAction + fields into per-rule `validate.failureAction` and removal of `validatingadmissionpolicies` + v1alpha1). Validate CRDs and policy manifests against the new schema.', + 'v1.13: Report types and cleanup behavior changed (old intermediate report + types removed; cleanup jobs disabled by default; some cleanup cronjobs removed). + If you had automation depending on those objects/jobs, update it.'] chart_version: 3.4.0 - images: - - bitnami/kubectl:1.32.3 - - busybox:1.35 - - reg.kyverno.io/kyverno/background-controller:v1.14.0 - - reg.kyverno.io/kyverno/cleanup-controller:v1.14.0 - - reg.kyverno.io/kyverno/kyverno-cli:v1.14.0 - - reg.kyverno.io/kyverno/kyverno:v1.14.0 - - reg.kyverno.io/kyverno/kyvernopre:v1.14.0 - - reg.kyverno.io/kyverno/reports-controller:v1.14.0 + images: ['bitnami/kubectl:1.32.3', 'busybox:1.35', 'reg.kyverno.io/kyverno/background-controller:v1.14.0', + 'reg.kyverno.io/kyverno/cleanup-controller:v1.14.0', 'reg.kyverno.io/kyverno/kyverno-cli:v1.14.0', + 'reg.kyverno.io/kyverno/kyverno:v1.14.0', 'reg.kyverno.io/kyverno/kyvernopre:v1.14.0', + 'reg.kyverno.io/kyverno/reports-controller:v1.14.0'] eolAt: '2026-02-02' - version: 1.13.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -27712,63 +21270,45 @@ addons: \ value key names aren\u2019t present in the snippet; compare your current\ \ `values.yaml` to the 1.13 chart `values.yaml` and run `helm diff upgrade`\ \ to confirm the precise paths." - chart_updates: - - 'Security posture tightened: exceptions default scope reduced (CVE-2024-48921 - guidance).' - - 'RBAC hardening: wildcard view permissions removed; binding to default `view` - role added.' - - Removed intermediate report types (`admissionreports`, `backgroundscanreports`) - and older report artifacts removed from the chart; cleanup jobs disabled by - default and several cleanup cronjobs removed. - - 'Reports architecture changed: removed report chunking and other report aggregation - behaviors; reports controller gains circuit breaker and new worker configuration - flag.' - - 'Helm templates updated: flowcontrol API updated to v1; Grafana dashboards - updated (Grafana 11 support, metric rename); Service/port and annotations - configurability expanded.' - features: - - 'Policy reporting improvements: `validate.podSecurity` now records control - names/images in reports and custom data can be added to policy reports.' - - 'Image verification expanded: supports multiple attestations/context entries, - TSA cert chain support, signature algorithm selection, full regexp support, - Sigstore bundle verification, and OCI 1.1 signatures.' - - 'Policy Exceptions enhancements: can be generated from policy reports; CLI - supports inline exceptions and apply can continue-on-failure.' - - 'Admission experience: warnings for policy violations/mutations can be emitted - during admission reviews.' - - 'Generate/mutate enhancements: `foreach` support for generate policies, labelSelectors - for mutate targets, `dumpPatch` option, and reporting added for mutate/generate - rules.' - breaking_changes: - - 'RBAC breaking change: wildcard view permissions removed; Kyverno may no longer - be able to read some custom resources, affecting reports and some mutate/generate - policies unless you grant explicit RBAC.' - - 'Helm breaking change: exception defaults changed (no longer enabled for all - namespaces by default); clusters relying on broad exception enablement must - explicitly configure it.' - - 'Helm breaking change: `cleanupJobs` values keys removed; existing values - will be ignored and must be migrated/removed.' - - 'API migrations in policy schema: `spec.validationFailureAction` and overrides - moved down to rule-level fields; other API fields migrated (generateExisting, - mutateExistingOnPolicyUpdate, webhookTimeoutSeconds, failurePolicy), and VAP - v1alpha1 removed in favor of v1beta1.' + chart_updates: ['Security posture tightened: exceptions default scope reduced + (CVE-2024-48921 guidance).', 'RBAC hardening: wildcard view permissions + removed; binding to default `view` role added.', 'Removed intermediate report + types (`admissionreports`, `backgroundscanreports`) and older report artifacts + removed from the chart; cleanup jobs disabled by default and several cleanup + cronjobs removed.', 'Reports architecture changed: removed report chunking + and other report aggregation behaviors; reports controller gains circuit + breaker and new worker configuration flag.', 'Helm templates updated: flowcontrol + API updated to v1; Grafana dashboards updated (Grafana 11 support, metric + rename); Service/port and annotations configurability expanded.'] + features: ['Policy reporting improvements: `validate.podSecurity` now records + control names/images in reports and custom data can be added to policy reports.', + 'Image verification expanded: supports multiple attestations/context entries, + TSA cert chain support, signature algorithm selection, full regexp support, + Sigstore bundle verification, and OCI 1.1 signatures.', 'Policy Exceptions + enhancements: can be generated from policy reports; CLI supports inline + exceptions and apply can continue-on-failure.', 'Admission experience: warnings + for policy violations/mutations can be emitted during admission reviews.', + 'Generate/mutate enhancements: `foreach` support for generate policies, labelSelectors + for mutate targets, `dumpPatch` option, and reporting added for mutate/generate + rules.'] + breaking_changes: ['RBAC breaking change: wildcard view permissions removed; + Kyverno may no longer be able to read some custom resources, affecting reports + and some mutate/generate policies unless you grant explicit RBAC.', 'Helm + breaking change: exception defaults changed (no longer enabled for all namespaces + by default); clusters relying on broad exception enablement must explicitly + configure it.', 'Helm breaking change: `cleanupJobs` values keys removed; + existing values will be ignored and must be migrated/removed.', 'API migrations + in policy schema: `spec.validationFailureAction` and overrides moved down + to rule-level fields; other API fields migrated (generateExisting, mutateExistingOnPolicyUpdate, + webhookTimeoutSeconds, failurePolicy), and VAP v1alpha1 removed in favor + of v1beta1.'] chart_version: 3.3.2 - images: - - bitnami/kubectl:1.30.2 - - busybox:1.35 - - ghcr.io/kyverno/background-controller:v1.13.0 - - ghcr.io/kyverno/cleanup-controller:v1.13.0 - - ghcr.io/kyverno/kyverno-cli:v1.13.0 - - ghcr.io/kyverno/kyverno:v1.13.0 - - ghcr.io/kyverno/kyvernopre:v1.13.0 - - ghcr.io/kyverno/reports-controller:v1.13.0 + images: ['bitnami/kubectl:1.30.2', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.13.0', + 'ghcr.io/kyverno/cleanup-controller:v1.13.0', 'ghcr.io/kyverno/kyverno-cli:v1.13.0', + 'ghcr.io/kyverno/kyverno:v1.13.0', 'ghcr.io/kyverno/kyvernopre:v1.13.0', 'ghcr.io/kyverno/reports-controller:v1.13.0'] eolAt: '2025-11-10' - version: 1.12.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' + kube: ['1.29', '1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -27797,54 +21337,39 @@ addons: \ versions. Ensure hook jobs can run (RBAC, imagePull, PodSecurity, network\ \ policies) and that Argo CD/Flux allow hooks.\n - Sanity checks added for\ \ **CRD/controller mismatch** when deploying specific controllers/CRDs.\n" - chart_updates: - - Introduces CRD migration hooks to move existing Kyverno custom resources to - new storage versions (aligns with multiple APIs graduating to v2). - - Tightens RBAC by removing wildcard permissions; expect more granular ClusterRoles/RoleBindings. - - Adds defaults and knobs to reduce Event and webhook scope noise (omit certain - Events by default; default webhook exclusions). - - 'Multiple chart ergonomics improvements: global nodeSelector/extraEnvVars, - CA bundle support, job backoff tuning, webhook labeling, profiling enablement, - revisionHistoryLimit.' - - Renames bundled Grafana dashboard artifact to `kyverno-dashboard.json`. - features: - - Global resource caching via new `GlobalContextEntry` CRD, enabling reuse of - cached resources across policy evaluations. - - More flexible and narrower webhook scope configuration, including support - for Kubernetes 1.27+ CEL-based `matchConditions`. - - 'Policy Exceptions enhanced: support conditions, exclude specific Pod Security - controls, and be applied to existing resources when created (behavioral change).' - - New ephemeral report kinds (`EphemeralReports`, `ClusterEphemeralReports`) - under new `reports.kyverno.io` API group to support the revamped reports pipeline. - - 'CLI additions: `migrate` command to upgrade Kyverno resources to current - APIs; experimental `json` command; improved `test/apply` support for Policy - Exceptions and VAP bindings.' - breaking_changes: - - "Policies using long-deprecated/invalid operators in conditions (e.g., `In`,\ - \ `NotIn`) will now be blocked\u2014validate and update policies before upgrading." - - Multiple Kyverno CRDs/APIs graduate to **v2** (Policy Exceptions, Cleanup - Policies, Reports APIs, UpdateRequests). Existing CRs may need migration; - use Helm hook migrations or `kyverno cli migrate` and plan for CRD updates. - - 'Operational caution: Kyverno 1.12.0 had known critical issues; upstream recommends - upgrading to at least **v1.12.1** (and for ephemeralreports piling up, **v1.12.4**) - rather than staying on 1.12.0.' + chart_updates: [Introduces CRD migration hooks to move existing Kyverno custom + resources to new storage versions (aligns with multiple APIs graduating + to v2)., Tightens RBAC by removing wildcard permissions; expect more granular + ClusterRoles/RoleBindings., Adds defaults and knobs to reduce Event and + webhook scope noise (omit certain Events by default; default webhook exclusions)., + 'Multiple chart ergonomics improvements: global nodeSelector/extraEnvVars, + CA bundle support, job backoff tuning, webhook labeling, profiling enablement, + revisionHistoryLimit.', Renames bundled Grafana dashboard artifact to `kyverno-dashboard.json`.] + features: ['Global resource caching via new `GlobalContextEntry` CRD, enabling + reuse of cached resources across policy evaluations.', 'More flexible and + narrower webhook scope configuration, including support for Kubernetes 1.27+ + CEL-based `matchConditions`.', 'Policy Exceptions enhanced: support conditions, + exclude specific Pod Security controls, and be applied to existing resources + when created (behavioral change).', 'New ephemeral report kinds (`EphemeralReports`, + `ClusterEphemeralReports`) under new `reports.kyverno.io` API group to support + the revamped reports pipeline.', 'CLI additions: `migrate` command to upgrade + Kyverno resources to current APIs; experimental `json` command; improved + `test/apply` support for Policy Exceptions and VAP bindings.'] + breaking_changes: ["Policies using long-deprecated/invalid operators in conditions\ + \ (e.g., `In`, `NotIn`) will now be blocked\u2014validate and update policies\ + \ before upgrading.", 'Multiple Kyverno CRDs/APIs graduate to **v2** (Policy + Exceptions, Cleanup Policies, Reports APIs, UpdateRequests). Existing CRs + may need migration; use Helm hook migrations or `kyverno cli migrate` and + plan for CRD updates.', 'Operational caution: Kyverno 1.12.0 had known critical + issues; upstream recommends upgrading to at least **v1.12.1** (and for ephemeralreports + piling up, **v1.12.4**) rather than staying on 1.12.0.'] chart_version: 3.2.0 - images: - - bitnami/kubectl:1.28.5 - - busybox:1.35 - - ghcr.io/kyverno/background-controller:v1.12.0 - - ghcr.io/kyverno/cleanup-controller:v1.12.0 - - ghcr.io/kyverno/kyverno-cli:v1.12.0 - - ghcr.io/kyverno/kyverno:v1.12.0 - - ghcr.io/kyverno/kyvernopre:v1.12.0 - - ghcr.io/kyverno/reports-controller:v1.12.0 + images: ['bitnami/kubectl:1.28.5', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.12.0', + 'ghcr.io/kyverno/cleanup-controller:v1.12.0', 'ghcr.io/kyverno/kyverno-cli:v1.12.0', + 'ghcr.io/kyverno/kyverno:v1.12.0', 'ghcr.io/kyverno/kyvernopre:v1.12.0', 'ghcr.io/kyverno/reports-controller:v1.12.0'] eolAt: '2025-07-31' - version: 1.11.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -27874,59 +21399,44 @@ addons: \ unrelated workloads).\n- Replica fields validated more safely (non-integer\ \ handling).\n- RBAC fixes for PolicyExceptions and Secrets access in background\ \ controller.\n- Added/adjusted PDB enablement values.\n" - chart_updates: - - CRDs moved to a dedicated subchart to reduce main chart size and change how - CRDs are installed/managed during upgrades. - - Grafana dashboard content moved to its own subchart to avoid Helm secret size - issues and reduce main chart footprint. - - Chart now includes Kubernetes API Priority & Fairness objects (FlowSchema/PriorityLevelConfiguration). - - Introduced a global image registry value to simplify image overrides across - controllers. - - Webhook cleanup job supports configurable security contexts; multiple Helm - fixes around hooks, RBAC, replicas, and PDB enablement. - features: - - 'ValidatingAdmissionPolicy (VAP) support (alpha): Kyverno can work with Kubernetes - VAPs, including generating VAPs from compatible `validate.cel` rules and producing - PolicyReports from VAP evaluations.' - - 'CEL-based validation rules: you can author Kyverno validate rules using CEL, - with autogen support, and optionally have Kyverno generate/manage matching - VAPs.' - - PolicyReports are now generated per-resource (UID-named) instead of per-policy, - reducing API server/etcd pressure and improving scalability. - - New cleanup mechanism via reserved label `cleanup.kyverno.io/ttl`, allowing - resources to be cleaned up based on a TTL label rather than scheduled CronJobs. - - 'Image verification updates: Cosign 2.0 support, Notary/OCI 1.1 updates, signature - verification caching, and improved registry credential configuration via `imageRegistryCredentials`.' - - 'CLI improvements: major refactor, formal test manifest schema, ability to - test VAPs, new `create` commands to scaffold test resources, and improved - `apply` output.' - breaking_changes: - - 'PolicyReports behavior change: reports are now per-resource and named by - UID rather than per-policy; any tooling/alerts/dashboards that assumed old - naming or aggregation may break.' - - 'Cosign policy requirement change: Rekor URL must be present (may be empty - string). If you previously did not use Rekor, you may need to explicitly disable - transparency log and SCT verification via `rekor.ignoreTlogs` and `ctlog.IgnoreSCT` - in policies to avoid failures.' - - (Operational/behavioral change) Cleanup policies no longer use CronJobs; cleanup - is handled internally, which can affect expectations around CronJob presence - and scheduling visibility. + chart_updates: [CRDs moved to a dedicated subchart to reduce main chart size + and change how CRDs are installed/managed during upgrades., Grafana dashboard + content moved to its own subchart to avoid Helm secret size issues and reduce + main chart footprint., Chart now includes Kubernetes API Priority & Fairness + objects (FlowSchema/PriorityLevelConfiguration)., Introduced a global image + registry value to simplify image overrides across controllers., 'Webhook + cleanup job supports configurable security contexts; multiple Helm fixes + around hooks, RBAC, replicas, and PDB enablement.'] + features: ['ValidatingAdmissionPolicy (VAP) support (alpha): Kyverno can work + with Kubernetes VAPs, including generating VAPs from compatible `validate.cel` + rules and producing PolicyReports from VAP evaluations.', 'CEL-based validation + rules: you can author Kyverno validate rules using CEL, with autogen support, + and optionally have Kyverno generate/manage matching VAPs.', 'PolicyReports + are now generated per-resource (UID-named) instead of per-policy, reducing + API server/etcd pressure and improving scalability.', 'New cleanup mechanism + via reserved label `cleanup.kyverno.io/ttl`, allowing resources to be cleaned + up based on a TTL label rather than scheduled CronJobs.', 'Image verification + updates: Cosign 2.0 support, Notary/OCI 1.1 updates, signature verification + caching, and improved registry credential configuration via `imageRegistryCredentials`.', + 'CLI improvements: major refactor, formal test manifest schema, ability to + test VAPs, new `create` commands to scaffold test resources, and improved + `apply` output.'] + breaking_changes: ['PolicyReports behavior change: reports are now per-resource + and named by UID rather than per-policy; any tooling/alerts/dashboards that + assumed old naming or aggregation may break.', 'Cosign policy requirement + change: Rekor URL must be present (may be empty string). If you previously + did not use Rekor, you may need to explicitly disable transparency log and + SCT verification via `rekor.ignoreTlogs` and `ctlog.IgnoreSCT` in policies + to avoid failures.', '(Operational/behavioral change) Cleanup policies no + longer use CronJobs; cleanup is handled internally, which can affect expectations + around CronJob presence and scheduling visibility.'] chart_version: 3.1.0 - images: - - bitnami/kubectl:1.26.10 - - bitnami/kubectl:1.26.4 - - busybox:1.35 - - ghcr.io/kyverno/background-controller:v1.11.0 - - ghcr.io/kyverno/cleanup-controller:v1.11.0 - - ghcr.io/kyverno/kyverno:v1.11.0 - - ghcr.io/kyverno/kyvernopre:v1.11.0 - - ghcr.io/kyverno/reports-controller:v1.11.0 + images: ['bitnami/kubectl:1.26.10', 'bitnami/kubectl:1.26.4', 'busybox:1.35', + 'ghcr.io/kyverno/background-controller:v1.11.0', 'ghcr.io/kyverno/cleanup-controller:v1.11.0', + 'ghcr.io/kyverno/kyverno:v1.11.0', 'ghcr.io/kyverno/kyvernopre:v1.11.0', 'ghcr.io/kyverno/reports-controller:v1.11.0'] eolAt: '2025-04-25' - version: 1.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -27956,72 +21466,55 @@ addons: \ no longer overuses `kyverno.fullname`; uses `.Release.Name`/instance labels\ \ more consistently.\n - Ensure any custom selectors/NetworkPolicies/ServiceMonitors\ \ that referenced the old labels/names are updated.\n" - chart_updates: - - Chart migrates from v2 to v3 to support Kyverno 1.10 architectural split (single - Deployment -> multiple controllers). - - Chart values are reorganized per controller (admission/reports/background) - and supplemented with a higher-level `features` configuration section. - - 'Helm templates/refactoring: configmap management, RBAC/role aggregation, - tests, labels, network policies, and CRD handling were substantially reworked.' - - 'Deployment naming updates: admission controller Deployment renamed to `kyverno-admission-controller`; - additional controllers added.' - - 'Operational hardening: chart enforces at least 1 replica for the admission - controller.' - - 'Improved configurability: ServiceAccount annotations supported for all SAs; - configurable Grafana ConfigMap name; configurable PDB API version; configurable - Sigstore TUF root volume.' - - 'Monitoring fixes/additions: missing ServiceMonitor for background controller - added; various Helm hook/imagePullSecret propagation fixes.' - features: - - Kyverno is split into three controllers (admission, background, reports), - improving separation of responsibilities and scaling options. - - Kyverno policies can now make authenticated calls to in-cluster Services (with - verb control), enabling richer external-data and integration patterns. - - VerifyImages gains Notary signature verification support in addition to existing - Cosign flows. - - Mutate-existing rules now support context variables and preconditions, enabling - more expressive background mutations. - - PolicyExceptions now support background scanning and wildcard ruleNames for - broader exception handling. - - New JMESPath helpers (e.g., `image_normalize()`, `to_boolean()`, `trim_prefix()`, - enhanced `sum()`) expand policy authoring options. - - Performance improvements to reporting aggregation (higher workers/QPS/burst - and new cleanup jobs) reduce delays in large clusters. - breaking_changes: - - "**No direct in-place upgrade path** from 1.9 to 1.10 due to controller decomposition;\ - \ plan downtime and use Helm v2\u2192v3 migration steps (backup/restore policies\ - \ or scale Kyverno to 0 first)." - - "Aggregated ClusterRoles may need updates to match **new label selectors**\ - \ for the decomposed controllers\u2019 RBAC aggregation." - - Policies matching subresources must use the standardized `Parent/subresource` - form (e.g., `Pod/exec`); some subresource matches will be rejected when background - scanning is enabled. - - 'Generate rules: several fields are now **immutable** after creation and certain - variable usages are disallowed; additionally `generate.apiVersion` is now - **required**.' - - 'Generate-existing behavior changes: `spec.generateExistingOnPolicyUpdate` - is deprecated in favor of `spec.generateExisting`; update policies accordingly.' - - 'Mutate existing enforcement: when `mutateExistingOnPolicyUpdate=true`, `mutate.targets[]` - must be defined or policy creation is blocked.' - - 'VerifyImages in Audit mode: policy creation is rejected unless `mutateDigest=false`.' - - 'Mutation behavior change: Kyverno no longer implicitly adds `docker.io` to - image context; adjust policies to use `images.*.registry` or `image_normalize()` - instead.' + chart_updates: [Chart migrates from v2 to v3 to support Kyverno 1.10 architectural + split (single Deployment -> multiple controllers)., Chart values are reorganized + per controller (admission/reports/background) and supplemented with a higher-level + `features` configuration section., 'Helm templates/refactoring: configmap + management, RBAC/role aggregation, tests, labels, network policies, and + CRD handling were substantially reworked.', 'Deployment naming updates: + admission controller Deployment renamed to `kyverno-admission-controller`; + additional controllers added.', 'Operational hardening: chart enforces at + least 1 replica for the admission controller.', 'Improved configurability: + ServiceAccount annotations supported for all SAs; configurable Grafana ConfigMap + name; configurable PDB API version; configurable Sigstore TUF root volume.', + 'Monitoring fixes/additions: missing ServiceMonitor for background controller + added; various Helm hook/imagePullSecret propagation fixes.'] + features: ['Kyverno is split into three controllers (admission, background, + reports), improving separation of responsibilities and scaling options.', + 'Kyverno policies can now make authenticated calls to in-cluster Services + (with verb control), enabling richer external-data and integration patterns.', + VerifyImages gains Notary signature verification support in addition to existing + Cosign flows., 'Mutate-existing rules now support context variables and + preconditions, enabling more expressive background mutations.', PolicyExceptions + now support background scanning and wildcard ruleNames for broader exception + handling., 'New JMESPath helpers (e.g., `image_normalize()`, `to_boolean()`, + `trim_prefix()`, enhanced `sum()`) expand policy authoring options.', Performance + improvements to reporting aggregation (higher workers/QPS/burst and new + cleanup jobs) reduce delays in large clusters.] + breaking_changes: ["**No direct in-place upgrade path** from 1.9 to 1.10 due\ + \ to controller decomposition; plan downtime and use Helm v2\u2192v3 migration\ + \ steps (backup/restore policies or scale Kyverno to 0 first).", "Aggregated\ + \ ClusterRoles may need updates to match **new label selectors** for the\ + \ decomposed controllers\u2019 RBAC aggregation.", 'Policies matching subresources + must use the standardized `Parent/subresource` form (e.g., `Pod/exec`); + some subresource matches will be rejected when background scanning is enabled.', + 'Generate rules: several fields are now **immutable** after creation and certain + variable usages are disallowed; additionally `generate.apiVersion` is now + **required**.', 'Generate-existing behavior changes: `spec.generateExistingOnPolicyUpdate` + is deprecated in favor of `spec.generateExisting`; update policies accordingly.', + 'Mutate existing enforcement: when `mutateExistingOnPolicyUpdate=true`, `mutate.targets[]` + must be defined or policy creation is blocked.', 'VerifyImages in Audit + mode: policy creation is rejected unless `mutateDigest=false`.', 'Mutation + behavior change: Kyverno no longer implicitly adds `docker.io` to image + context; adjust policies to use `images.*.registry` or `image_normalize()` + instead.'] chart_version: 3.0.0 - images: - - bitnami/kubectl:1.26.4 - - busybox:1.35 - - ghcr.io/kyverno/background-controller:v1.10.0 - - ghcr.io/kyverno/cleanup-controller:v1.10.0 - - ghcr.io/kyverno/kyverno:v1.10.0 - - ghcr.io/kyverno/kyvernopre:v1.10.0 - - ghcr.io/kyverno/reports-controller:v1.10.0 + images: ['bitnami/kubectl:1.26.4', 'busybox:1.35', 'ghcr.io/kyverno/background-controller:v1.10.0', + 'ghcr.io/kyverno/cleanup-controller:v1.10.0', 'ghcr.io/kyverno/kyverno:v1.10.0', + 'ghcr.io/kyverno/kyvernopre:v1.10.0', 'ghcr.io/kyverno/reports-controller:v1.10.0'] eolAt: '2024-10-29' - version: 1.9.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -28047,65 +21540,49 @@ addons: \ `_` instead of `+` to avoid Flux reconciliation failures (relevant if you\ \ use Flux and versions with build metadata).\n - Helm test pod busybox image\ \ is pinned; initContainer extraArgs handling fixed.\n" - chart_updates: - - 'Reports system and CRDs were overhauled in 1.8: `ReportChangeRequest`/`ClusterReportChangeRequest` - removed and replaced with `AdmissionReport`, `ClusterAdmissionReport`, `BackgroundScanReport`, - `ClusterBackgroundScanReport` CRDs. Ensure CRDs are updated as part of the - upgrade and any tooling consuming old CRDs is updated.' - - Kyverno introduced/advanced the **v2beta1** API for Kyverno resources, intended - to remove deprecated fields/types. Plan a migration path for policies using - deprecated fields. - - 'Autogen behavior changed: in 1.8 autogen moved to `status` (not `spec`) and - is enabled by default; in 1.9 the deprecated `--autogenInternals` flag is - removed and the behavior is automatic.' - - 'Webhooks behavior changed in 1.9: separate webhook rules per GVK; AdmissionReview - v1 is used instead of v1beta1. This may affect clusters/components expecting - v1beta1 AdmissionReview.' - - 'New alpha CRDs/resources added in 1.9: **PolicyException** and **CleanupPolicy** - (and associated cleanup controller components when enabled).' - features: - - PolicyException (alpha) to define exceptions to policy enforcement without - editing the policy itself. - - CleanupPolicy (alpha) to automate cleanup/removal of resources matching criteria, - delivered with an optional cleanup controller. - - Distributed tracing improvements building on OpenTelemetry support, enabling - better end-to-end request visibility. - - Nested `foreach` loops in policies for more complex iteration logic. - - Extended subresource support in webhook and CLI for validation/mutation across - more Kubernetes subresources. - - ConfigMap caching to improve performance and reduce API load for repeated - ConfigMap lookups. - - 'CLI enhancements: dump AdmissionReview payload, audit/warn flags, accept - policies via stdin/pipes, git repo policy sources, and experimental OCI push/pull - of policies.' - - 'verifyImages enhancements: key signature algorithm selection, attestations - attestors, and (Helm) support for existing imagePullSecrets.' - - Kubernetes version support extended (1.25 in 1.8, 1.26 in 1.9). - breaking_changes: - - 'JMESPath behavior change (introduced in 1.8): unresolved expressions now - evaluate to `null` instead of empty string; some policies may need explicit - existence checks to avoid unexpected denies/mutations.' - - 'Reporting CRDs changed (1.8): old RCR CRDs removed and replaced; any automation - querying old CRDs will break until updated.' - - 'CLI/flags: `--splitPolicyReport` and `--autogenInternals` are removed in - 1.9; deployments using these flags will fail to start until removed.' - - 'verifyImages attestations: new `verifyImages.attestations.attestors` is for - attestations while existing `verifyImages.attestors` remains for signatures; - misconfiguration can cause verification failures.' - - 'Operational change (1.9): if Kyverno is down, new/changed policies are blocked - until Kyverno returns, which can impact GitOps rollouts during outages.' + chart_updates: ['Reports system and CRDs were overhauled in 1.8: `ReportChangeRequest`/`ClusterReportChangeRequest` + removed and replaced with `AdmissionReport`, `ClusterAdmissionReport`, `BackgroundScanReport`, + `ClusterBackgroundScanReport` CRDs. Ensure CRDs are updated as part of the + upgrade and any tooling consuming old CRDs is updated.', 'Kyverno introduced/advanced + the **v2beta1** API for Kyverno resources, intended to remove deprecated + fields/types. Plan a migration path for policies using deprecated fields.', + 'Autogen behavior changed: in 1.8 autogen moved to `status` (not `spec`) and + is enabled by default; in 1.9 the deprecated `--autogenInternals` flag is + removed and the behavior is automatic.', 'Webhooks behavior changed in 1.9: + separate webhook rules per GVK; AdmissionReview v1 is used instead of v1beta1. + This may affect clusters/components expecting v1beta1 AdmissionReview.', + 'New alpha CRDs/resources added in 1.9: **PolicyException** and **CleanupPolicy** + (and associated cleanup controller components when enabled).'] + features: [PolicyException (alpha) to define exceptions to policy enforcement + without editing the policy itself., 'CleanupPolicy (alpha) to automate cleanup/removal + of resources matching criteria, delivered with an optional cleanup controller.', + 'Distributed tracing improvements building on OpenTelemetry support, enabling + better end-to-end request visibility.', Nested `foreach` loops in policies + for more complex iteration logic., Extended subresource support in webhook + and CLI for validation/mutation across more Kubernetes subresources., ConfigMap + caching to improve performance and reduce API load for repeated ConfigMap + lookups., 'CLI enhancements: dump AdmissionReview payload, audit/warn flags, + accept policies via stdin/pipes, git repo policy sources, and experimental + OCI push/pull of policies.', 'verifyImages enhancements: key signature algorithm + selection, attestations attestors, and (Helm) support for existing imagePullSecrets.', + 'Kubernetes version support extended (1.25 in 1.8, 1.26 in 1.9).'] + breaking_changes: ['JMESPath behavior change (introduced in 1.8): unresolved + expressions now evaluate to `null` instead of empty string; some policies + may need explicit existence checks to avoid unexpected denies/mutations.', + 'Reporting CRDs changed (1.8): old RCR CRDs removed and replaced; any automation + querying old CRDs will break until updated.', 'CLI/flags: `--splitPolicyReport` + and `--autogenInternals` are removed in 1.9; deployments using these flags + will fail to start until removed.', 'verifyImages attestations: new `verifyImages.attestations.attestors` + is for attestations while existing `verifyImages.attestors` remains for + signatures; misconfiguration can cause verification failures.', 'Operational + change (1.9): if Kyverno is down, new/changed policies are blocked until + Kyverno returns, which can impact GitOps rollouts during outages.'] chart_version: 2.7.0 - images: - - busybox:1.35 - - ghcr.io/kyverno/cleanup-controller:v1.9.0 - - ghcr.io/kyverno/kyverno:v1.9.0 - - ghcr.io/kyverno/kyvernopre:v1.9.0 + images: ['busybox:1.35', 'ghcr.io/kyverno/cleanup-controller:v1.9.0', 'ghcr.io/kyverno/kyverno:v1.9.0', + 'ghcr.io/kyverno/kyvernopre:v1.9.0'] eolAt: '2024-04-26' - version: 1.8.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: @@ -28125,48 +21602,34 @@ addons: \ re-check after upgrade.\n- **Note**: upstream release notes mention \u201C\ several Helm chart changes with both kyverno and kyverno-policies\u201D; review\ \ the chart changelog for your exact chart versions (not provided here).\n" - chart_updates: - - New reporting system v2 (ground-up refactor) which changes/renames reporting - CRDs. - - Aggregated ClusterRoles are now used, simplifying adding custom permissions - but changing RBAC shape. - - 'Improved certificate management: dynamic certificate fetching and more graceful - rotation; CA key is now included in the Kyverno Secret; self-signed certs - no longer need annotation.' - - Autogen internals enabled by default; autogen results stored in policy status - rather than spec. - - 'Build/distribution changes: Kyverno images built with `ko` by default and - use a distroless base image.' - - Support added for Kubernetes 1.25. - - Event RBAC tightened (reduced permissions). - features: - - New validate subrule `podSecurity` integrates Pod Security Admission libraries - to validate workloads against PSA controls. - - New validate subrule `manifests` supports YAML manifest signature validation. - - Generate rules can now generate multiple resources in a single rule (including - selection via labels). - - OpenTelemetry support for traces/metrics export. - - New policy field `applyRules` controls whether one or all rules are applied. - - New JMESPath functions including `x509_decode` (decode X.509 certs) and `random` - (composable random strings). - breaking_changes: - - Unresolved JMESPath expressions now evaluate to `null` instead of empty string - (`''`), which can change preconditions/deny logic; policies may need existence - checks to avoid unintended denies/mutations. - - Reporting CRDs `ReportChangeRequest` and `ClusterReportChangeRequest` were - removed and replaced by Admission/BackgroundScan report CRDs; any tooling - relying on the old CRDs must be updated. + chart_updates: [New reporting system v2 (ground-up refactor) which changes/renames + reporting CRDs., 'Aggregated ClusterRoles are now used, simplifying adding + custom permissions but changing RBAC shape.', 'Improved certificate management: + dynamic certificate fetching and more graceful rotation; CA key is now included + in the Kyverno Secret; self-signed certs no longer need annotation.', Autogen + internals enabled by default; autogen results stored in policy status rather + than spec., 'Build/distribution changes: Kyverno images built with `ko` + by default and use a distroless base image.', Support added for Kubernetes + 1.25., Event RBAC tightened (reduced permissions).] + features: [New validate subrule `podSecurity` integrates Pod Security Admission + libraries to validate workloads against PSA controls., New validate subrule + `manifests` supports YAML manifest signature validation., Generate rules + can now generate multiple resources in a single rule (including selection + via labels)., OpenTelemetry support for traces/metrics export., New policy + field `applyRules` controls whether one or all rules are applied., New JMESPath + functions including `x509_decode` (decode X.509 certs) and `random` (composable + random strings).] + breaking_changes: ['Unresolved JMESPath expressions now evaluate to `null` instead + of empty string (`''''`), which can change preconditions/deny logic; policies + may need existence checks to avoid unintended denies/mutations.', Reporting + CRDs `ReportChangeRequest` and `ClusterReportChangeRequest` were removed + and replaced by Admission/BackgroundScan report CRDs; any tooling relying + on the old CRDs must be updated.] chart_version: 2.6.0 - images: - - busybox - - ghcr.io/kyverno/kyverno:v1.8.0 - - ghcr.io/kyverno/kyvernopre:v1.8.0 + images: [busybox, 'ghcr.io/kyverno/kyverno:v1.8.0', 'ghcr.io/kyverno/kyvernopre:v1.8.0'] eolAt: '2023-11-10' - version: 1.7.0 - kube: - - '1.23' - - '1.22' - - '1.21' + kube: ['1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -28184,57 +21647,40 @@ addons: \ `config.resourceFilters` and Helm release name/namespace interactions; review\ \ your custom `config.resourceFilters` to ensure Kyverno isn\u2019t unintentionally\ \ processing or skipping resources (especially in the Kyverno namespace)." - chart_updates: - - Policy status representation updated to use `status.conditions` internally; - `status.ready` is deprecated (kept for a couple of releases). - - Deprecated flags removed (and some config moved to ConfigMap-only). - - 'Policy schema/behavior changes around autogen internals: Kyverno reduces/stops - mutating policies in some cases when autogen internals are enabled.' - - 'CRD lifecycle/compat: drop `v1alpha1` PolicyReport CRD (noted as an enhancement).' - - UpdateRequest/GenerateRequest work evolved (UR controller changes; backward - compatibility noted where GenerateRequest converts to UpdateRequest). - - 'Security/operability hardening: seccomp profile and various controller refactors; - improved webhook/config controller behavior and cache sync handling.' - features: - - 'Major expansion of image verification capabilities: support for certificate - chains, multiple keys, required signed images, digest enforcement/mutation, - and better CLI testing for image verification rules.' - - 'Policy authoring improvements: inline variables in context, richer `foreach` - support (including broader request.* JMESPath usage), and new JMESPath functions.' - - 'Operational features: webhooks object selector support and ability to disable - leader election for the UpdateRequest controller in certain scenarios.' - breaking_changes: - - '`mutate.overlay` and `mutate.patches` (deprecated since 1.4) were **removed - in v1.6.0**; any policies still using them must be migrated before/while upgrading.' - - In v1.7.0, **deprecated CLI flags were removed**, and some options (`filterK8sResources`, - `excludeGroupRole`, `excludeUsername`) can now be configured **only via the - Kyverno ConfigMap**. This can break existing deployments relying on those - flags. - - '`status.ready` on policies is **deprecated** in v1.7.0 in favor of `status.conditions`/`policy.IsReady()`; - if you have tooling/scripts reading `status.ready`, plan to migrate.' + chart_updates: [Policy status representation updated to use `status.conditions` + internally; `status.ready` is deprecated (kept for a couple of releases)., + Deprecated flags removed (and some config moved to ConfigMap-only)., 'Policy + schema/behavior changes around autogen internals: Kyverno reduces/stops + mutating policies in some cases when autogen internals are enabled.', 'CRD + lifecycle/compat: drop `v1alpha1` PolicyReport CRD (noted as an enhancement).', + UpdateRequest/GenerateRequest work evolved (UR controller changes; backward + compatibility noted where GenerateRequest converts to UpdateRequest)., 'Security/operability + hardening: seccomp profile and various controller refactors; improved webhook/config + controller behavior and cache sync handling.'] + features: ['Major expansion of image verification capabilities: support for + certificate chains, multiple keys, required signed images, digest enforcement/mutation, + and better CLI testing for image verification rules.', 'Policy authoring + improvements: inline variables in context, richer `foreach` support (including + broader request.* JMESPath usage), and new JMESPath functions.', 'Operational + features: webhooks object selector support and ability to disable leader + election for the UpdateRequest controller in certain scenarios.'] + breaking_changes: ['`mutate.overlay` and `mutate.patches` (deprecated since + 1.4) were **removed in v1.6.0**; any policies still using them must be migrated + before/while upgrading.', 'In v1.7.0, **deprecated CLI flags were removed**, + and some options (`filterK8sResources`, `excludeGroupRole`, `excludeUsername`) + can now be configured **only via the Kyverno ConfigMap**. This can break + existing deployments relying on those flags.', '`status.ready` on policies + is **deprecated** in v1.7.0 in favor of `status.conditions`/`policy.IsReady()`; + if you have tooling/scripts reading `status.ready`, plan to migrate.'] chart_version: 2.4.0 - images: - - busybox - - ghcr.io/kyverno/kyverno:v1.7.0 - - ghcr.io/kyverno/kyvernopre:v1.7.0 + images: [busybox, 'ghcr.io/kyverno/kyverno:v1.7.0', 'ghcr.io/kyverno/kyvernopre:v1.7.0'] - version: 1.6.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: - - busybox - - ghcr.io/kyverno/kyverno:v1.6.0 - - ghcr.io/kyverno/kyvernopre:v1.6.0 + images: [busybox, 'ghcr.io/kyverno/kyverno:v1.6.0', 'ghcr.io/kyverno/kyvernopre:v1.6.0'] name: kyverno - icon: https://avatars.githubusercontent.com/u/25301026?s=200&v=4 git_url: https://github.com/linkerd/linkerd2 @@ -28242,165 +21688,70 @@ addons: helm_repository_url: https://helm.linkerd.io/stable versions: - version: 2.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null - version: 2.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null - version: 2.18.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 2.17.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', + '1.22'] requirements: [] incompatibilities: [] summary: null - version: 2.16.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 2.15.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 2.14.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 2.13.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 2.12.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 2.11.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null - version: 2.10.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null - name: linkerd - icon: https://avatars.githubusercontent.com/u/51335366?s=48&v=4 git_url: https://github.com/longhorn/longhorn release_url: https://github.com/longhorn/longhorn/releases/tag/v{vsn} helm_repository_url: https://charts.longhorn.io versions: - version: 1.10.1 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -28420,40 +21771,25 @@ addons: *before* the Helm upgrade. ' - chart_updates: - - 'Helm chart behavior improvement: `defaultSettings` handling supports automatic - quoting and multiple types (reduces YAML/JSON typing pitfalls when setting - Longhorn global settings via Helm).' - features: - - 'V2 Data Engine: interrupt mode now supports **NVMe disks** starting in v1.10.1 - (v1.10.0 supported AIO disks only).' - - 'Improved scheduling visibility: `CSIStorageCapacity` objects show schedulable/allocatable - capacity (helps capacity-aware scheduling with `WaitForFirstConsumer`).' - - Adds/extends installation variant usage metrics (observability/telemetry improvement). - breaking_changes: - - Longhorn v1.10.0 removes the `longhorn.io/v1beta1` API and removes the deprecated - `replica.status.evictionRequested` field. If any CRs are still stored as `v1beta1`, - upgrades to v1.10.x can fail until you migrate CRD storedVersions to `v1beta2`. - - 'Kubernetes requirement: v1.10.x requires **Kubernetes v1.25+**; upgrading - on older clusters is unsupported.' + chart_updates: ['Helm chart behavior improvement: `defaultSettings` handling + supports automatic quoting and multiple types (reduces YAML/JSON typing + pitfalls when setting Longhorn global settings via Helm).'] + features: ['V2 Data Engine: interrupt mode now supports **NVMe disks** starting + in v1.10.1 (v1.10.0 supported AIO disks only).', 'Improved scheduling visibility: + `CSIStorageCapacity` objects show schedulable/allocatable capacity (helps + capacity-aware scheduling with `WaitForFirstConsumer`).', Adds/extends installation + variant usage metrics (observability/telemetry improvement).] + breaking_changes: ['Longhorn v1.10.0 removes the `longhorn.io/v1beta1` API and + removes the deprecated `replica.status.evictionRequested` field. If any + CRs are still stored as `v1beta1`, upgrades to v1.10.x can fail until you + migrate CRD storedVersions to `v1beta2`.', 'Kubernetes requirement: v1.10.x + requires **Kubernetes v1.25+**; upgrading on older clusters is unsupported.'] chart_version: 1.10.1 - images: - - longhornio/longhorn-manager:v1.10.1 - - longhornio/longhorn-share-manager:v1.10.1 - - longhornio/longhorn-ui:v1.10.1 + images: ['longhornio/longhorn-manager:v1.10.1', 'longhornio/longhorn-share-manager:v1.10.1', + 'longhornio/longhorn-ui:v1.10.1'] - version: 1.10.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -28470,64 +21806,43 @@ addons: \ to support per\u2013data-engine JSON values; if you currently set these\ \ via Helm `defaultSettings`, validate they still apply as intended (see \u201C\ Consolidated Global Settings\u201D below).\n" - chart_updates: - - 'Hotfix guidance: v1.10.0 chart should deploy `longhorn-manager:v1.10.0-hotfix-1` - instead of `v1.10.0` to avoid a share-manager backoff regression (manager - crash loop / inability to deploy new share-manager pods).' - - 'Pre-upgrade requirement: ensure Longhorn CRDs no longer store `v1beta1` objects - in `status.storedVersions` before upgrading to v1.10 (manual storage-version - migration may be required).' - - 'API removal: `longhorn.io/v1beta1` is removed in v1.10; clusters with leftover - `v1beta1` stored objects can fail CRD patching during upgrade.' - - 'Field removal: deprecated `replica.status.evictionRequested` removed in v1.10.' - features: - - 'V2 Data Engine: interrupt mode (AIO disks only) to reduce CPU usage on idle/low - I/O workloads.' - - 'V2 Data Engine: volume & snapshot cloning (full-copy clone and fast linked/smart - clone).' - - 'V2 Data Engine: replica rebuild QoS / bandwidth limiting (global or per volume) - to reduce rebuild impact.' - - 'V2 Data Engine: volume expansion supported (PVC resize/UI).' - - 'V2 Data Engine: can run without hugepages (more flexible on low-spec nodes; - possible performance tradeoff).' - - 'V1 Data Engine: single-stack IPv6 support (dual-stack and V2 IPv6 not supported - in this release).' - - 'Kubernetes scheduling: CSIStorageCapacity support for better placement with - `WaitForFirstConsumer` StorageClasses.' - - 'Backups: configurable backup block size at volume creation time.' - - 'UX/observability: consolidated settings model allowing per-engine values - via JSON; UI shows volume attachment ticket summaries.' - breaking_changes: - - '`longhorn.io/v1beta1` API is removed in v1.10; upgrades will fail if any - CRDs still have `v1beta1` as a stored version or any objects persisted in - `v1beta1`. Manual CRD storage-version migration is strongly advised before - upgrading from v1.9 to v1.10, especially for clusters originally installed - < v1.3.0 or after etcd/CRD restores.' - - Deprecated `replica.status.evictionRequested` field is removed; any tooling - that reads/writes it must be updated. - - "Settings consolidation: several global settings now support per\u2013data-engine\ - \ values via JSON (`{\"v1\":..., \"v2\":...}`); existing automation that assumes\ - \ simple string values may need updates." - - 'Known regression: `longhorn-manager:v1.10.0` can crash due to share-manager - backoff logic; plan to use `v1.10.0-hotfix-1` during upgrade to avoid instability.' + chart_updates: ['Hotfix guidance: v1.10.0 chart should deploy `longhorn-manager:v1.10.0-hotfix-1` + instead of `v1.10.0` to avoid a share-manager backoff regression (manager + crash loop / inability to deploy new share-manager pods).', 'Pre-upgrade + requirement: ensure Longhorn CRDs no longer store `v1beta1` objects in `status.storedVersions` + before upgrading to v1.10 (manual storage-version migration may be required).', + 'API removal: `longhorn.io/v1beta1` is removed in v1.10; clusters with leftover + `v1beta1` stored objects can fail CRD patching during upgrade.', 'Field + removal: deprecated `replica.status.evictionRequested` removed in v1.10.'] + features: ['V2 Data Engine: interrupt mode (AIO disks only) to reduce CPU usage + on idle/low I/O workloads.', 'V2 Data Engine: volume & snapshot cloning + (full-copy clone and fast linked/smart clone).', 'V2 Data Engine: replica + rebuild QoS / bandwidth limiting (global or per volume) to reduce rebuild + impact.', 'V2 Data Engine: volume expansion supported (PVC resize/UI).', + 'V2 Data Engine: can run without hugepages (more flexible on low-spec nodes; + possible performance tradeoff).', 'V1 Data Engine: single-stack IPv6 support + (dual-stack and V2 IPv6 not supported in this release).', 'Kubernetes scheduling: + CSIStorageCapacity support for better placement with `WaitForFirstConsumer` + StorageClasses.', 'Backups: configurable backup block size at volume creation + time.', 'UX/observability: consolidated settings model allowing per-engine + values via JSON; UI shows volume attachment ticket summaries.'] + breaking_changes: ['`longhorn.io/v1beta1` API is removed in v1.10; upgrades + will fail if any CRDs still have `v1beta1` as a stored version or any objects + persisted in `v1beta1`. Manual CRD storage-version migration is strongly + advised before upgrading from v1.9 to v1.10, especially for clusters originally + installed < v1.3.0 or after etcd/CRD restores.', Deprecated `replica.status.evictionRequested` + field is removed; any tooling that reads/writes it must be updated., "Settings\ + \ consolidation: several global settings now support per\u2013data-engine\ + \ values via JSON (`{\"v1\":..., \"v2\":...}`); existing automation that\ + \ assumes simple string values may need updates.", 'Known regression: `longhorn-manager:v1.10.0` + can crash due to share-manager backoff logic; plan to use `v1.10.0-hotfix-1` + during upgrade to avoid instability.'] chart_version: 1.10.0 - images: - - longhornio/longhorn-manager:v1.10.0 - - longhornio/longhorn-share-manager:v1.10.0 - - longhornio/longhorn-ui:v1.10.0 + images: ['longhornio/longhorn-manager:v1.10.0', 'longhornio/longhorn-share-manager:v1.10.0', + 'longhornio/longhorn-ui:v1.10.0'] - version: 1.9.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -28542,52 +21857,34 @@ addons: \ Kubernetes objects.\n - Fix: `persistence.backupTargetName` was not referenced\ \ in the StorageClass template (verify your StorageClass rendering if you\ \ relied on this).\n" - chart_updates: - - v1.9.0 removes the deprecated `environment_check.sh` script from the release - artifacts (use `longhornctl` for preflight checks instead). - - "CRDs: deprecated fields removed from `longhorn.io/v1beta2` CRDs; ensure CRs/manifests\ - \ don\u2019t rely on removed fields." - - 'Settings migration: `orphan-auto-deletion` is replaced by `orphan-resource-auto-deletion` - and is auto-migrated during upgrade.' - features: - - Recurring **system backups** can now be scheduled via recurring jobs (new - operational safety net). - - '**Offline replica rebuilding** (v1 and v2) can automatically rebuild replicas - while volumes are detached (disabled by default).' - - '**Orphaned instance cleanup** can track and delete leftover engine/replica - runtime resources (disabled by default).' - - 'Improved **observability/metrics**: new Prometheus metrics for replica/engine - CR identity and rebuild status.' - - 'V2 Data Engine enhancements: **UBLK frontend** support and **storage network** - support (still experimental).' - breaking_changes: - - Kubernetes **v1.25+ is required** for Longhorn v1.9.x upgrades/installs (blocker - if cluster is older). - - V2 **backing images are incompatible** with earlier versions due to xattr - naming conflicts; you must delete/recreate V2 backing images during upgrade - and restore any dependent volumes from backups. - - '`longhorn.io/v1beta1` API is now unserved/unsupported in v1.9.0 and will - be removed in v1.10.0; any tooling using v1beta1 must move to v1beta2.' - - 'Setting rename: `orphan-auto-deletion` replaced by `orphan-resource-auto-deletion` - (auto-migrated, but automation/scripts must be updated).' + chart_updates: [v1.9.0 removes the deprecated `environment_check.sh` script + from the release artifacts (use `longhornctl` for preflight checks instead)., + "CRDs: deprecated fields removed from `longhorn.io/v1beta2` CRDs; ensure CRs/manifests\ + \ don\u2019t rely on removed fields.", 'Settings migration: `orphan-auto-deletion` + is replaced by `orphan-resource-auto-deletion` and is auto-migrated during + upgrade.'] + features: [Recurring **system backups** can now be scheduled via recurring jobs + (new operational safety net)., '**Offline replica rebuilding** (v1 and v2) + can automatically rebuild replicas while volumes are detached (disabled + by default).', '**Orphaned instance cleanup** can track and delete leftover + engine/replica runtime resources (disabled by default).', 'Improved **observability/metrics**: + new Prometheus metrics for replica/engine CR identity and rebuild status.', + 'V2 Data Engine enhancements: **UBLK frontend** support and **storage network** + support (still experimental).'] + breaking_changes: [Kubernetes **v1.25+ is required** for Longhorn v1.9.x upgrades/installs + (blocker if cluster is older)., V2 **backing images are incompatible** with + earlier versions due to xattr naming conflicts; you must delete/recreate + V2 backing images during upgrade and restore any dependent volumes from + backups., '`longhorn.io/v1beta1` API is now unserved/unsupported in v1.9.0 + and will be removed in v1.10.0; any tooling using v1beta1 must move to v1beta2.', + 'Setting rename: `orphan-auto-deletion` replaced by `orphan-resource-auto-deletion` + (auto-migrated, but automation/scripts must be updated).'] chart_version: 1.9.0 - images: - - longhornio/longhorn-manager:v1.9.0 - - longhornio/longhorn-share-manager:v1.9.0 - - longhornio/longhorn-ui:v1.9.0 + images: ['longhornio/longhorn-manager:v1.9.0', 'longhornio/longhorn-share-manager:v1.9.0', + 'longhornio/longhorn-ui:v1.9.0'] - version: 1.8.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -28615,112 +21912,71 @@ addons: \ backup target.\n- **RWX expansion behavior:** v1.8.0 supports **automatic\ \ online RWX volume expansion** when **manager, share-manager, and CSI plugin\ \ are all at v1.8.0** (so avoid mixed-version states longer than necessary).\n" - chart_updates: - - "Longhorn v1.8.0 includes the standard chart/app refresh plus: (1) updated\ - \ CSI external-snapshotter (v8.2.0), which drives the Kubernetes v1.25+ requirement;\ - \ (2) support for installation/upgrade via the built-in Helm Controller for\ - \ K3s/RKE2 using a HelmChart CRD; (3) a warning that the longhorn/longhorn\ - \ repo\u2019s v1.8.0 manifest and chart had an incorrect image tag (`v1.8.x-head`),\ - \ so ensure your chart source is correct (prefer charts.longhorn.io or fix\ - \ the tag before applying)." - features: - - Multiple backupstores support, including creation of a default backup target - named `default` used for system backups and volumes without a specified target. - - Automatic online RWX volume expansion (no workload scale-down/manual resize - steps) when all Longhorn components are on v1.8.0. - - 'V2 Data Engine enhancements: configurable CPU cores, DR volumes, auto-salvage, - live migration, volume encryption, delta replica rebuild using snapshot checksums, - and backing image update/download.' - - Support installing/upgrading Longhorn on K3s/RKE2 via the built-in Helm Controller - (HelmChart CRD workflow). - - V2 Data Engine support for Talos Linux (assuming prerequisites are met). - breaking_changes: - - Kubernetes minimum version is now **v1.25+** for Longhorn v1.8.0 due to CSI - external-snapshotter v8.2.0; clusters below v1.25 must upgrade Kubernetes - before upgrading Longhorn. - - V2 block-type disk default block size changed from **4096** to **512** bytes; - existing V2 volumes on 4k-block disks require a disruptive migrate/restore - procedure to align with the new default and avoid incompatibilities with V1-generated - backing images. - - If you upgraded using the *main* longhorn/longhorn repo chart/manifest without - fixing the image tag, you may have deployed `v1.8.x-head` images; you must - correct to `v1.8.0` and update engine images for affected volumes. + chart_updates: ["Longhorn v1.8.0 includes the standard chart/app refresh plus:\ + \ (1) updated CSI external-snapshotter (v8.2.0), which drives the Kubernetes\ + \ v1.25+ requirement; (2) support for installation/upgrade via the built-in\ + \ Helm Controller for K3s/RKE2 using a HelmChart CRD; (3) a warning that\ + \ the longhorn/longhorn repo\u2019s v1.8.0 manifest and chart had an incorrect\ + \ image tag (`v1.8.x-head`), so ensure your chart source is correct (prefer\ + \ charts.longhorn.io or fix the tag before applying)."] + features: ['Multiple backupstores support, including creation of a default backup + target named `default` used for system backups and volumes without a specified + target.', Automatic online RWX volume expansion (no workload scale-down/manual + resize steps) when all Longhorn components are on v1.8.0., 'V2 Data Engine + enhancements: configurable CPU cores, DR volumes, auto-salvage, live migration, + volume encryption, delta replica rebuild using snapshot checksums, and backing + image update/download.', Support installing/upgrading Longhorn on K3s/RKE2 + via the built-in Helm Controller (HelmChart CRD workflow)., V2 Data Engine + support for Talos Linux (assuming prerequisites are met).] + breaking_changes: [Kubernetes minimum version is now **v1.25+** for Longhorn + v1.8.0 due to CSI external-snapshotter v8.2.0; clusters below v1.25 must + upgrade Kubernetes before upgrading Longhorn., V2 block-type disk default + block size changed from **4096** to **512** bytes; existing V2 volumes on + 4k-block disks require a disruptive migrate/restore procedure to align with + the new default and avoid incompatibilities with V1-generated backing images., + 'If you upgraded using the *main* longhorn/longhorn repo chart/manifest without + fixing the image tag, you may have deployed `v1.8.x-head` images; you must + correct to `v1.8.0` and update engine images for affected volumes.'] chart_version: 1.8.0 - images: - - longhornio/longhorn-manager:v1.8.0 - - longhornio/longhorn-share-manager:v1.8.0 - - longhornio/longhorn-ui:v1.8.0 + images: ['longhornio/longhorn-manager:v1.8.0', 'longhornio/longhorn-share-manager:v1.8.0', + 'longhornio/longhorn-ui:v1.8.0'] - version: 1.7.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart values.yaml was simplified/cleaned up (less churn, but expect some - keys to have moved/been renamed). - - Helm chart added support for Gateway API and improved Ingress options. - - Chart includes updated defaults/behavior aligned with Longhorn v1.7.0 features - (e.g., RWX storage network support, monitoring knobs). - features: - - V2 Data Engine (still preview) gained online replica rebuild, filesystem trim, - broader SPDK block-disk driver support (AIO/NVMe/VirtIO), and live data-plane - upgrade for V2 volumes (spdk_tgt) with no downtime. - - High availability improvements include HA backing images and experimental - RWX fast failover (faster Share Manager failure detection/response). - - Data protection now supports periodic and on-demand full backups to reduce - corruption risk and improve reliability. - - Scheduling enhancements improve replica auto-balancing under disk pressure - and speed up rebuilds via local file copying when possible. - - Storage network can now be used with RWX volumes for traffic segregation. - - Introduced an official Longhorn CLI (longhornctl) for install/ops/troubleshooting - via CRs and in-cluster pod execution. - - Improved platform coverage, including support for Container-Optimized OS (COS). - breaking_changes: - - Longhorn v1.7.0 requires Kubernetes v1.21+ for install/upgrade from 1.6.x. - - "environment_check.sh is deprecated in v1.7.0 (overlaps with the new Longhorn\ - \ CLI) and scheduled for removal in v1.8.0\u2014don\u2019t build automation\ - \ around the script going forward." - - There is a critical known issue in v1.7.0 affecting volume attachment for - clusters with legacy engine resource names (pre v1.5.2/v1.4.4 pattern); if - present, you must hold the upgrade until v1.7.1. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Helm chart values.yaml was simplified/cleaned up (less churn, + but expect some keys to have moved/been renamed).', Helm chart added support + for Gateway API and improved Ingress options., 'Chart includes updated defaults/behavior + aligned with Longhorn v1.7.0 features (e.g., RWX storage network support, + monitoring knobs).'] + features: ['V2 Data Engine (still preview) gained online replica rebuild, filesystem + trim, broader SPDK block-disk driver support (AIO/NVMe/VirtIO), and live + data-plane upgrade for V2 volumes (spdk_tgt) with no downtime.', High availability + improvements include HA backing images and experimental RWX fast failover + (faster Share Manager failure detection/response)., Data protection now + supports periodic and on-demand full backups to reduce corruption risk and + improve reliability., Scheduling enhancements improve replica auto-balancing + under disk pressure and speed up rebuilds via local file copying when possible., + Storage network can now be used with RWX volumes for traffic segregation., + Introduced an official Longhorn CLI (longhornctl) for install/ops/troubleshooting + via CRs and in-cluster pod execution., 'Improved platform coverage, including + support for Container-Optimized OS (COS).'] + breaking_changes: [Longhorn v1.7.0 requires Kubernetes v1.21+ for install/upgrade + from 1.6.x., "environment_check.sh is deprecated in v1.7.0 (overlaps with\ + \ the new Longhorn CLI) and scheduled for removal in v1.8.0\u2014don\u2019\ + t build automation around the script going forward.", 'There is a critical + known issue in v1.7.0 affecting volume attachment for clusters with legacy + engine resource names (pre v1.5.2/v1.4.4 pattern); if present, you must + hold the upgrade until v1.7.1.'] chart_version: 1.7.0 - images: - - longhornio/longhorn-manager:v1.7.0 - - longhornio/longhorn-share-manager:v1.7.0 - - longhornio/longhorn-ui:v1.7.0 + images: ['longhornio/longhorn-manager:v1.7.0', 'longhornio/longhorn-share-manager:v1.7.0', + 'longhornio/longhorn-ui:v1.7.0'] - version: 1.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -28745,124 +22001,81 @@ addons: \ release notes provided don\u2019t list a full values.yaml diff; do a `helm\ \ diff upgrade` between your current chart and the v1.6.0 chart to catch renamed/added/removed\ \ values." - chart_updates: - - 'Improved GitOps friendliness: validated with Flux/Argo CD/Fleet; chart adjusted - (notably pre-upgrade hook changes) to work better with Argo CD.' - - Adds optional Prometheus Operator integration by allowing deployment of a - ServiceMonitor. - - Adds chart support for configuring StorageClass mount options and component - log level via values.yaml. - - General dependency bumps and manifest refactors noted in release notes (e.g., - CSI component upgrades, Kubernetes version support updates). - features: - - 'Snapshot space management: define max snapshot count and max total snapshot - size globally or per-volume to control space usage.' - - V2 Data Engine (preview) gains snapshot/revert and backup/restore, including - backup/restore interoperability between v1 and v2 engines. - - 'Platform support broadened: Talos support and OKD (OpenShift Origin) support - added; v2 engine support on ARM64.' - - 'Node maintenance enhancements: new node drain policy options to proactively - evict/relocate replicas during planned maintenance.' - - 'Data protection: encryption support for `volumeMode: Block` volumes.' - - 'Backing image improvements: ability to back up and restore backing images - across clusters.' - breaking_changes: - - Potential behavior change for GitOps installs/upgrades due to removal/change - of the Helm pre-upgrade hook (re-test Argo CD/Flux pipelines). - - "V1/V2 data plane separation and selective v2 activation introduce new operational\ - \ modes; ensure you don\u2019t accidentally enable v2 in production unless\ - \ you intend to (v2 remains preview)." + chart_updates: ['Improved GitOps friendliness: validated with Flux/Argo CD/Fleet; + chart adjusted (notably pre-upgrade hook changes) to work better with Argo + CD.', Adds optional Prometheus Operator integration by allowing deployment + of a ServiceMonitor., Adds chart support for configuring StorageClass mount + options and component log level via values.yaml., 'General dependency bumps + and manifest refactors noted in release notes (e.g., CSI component upgrades, + Kubernetes version support updates).'] + features: ['Snapshot space management: define max snapshot count and max total + snapshot size globally or per-volume to control space usage.', 'V2 Data + Engine (preview) gains snapshot/revert and backup/restore, including backup/restore + interoperability between v1 and v2 engines.', 'Platform support broadened: + Talos support and OKD (OpenShift Origin) support added; v2 engine support + on ARM64.', 'Node maintenance enhancements: new node drain policy options + to proactively evict/relocate replicas during planned maintenance.', 'Data + protection: encryption support for `volumeMode: Block` volumes.', 'Backing + image improvements: ability to back up and restore backing images across + clusters.'] + breaking_changes: [Potential behavior change for GitOps installs/upgrades due + to removal/change of the Helm pre-upgrade hook (re-test Argo CD/Flux pipelines)., + "V1/V2 data plane separation and selective v2 activation introduce new operational\ + \ modes; ensure you don\u2019t accidentally enable v2 in production unless\ + \ you intend to (v2 remains preview)."] chart_version: 1.6.0 - images: - - longhornio/longhorn-manager:v1.6.0 - - longhornio/longhorn-ui:v1.6.0 + images: ['longhornio/longhorn-manager:v1.6.0', 'longhornio/longhorn-ui:v1.6.0'] - version: 1.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Upgrade path is enforced: v1.5.0 supports upgrades only from Longhorn 1.4.x\ - \ (you\u2019re currently on 1.4.0, so you\u2019re in the supported path)." - - 'Instance Manager architecture change: engine+replica instance managers are - consolidated into a single instance-manager, which affects pod count/resources - during/after upgrade.' - - Admission webhook and recovery-backend services are merged into longhorn-manager - (fewer standalone components/services). - - 'New CRD introduced: Longhorn VolumeAttachment (used for exclusive attachment - and headless operations like cloning/recurring jobs/backing image export).' - - 'New/expanded backup stores and backup behaviors: CIFS and Azure backup stores; - backup compression options (lz4/gzip/none).' - - 'New/expanded trim and recurring job capabilities: automatic filesystem trim - via recurring job; RWX volume trim; new recurring job types for snapshot cleanup - and delete.' - - 'New node maintenance behavior: Kubernetes Upgrade Node Drain Policy and use - of PDBs to protect Longhorn components during drains.' - - 'Preview feature added: v2/SPDK data engine (disabled by default; not for - production).' - - "Deprecations/removals called out in 1.5 notes: remove global setting mkfs-ext4-parameters;\ - \ remove system-managed component image settings; remove deprecated volume\ - \ spec recurringJobs fields; remove deprecated allow-node-drain-with-last-healthy-replica;\ - \ remove disable-replica-rebuild feature; remove several \u201CGuaranteed\ - \ * CPU\u201D settings; default backup/restore concurrent limits reduced." - features: - - SPDK-based v2 data engine (preview, disabled by default) for an alternative - datapath with new lifecycle and replica management capabilities. - - New VolumeAttachment CRD to ensure exclusive attachment and enable safe headless - operations (clones, recurring jobs, backing image export). - - Cluster Autoscaler support is GA (no longer experimental). - - Consolidated instance managers reduce resource usage during normal operation - and upgrades. - - 'Backup improvements: new compression methods (lz4/gzip/none) and additional - backup stores (CIFS and Azure).' - - 'Operations improvements: automatic trim via recurring job, RWX volume trim, - and new recurring jobs for snapshot cleanup/delete.' - - 'Node maintenance protection: node drain policy and PDB usage to improve safety - during Kubernetes upgrades/maintenance.' - breaking_changes: - - 'Upgrade path enforcement & downgrade prevention: you cannot downgrade after - upgrading, and upgrades are only supported from 1.4.x to 1.5.0.' - - "Removed/changed settings and deprecated fields may break existing Helm values\ - \ or automation if you rely on them (e.g., mkfs-ext4-parameters, system-managed\ - \ component image settings, deprecated recurringJobs fields, allow-node-drain-with-last-healthy-replica,\ - \ disable-replica-rebuild, \u201CGuaranteed * CPU\u201D settings)." + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Upgrade path is enforced: v1.5.0 supports upgrades only from\ + \ Longhorn 1.4.x (you\u2019re currently on 1.4.0, so you\u2019re in the\ + \ supported path).", 'Instance Manager architecture change: engine+replica + instance managers are consolidated into a single instance-manager, which + affects pod count/resources during/after upgrade.', Admission webhook and + recovery-backend services are merged into longhorn-manager (fewer standalone + components/services)., 'New CRD introduced: Longhorn VolumeAttachment (used + for exclusive attachment and headless operations like cloning/recurring + jobs/backing image export).', 'New/expanded backup stores and backup behaviors: + CIFS and Azure backup stores; backup compression options (lz4/gzip/none).', + 'New/expanded trim and recurring job capabilities: automatic filesystem trim + via recurring job; RWX volume trim; new recurring job types for snapshot + cleanup and delete.', 'New node maintenance behavior: Kubernetes Upgrade + Node Drain Policy and use of PDBs to protect Longhorn components during + drains.', 'Preview feature added: v2/SPDK data engine (disabled by default; + not for production).', "Deprecations/removals called out in 1.5 notes: remove\ + \ global setting mkfs-ext4-parameters; remove system-managed component image\ + \ settings; remove deprecated volume spec recurringJobs fields; remove deprecated\ + \ allow-node-drain-with-last-healthy-replica; remove disable-replica-rebuild\ + \ feature; remove several \u201CGuaranteed * CPU\u201D settings; default\ + \ backup/restore concurrent limits reduced."] + features: ['SPDK-based v2 data engine (preview, disabled by default) for an + alternative datapath with new lifecycle and replica management capabilities.', + 'New VolumeAttachment CRD to ensure exclusive attachment and enable safe headless + operations (clones, recurring jobs, backing image export).', Cluster Autoscaler + support is GA (no longer experimental)., Consolidated instance managers + reduce resource usage during normal operation and upgrades., 'Backup improvements: + new compression methods (lz4/gzip/none) and additional backup stores (CIFS + and Azure).', 'Operations improvements: automatic trim via recurring job, + RWX volume trim, and new recurring jobs for snapshot cleanup/delete.', 'Node + maintenance protection: node drain policy and PDB usage to improve safety + during Kubernetes upgrades/maintenance.'] + breaking_changes: ['Upgrade path enforcement & downgrade prevention: you cannot + downgrade after upgrading, and upgrades are only supported from 1.4.x to + 1.5.0.', "Removed/changed settings and deprecated fields may break existing\ + \ Helm values or automation if you rely on them (e.g., mkfs-ext4-parameters,\ + \ system-managed component image settings, deprecated recurringJobs fields,\ + \ allow-node-drain-with-last-healthy-replica, disable-replica-rebuild, \u201C\ + Guaranteed * CPU\u201D settings)."] chart_version: 1.5.0 - images: - - longhornio/longhorn-manager:v1.5.0 - - longhornio/longhorn-ui:v1.5.0 + images: ['longhornio/longhorn-manager:v1.5.0', 'longhornio/longhorn-ui:v1.5.0'] - version: 1.4.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -28878,448 +22091,283 @@ addons: \ - **v1beta1 VolumeSnapshot CRDs are deprecated (still supported)**; you\ \ should migrate to **snapshot.storage.k8s.io/v1** before a future snapshotter\ \ upgrade removes v1beta1 support.\n" - chart_updates: - - Kubernetes 1.25 compatibility work (removal of deprecated API usage such as - PodSecurityPolicy by default; PSP becomes opt-in). - - Helm chart docs/readme updates mentioned in release notes (#4175/#4745). - - Adds/updates chart-level knobs for scaling certain components (e.g., configurable - replica counts for webhook and RWX recovery-backend) (#5087). - - Adds/changes UI deployment affinity options in the chart (#4987). - features: - - Kubernetes 1.25 support via PSA/optional PSP handling. - - ARM64 support promoted to General Availability (GA). - - RWX (NFS) support promoted to GA with recovery backend to improve failover - behavior. - - Snapshot checksum + periodic verification to detect corruption and support - data integrity workflows. - - Bit-rot detection and repair for snapshots when snapshot checksum is enabled. - - Replica rebuild speed-ups (notably leveraging snapshot checksums/metadata - to reduce unnecessary replication). - - Volume trim (UNMAP) support to reclaim space on block volumes. - - Online volume expansion support via engine + CSI node driver filesystem resize. - - Strict data locality mode to keep a local replica and use local socket for - improved performance. - - System Backup & Restore for backing up Longhorn system resources/metadata - and restoring in-place or to a new cluster. - - Enhanced support bundle collection via rancher/support-bundle-kit integration. - - New tunable engine-to-replica timeout setting for low-spec/latent environments. - breaking_changes: - - 'Kubernetes support window shifts: upgrading to v1.4.0 requires Kubernetes - **>=1.21** (and v1.4.0 is intended for newer clusters, including 1.25).' - - "PodSecurityPolicy is no longer assumed; on Kubernetes 1.25 you must use PSA,\ - \ and if you still need PSP you must explicitly enable Longhorn\u2019s opt-in\ - \ PSP support." - - VolumeSnapshot v1beta1 API is deprecated (still works now) and will be removed - in a future CSI snapshotter upgrade; plan migration to v1. + chart_updates: [Kubernetes 1.25 compatibility work (removal of deprecated API + usage such as PodSecurityPolicy by default; PSP becomes opt-in)., Helm chart + docs/readme updates mentioned in release notes (#4175/#4745)., 'Adds/updates + chart-level knobs for scaling certain components (e.g., configurable replica + counts for webhook and RWX recovery-backend) (#5087).', Adds/changes UI + deployment affinity options in the chart (#4987).] + features: [Kubernetes 1.25 support via PSA/optional PSP handling., ARM64 support + promoted to General Availability (GA)., RWX (NFS) support promoted to GA + with recovery backend to improve failover behavior., Snapshot checksum + + periodic verification to detect corruption and support data integrity workflows., + Bit-rot detection and repair for snapshots when snapshot checksum is enabled., + Replica rebuild speed-ups (notably leveraging snapshot checksums/metadata + to reduce unnecessary replication)., Volume trim (UNMAP) support to reclaim + space on block volumes., Online volume expansion support via engine + CSI + node driver filesystem resize., Strict data locality mode to keep a local + replica and use local socket for improved performance., System Backup & + Restore for backing up Longhorn system resources/metadata and restoring + in-place or to a new cluster., Enhanced support bundle collection via rancher/support-bundle-kit + integration., New tunable engine-to-replica timeout setting for low-spec/latent + environments.] + breaking_changes: ['Kubernetes support window shifts: upgrading to v1.4.0 requires + Kubernetes **>=1.21** (and v1.4.0 is intended for newer clusters, including + 1.25).', "PodSecurityPolicy is no longer assumed; on Kubernetes 1.25 you\ + \ must use PSA, and if you still need PSP you must explicitly enable Longhorn\u2019\ + s opt-in PSP support.", VolumeSnapshot v1beta1 API is deprecated (still + works now) and will be removed in a future CSI snapshotter upgrade; plan + migration to v1.] chart_version: 1.4.0 - images: - - longhornio/longhorn-manager:v1.4.0 - - longhornio/longhorn-ui:v1.4.0 + images: ['longhornio/longhorn-manager:v1.4.0', 'longhornio/longhorn-ui:v1.4.0'] - version: 1.3.2 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Upgrade target is within the Longhorn 1.3 minor line (v1.3.0 \u2192 v1.3.2);\ - \ most changes are bugfixes and operational improvements rather than new features." - - 'v1.3.2 adds an explicit Kubernetes version upper bound for <1.4 charts: supported - Kubernetes is >=1.18 and <=1.24 (<1.25).' - - v1.3.2 cleans up Helm chart packaging inconsistencies (e.g., values.yaml containing - unused values; questions.yaml had outdated CSI image tags). - - 'CRD/manifest maintenance: updates around preserveUnknownFields and CRD patch - generation/reorg; relevant if you manage CRDs outside Helm.' - features: - - Data alignment correction for existing volumes when filesystem block size - is <4096 to prevent rare potential data corruption during replica rebuilds. - - Use a specific filesystem block size to reduce unnecessary read-modify-write - between volume head and snapshots, improving write performance. - - Support cleanup of failed/obsolete orphaned backups (backup hygiene improvements). - breaking_changes: - - 'Kubernetes compatibility constraint tightened/clarified for v1.3.2: cluster - must be Kubernetes >=1.18 and <=1.24 (i.e., not 1.25+). Upgrading on newer - clusters may be unsupported and should be avoided/validated before proceeding.' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Upgrade target is within the Longhorn 1.3 minor line (v1.3.0\ + \ \u2192 v1.3.2); most changes are bugfixes and operational improvements\ + \ rather than new features.", 'v1.3.2 adds an explicit Kubernetes version + upper bound for <1.4 charts: supported Kubernetes is >=1.18 and <=1.24 (<1.25).', + 'v1.3.2 cleans up Helm chart packaging inconsistencies (e.g., values.yaml + containing unused values; questions.yaml had outdated CSI image tags).', + 'CRD/manifest maintenance: updates around preserveUnknownFields and CRD patch + generation/reorg; relevant if you manage CRDs outside Helm.'] + features: [Data alignment correction for existing volumes when filesystem block + size is <4096 to prevent rare potential data corruption during replica rebuilds., + 'Use a specific filesystem block size to reduce unnecessary read-modify-write + between volume head and snapshots, improving write performance.', Support + cleanup of failed/obsolete orphaned backups (backup hygiene improvements).] + breaking_changes: ['Kubernetes compatibility constraint tightened/clarified + for v1.3.2: cluster must be Kubernetes >=1.18 and <=1.24 (i.e., not 1.25+). + Upgrading on newer clusters may be unsupported and should be avoided/validated + before proceeding.'] chart_version: 1.3.2 images: [] - version: 1.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Longhorn now requires Kubernetes >= 1.18 for install/upgrade (still upgrading - only supported from 1.2.x to 1.3.0). - - CRDs move to `longhorn.io/v1beta2` as the default; a conversion webhook is - introduced to keep `v1beta1` access working post-upgrade. - - New/updated admission webhooks (mutating + validating) are added and the manager - now waits for the webhook server to be ready. - - Communication between longhorn-manager and engine/replica processes is changed - to be proxied through instance-manager (enables storage network segregation). - - 'Optional security hardening additions: NetworkPolicies and optional mTLS - between manager and instance-manager.' - - Snapshot-related API surface expands with a new Snapshot CRD; CSI snapshot - support is extended to Longhorn snapshots. - - Orphaned replica detection/cleanup feature added (including opt-in automatic - cleanup). - - Instance-manager lifecycle management changes; optional dynamic PDB management - to work with Cluster Autoscaler (experimental). - - 'Multiple operational/UX improvements: snapshot purge/prune improvement, backing - image download support, metrics improvements, non-root default user for images, - etc.' - features: - - Storage network / multi-network cluster support with control-plane/data-plane - segregation via Multus (opt-in). - - Managed Kubernetes compatibility improvements (EKS/GKE/AKS operations like - upgrades and node pool replacement). - - New v1beta2 CRDs with structural schema validation and a conversion webhook - (v1beta2 becomes default). - - New Snapshot CRD and extended CSI snapshot integration to create/restore Longhorn - snapshots via CSI workflows. - - Orphaned replica detection with optional automatic cleanup to reduce manual - maintenance. - - Snapshot prune capability to delete snapshots directly behind the head to - reclaim duplicated space. - - Optional mTLS between longhorn-manager and instance-manager for tighter control-plane - security. - - Experimental support for Cluster Autoscaler via dynamic PDB handling for instance-manager - pods. - breaking_changes: - - CRD API versioning shifts to `longhorn.io/v1beta2` as default; while a conversion - webhook keeps `v1beta1` workable, any tooling that hard-codes v1beta1 manifests - or relies on direct etcd objects should be validated against the new schemas/webhooks. - - Networking/engine invocation path changes (manager->instance-manager proxy) - could affect environments with strict NetworkPolicies/firewalls; if you run - hardened clusters, ensure webhook/manager/instance-manager connectivity is - allowed and consider the new provided NetworkPolicies. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Longhorn now requires Kubernetes >= 1.18 for install/upgrade + (still upgrading only supported from 1.2.x to 1.3.0)., CRDs move to `longhorn.io/v1beta2` + as the default; a conversion webhook is introduced to keep `v1beta1` access + working post-upgrade., New/updated admission webhooks (mutating + validating) + are added and the manager now waits for the webhook server to be ready., + Communication between longhorn-manager and engine/replica processes is changed + to be proxied through instance-manager (enables storage network segregation)., + 'Optional security hardening additions: NetworkPolicies and optional mTLS + between manager and instance-manager.', Snapshot-related API surface expands + with a new Snapshot CRD; CSI snapshot support is extended to Longhorn snapshots., + Orphaned replica detection/cleanup feature added (including opt-in automatic + cleanup)., Instance-manager lifecycle management changes; optional dynamic + PDB management to work with Cluster Autoscaler (experimental)., 'Multiple + operational/UX improvements: snapshot purge/prune improvement, backing image + download support, metrics improvements, non-root default user for images, + etc.'] + features: [Storage network / multi-network cluster support with control-plane/data-plane + segregation via Multus (opt-in)., Managed Kubernetes compatibility improvements + (EKS/GKE/AKS operations like upgrades and node pool replacement)., New v1beta2 + CRDs with structural schema validation and a conversion webhook (v1beta2 + becomes default)., New Snapshot CRD and extended CSI snapshot integration + to create/restore Longhorn snapshots via CSI workflows., Orphaned replica + detection with optional automatic cleanup to reduce manual maintenance., + Snapshot prune capability to delete snapshots directly behind the head to + reclaim duplicated space., Optional mTLS between longhorn-manager and instance-manager + for tighter control-plane security., Experimental support for Cluster Autoscaler + via dynamic PDB handling for instance-manager pods.] + breaking_changes: ['CRD API versioning shifts to `longhorn.io/v1beta2` as default; + while a conversion webhook keeps `v1beta1` workable, any tooling that hard-codes + v1beta1 manifests or relies on direct etcd objects should be validated against + the new schemas/webhooks.', 'Networking/engine invocation path changes (manager->instance-manager + proxy) could affect environments with strict NetworkPolicies/firewalls; + if you run hardened clusters, ensure webhook/manager/instance-manager connectivity + is allowed and consider the new provided NetworkPolicies.'] chart_version: 1.3.0 - images: - - longhornio/longhorn-manager:v1.3.0 - - longhornio/longhorn-ui:v1.3.0 + images: ['longhornio/longhorn-manager:v1.3.0', 'longhornio/longhorn-ui:v1.3.0'] - version: 1.2.6 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Longhorn v1.2.x remains within the same major/minor line; upgrade is primarily - a patch-level move to v1.2.6. - - v1.2.0 introduced new CRDs/controllers for backups (BackupTarget/BackupVolume/Backup - CRs) and for Recurring Jobs; upgrading to 1.2.0 triggers migration of per-volume - recurring job settings to the new RecurringJob resources. - - v1.2.6 includes data-path correctness/performance fixes around filesystem - block size alignment during rebuild and using a specific filesystem block - size to avoid unnecessary RMW operations. - - v1.2.6 also contains fixes around replica auto-balance/rebuild loops and some - helm chart hygiene (removing unused values, updating outdated CSI image tags - in questions.yaml). - features: - - (Introduced in 1.2.0) Encrypted volumes and backups using Kubernetes Secrets - for key storage. - - (Introduced in 1.2.0) CSI volume cloning support. - - (Introduced in 1.2.0) Automatic replica rebalancing based on node/zone soft - anti-affinity. - - (Introduced in 1.2.0) Asynchronous backup operations via new backup CRDs/controllers - and improved scheduling via recurring job/groups. - - (Patch focus in 1.2.6) Data alignment correction and filesystem block size - handling to reduce risk of rare rebuild-related corruption and improve write - performance. - breaking_changes: - - Kubernetes minimum supported version becomes v1.18 in Longhorn v1.2.0 (and - v1.2.6 supports Kubernetes <= v1.24). - - After upgrading to v1.2.0, volume recurring job settings are migrated to new - RecurringJob resources and the `RecurringJobs` field in Volume spec is deprecated. - - 'Known issue in v1.2.0: StorageClasses using the longhorn CSI driver without - specifying `fsType` can hit an `fsGroup`-ineffective issue for new filesystem - volumes (resolved in 1.2.1 per notes).' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Longhorn v1.2.x remains within the same major/minor line; upgrade + is primarily a patch-level move to v1.2.6., v1.2.0 introduced new CRDs/controllers + for backups (BackupTarget/BackupVolume/Backup CRs) and for Recurring Jobs; + upgrading to 1.2.0 triggers migration of per-volume recurring job settings + to the new RecurringJob resources., v1.2.6 includes data-path correctness/performance + fixes around filesystem block size alignment during rebuild and using a + specific filesystem block size to avoid unnecessary RMW operations., 'v1.2.6 + also contains fixes around replica auto-balance/rebuild loops and some helm + chart hygiene (removing unused values, updating outdated CSI image tags + in questions.yaml).'] + features: [(Introduced in 1.2.0) Encrypted volumes and backups using Kubernetes + Secrets for key storage., (Introduced in 1.2.0) CSI volume cloning support., + (Introduced in 1.2.0) Automatic replica rebalancing based on node/zone soft + anti-affinity., (Introduced in 1.2.0) Asynchronous backup operations via + new backup CRDs/controllers and improved scheduling via recurring job/groups., + (Patch focus in 1.2.6) Data alignment correction and filesystem block size + handling to reduce risk of rare rebuild-related corruption and improve write + performance.] + breaking_changes: [Kubernetes minimum supported version becomes v1.18 in Longhorn + v1.2.0 (and v1.2.6 supports Kubernetes <= v1.24)., 'After upgrading to v1.2.0, + volume recurring job settings are migrated to new RecurringJob resources + and the `RecurringJobs` field in Volume spec is deprecated.', 'Known issue + in v1.2.0: StorageClasses using the longhorn CSI driver without specifying + `fsType` can hit an `fsGroup`-ineffective issue for new filesystem volumes + (resolved in 1.2.1 per notes).'] chart_version: 1.2.6 images: [] - version: 1.2.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Longhorn v1.2.0 updates supported Kubernetes versions: minimum supported - Kubernetes is now v1.18; adds compatibility up to Kubernetes v1.22 by migrating - deprecated resources and updating CSI sidecars.' - - 'CSI components are updated; known issue in v1.2.0: if a StorageClass using - the `driver.longhorn.io` provisioner does not specify `fsType`, `fsGroup` - may be ineffective for newly created filesystem volumes due to an external-provisioner - default change. Workaround: explicitly set `parameters.fsType` (e.g., `ext4` - or `xfs`) in the StorageClass; fixed in v1.2.1.' - - 'Recurring jobs are migrated: per-volume `spec.RecurringJobs` is deprecated - and volume recurring job settings are migrated into new RecurringJob CRDs/resources - during upgrade.' - - 'Backup subsystem refactor: introduces BackupTarget/BackupVolume/Backup CRDs - and controllers enabling asynchronous backups; behavior and UI/observability - around backups changes accordingly.' - features: - - 'Kubernetes support updates: minimum K8s version becomes v1.18 and Longhorn - supports K8s v1.22 with updated CSI sidecars.' - - Volume encryption and backup encryption using kernel crypto + Kubernetes Secrets; - encrypted volumes are encrypted in transit and at rest and their backups are - encrypted too. - - CSI volume cloning support to clone PVCs/volumes via CSI primitives. - - Automatic replica rebalancing based on (soft) node/zone anti-affinity when - nodes go up/down. - - 'Backing image enhancements: upload backing images from local and create backing - images from existing volumes.' - - Asynchronous backup operations via new backup-related CRDs/controllers to - improve backup performance and reduce blocking operations. - - Recurring job and recurring job groups via new CRD/controller for reusable - scheduled snapshots/backups; includes default recurring backup policy concept. - breaking_changes: - - 'Kubernetes version compatibility change: you must be running Kubernetes v1.18+ - before upgrading to Longhorn v1.2.0.' - - 'Recurring job model change: volume-level `RecurringJobs` in the Volume spec - is deprecated and settings are migrated to new RecurringJob resources; automation - that edits Volume specs directly must be updated.' - - 'Potential post-upgrade workload behavior change (known issue): StorageClasses - without `fsType` may experience ineffective `fsGroup` on new filesystem volumes - in v1.2.0; mitigate by setting `fsType` explicitly or upgrade to v1.2.1+.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Longhorn v1.2.0 updates supported Kubernetes versions: minimum + supported Kubernetes is now v1.18; adds compatibility up to Kubernetes v1.22 + by migrating deprecated resources and updating CSI sidecars.', 'CSI components + are updated; known issue in v1.2.0: if a StorageClass using the `driver.longhorn.io` + provisioner does not specify `fsType`, `fsGroup` may be ineffective for + newly created filesystem volumes due to an external-provisioner default + change. Workaround: explicitly set `parameters.fsType` (e.g., `ext4` or + `xfs`) in the StorageClass; fixed in v1.2.1.', 'Recurring jobs are migrated: + per-volume `spec.RecurringJobs` is deprecated and volume recurring job settings + are migrated into new RecurringJob CRDs/resources during upgrade.', 'Backup + subsystem refactor: introduces BackupTarget/BackupVolume/Backup CRDs and + controllers enabling asynchronous backups; behavior and UI/observability + around backups changes accordingly.'] + features: ['Kubernetes support updates: minimum K8s version becomes v1.18 and + Longhorn supports K8s v1.22 with updated CSI sidecars.', Volume encryption + and backup encryption using kernel crypto + Kubernetes Secrets; encrypted + volumes are encrypted in transit and at rest and their backups are encrypted + too., CSI volume cloning support to clone PVCs/volumes via CSI primitives., + Automatic replica rebalancing based on (soft) node/zone anti-affinity when + nodes go up/down., 'Backing image enhancements: upload backing images from + local and create backing images from existing volumes.', Asynchronous backup + operations via new backup-related CRDs/controllers to improve backup performance + and reduce blocking operations., Recurring job and recurring job groups + via new CRD/controller for reusable scheduled snapshots/backups; includes + default recurring backup policy concept.] + breaking_changes: ['Kubernetes version compatibility change: you must be running + Kubernetes v1.18+ before upgrading to Longhorn v1.2.0.', 'Recurring job + model change: volume-level `RecurringJobs` in the Volume spec is deprecated + and settings are migrated to new RecurringJob resources; automation that + edits Volume specs directly must be updated.', 'Potential post-upgrade workload + behavior change (known issue): StorageClasses without `fsType` may experience + ineffective `fsGroup` on new filesystem volumes in v1.2.0; mitigate by setting + `fsType` explicitly or upgrade to v1.2.1+.'] chart_version: 1.2.0 - images: - - longhornio/longhorn-manager:v1.2.0 - - longhornio/longhorn-ui:v1.2.0 + images: ['longhornio/longhorn-manager:v1.2.0', 'longhornio/longhorn-ui:v1.2.0'] - version: 1.1.3 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Includes security fixes for CVE-2021-36779 (host operations allowed in privileged - Longhorn-managed pods) and CVE-2021-36780 (unauthorized data access from replicas - via vulnerable instance manager pods). - - Improves data-plane behavior in low-performance environments (e.g., spinning - disks, 1Gbps networks, low CPU). - - Updates default advertised CSI version to CSI 1.2, improving compatibility - with CSI consumers. + features: [Includes security fixes for CVE-2021-36779 (host operations allowed + in privileged Longhorn-managed pods) and CVE-2021-36780 (unauthorized data + access from replicas via vulnerable instance manager pods)., 'Improves data-plane + behavior in low-performance environments (e.g., spinning disks, 1Gbps networks, + low CPU).', 'Updates default advertised CSI version to CSI 1.2, improving + compatibility with CSI consumers.'] breaking_changes: [] chart_version: 1.1.3 images: [] - version: 1.1.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Native RWX (ReadWriteMany) support via NFS provisioner is introduced as an - experimental feature; validate with non-production workloads first. - - Experimental ARM64 support is added so Longhorn can be deployed on ARM64 clusters - without special modifications. - - CSI Snapshotter support is added (requires Kubernetes >=1.17) enabling kubectl-managed - VolumeSnapshots that map to Longhorn backups/restores. - - Prometheus metrics endpoints and a sample Grafana dashboard are added to integrate - Longhorn into existing monitoring/alerting stacks. - - Improved node failure and volume failure recovery, including automatic StatefulSet - recovery behavior and rebuild from existing replicas after temporary node - disconnects. - - Expanded node maintenance operations (supports drain, replica eviction, pausing - rebuilds, auto-removal of deleted K8s nodes, and disk recognition when reattached/moved). - - Data Locality option is added to prefer keeping one replica local to the engine/workload - to improve resilience during network interruptions. - - New setting to allow volume creation with degraded availability (default true; - recommended false for production) for small clusters or constrained capacity - environments. - - Experimental performance improvement by removing the revision counter is introduced. - breaking_changes: - - Kubernetes minimum version increases to v1.16 for Longhorn v1.1.0; clusters - below this must be upgraded before Longhorn. - - CSI Snapshotter feature requires Kubernetes v1.17+ and installation of the - external CSI Snapshot Controller; without it, CSI snapshots will not work. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Native RWX (ReadWriteMany) support via NFS provisioner is introduced + as an experimental feature; validate with non-production workloads first., + Experimental ARM64 support is added so Longhorn can be deployed on ARM64 clusters + without special modifications., CSI Snapshotter support is added (requires + Kubernetes >=1.17) enabling kubectl-managed VolumeSnapshots that map to + Longhorn backups/restores., Prometheus metrics endpoints and a sample Grafana + dashboard are added to integrate Longhorn into existing monitoring/alerting + stacks., 'Improved node failure and volume failure recovery, including automatic + StatefulSet recovery behavior and rebuild from existing replicas after temporary + node disconnects.', 'Expanded node maintenance operations (supports drain, + replica eviction, pausing rebuilds, auto-removal of deleted K8s nodes, and + disk recognition when reattached/moved).', Data Locality option is added + to prefer keeping one replica local to the engine/workload to improve resilience + during network interruptions., New setting to allow volume creation with + degraded availability (default true; recommended false for production) for + small clusters or constrained capacity environments., Experimental performance + improvement by removing the revision counter is introduced.] + breaking_changes: [Kubernetes minimum version increases to v1.16 for Longhorn + v1.1.0; clusters below this must be upgraded before Longhorn., 'CSI Snapshotter + feature requires Kubernetes v1.17+ and installation of the external CSI + Snapshot Controller; without it, CSI snapshots will not work.'] chart_version: 1.1.0 - images: - - longhornio/longhorn-manager:v1.1.0 - - longhornio/longhorn-ui:v1.1.0 + images: ['longhornio/longhorn-manager:v1.1.0', 'longhornio/longhorn-ui:v1.1.0'] - version: 1.0.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14'] requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 - images: - - longhornio/longhorn-manager:v1.0.0 - - longhornio/longhorn-ui:v1.0.0 - name: longhorn + images: ['longhornio/longhorn-manager:v1.0.0', 'longhornio/longhorn-ui:v1.0.0'] - icon: https://avatars.githubusercontent.com/u/36015203?s=400&v=4 git_url: https://github.com/kubernetes-sigs/metrics-server release_url: https://github.com/kubernetes-sigs/metrics-server/releases/tag/v{vsn} helm_repository_url: https://kubernetes-sigs.github.io/metrics-server versions: - version: 0.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Kubernetes dependency updates to v1.36.2, which may improve compatibility - with newer clusters and API behaviors. - - 'Logging behavior improvements: honors `stderrthreshold` when `logtostderr` - is enabled, and reduces log severity for scrape failures on not-ready nodes.' - - 'Documentation improvement: adds a diagram explaining the `kubectl top pod` - request flow through metrics-server.' - - Storage readiness now requires both node and pod metrics to be present before - reporting ready, reducing false-ready states. - breaking_changes: - - 'Readiness semantics are stricter: metrics-server may remain unready until - it has successfully collected both node and pod metrics (could affect rollouts/alerts - that expect quicker readiness).' + features: ['Kubernetes dependency updates to v1.36.2, which may improve compatibility + with newer clusters and API behaviors.', 'Logging behavior improvements: + honors `stderrthreshold` when `logtostderr` is enabled, and reduces log + severity for scrape failures on not-ready nodes.', 'Documentation improvement: + adds a diagram explaining the `kubectl top pod` request flow through metrics-server.', + 'Storage readiness now requires both node and pod metrics to be present before + reporting ready, reducing false-ready states.'] + breaking_changes: ['Readiness semantics are stricter: metrics-server may remain + unready until it has successfully collected both node and pod metrics (could + affect rollouts/alerts that expect quicker readiness).'] chart_version: 3.14.0 - images: - - registry.k8s.io/metrics-server/metrics-server:v0.9.0 + images: ['registry.k8s.io/metrics-server/metrics-server:v0.9.0'] - version: 0.8.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Flags are now wired through to server run options, exposing Kubernetes SecureServingOptions - flags (notably `--disable-http2-serving`) via metrics-server CLI configuration. - - 'Dependency bumps: Go toolchain updated to 1.24.4 and Kubernetes client libraries - to v0.33.2, plus Prometheus module bumped to v0.304.2.' - - Tooling can now target alternate container engines when building/testing (useful - for non-Docker environments). - breaking_changes: - - If you still pass any deprecated klog logging flags removed in v0.7.0 (e.g., - `--logtostderr`, `--log-file`, `--log-dir`, etc.), metrics-server will fail - to start; ensure your deployment/helm values no longer include them. - - Newly exposed secure serving flags may change defaults/behavior in some clusters; - if you need HTTP/2 disabled for compliance/interoperability, explicitly set - `--disable-http2-serving` after upgrading. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Flags are now wired through to server run options, exposing Kubernetes + SecureServingOptions flags (notably `--disable-http2-serving`) via metrics-server + CLI configuration.', 'Dependency bumps: Go toolchain updated to 1.24.4 and + Kubernetes client libraries to v0.33.2, plus Prometheus module bumped to + v0.304.2.', Tooling can now target alternate container engines when building/testing + (useful for non-Docker environments).] + breaking_changes: ['If you still pass any deprecated klog logging flags removed + in v0.7.0 (e.g., `--logtostderr`, `--log-file`, `--log-dir`, etc.), metrics-server + will fail to start; ensure your deployment/helm values no longer include + them.', 'Newly exposed secure serving flags may change defaults/behavior + in some clusters; if you need HTTP/2 disabled for compliance/interoperability, + explicitly set `--disable-http2-serving` after upgrading.'] chart_version: 3.13.0 - images: - - registry.k8s.io/metrics-server/metrics-server:v0.8.0 + images: ['registry.k8s.io/metrics-server/metrics-server:v0.8.0'] - version: 0.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27'] requirements: [] incompatibilities: [] summary: @@ -29331,46 +22379,28 @@ addons: - Optional new configuration knobs you can add to `extraArgs` (or equivalent\ \ chart values):\n - `--logging-format=json` (JSON logs)\n - `--kubelet-request-timeout=`\n\ \ - `--node-selector=` (exclude nodes by label selector)" - chart_updates: - - Metrics-server manifests were restructured (base-components-overlays) upstream; - the chart may reflect this via updated templates/paths but functional intent - is the same. - - PodDisruptionBudget API updated to `policy/v1`. - - Version-specific high-availability manifests were added upstream; ensure your - deployment/replica/PDB settings align with your cluster version guidance. - - Manifests were adjusted to permit running under PodSecurity `restricted` (securityContext/permissions - tightening). - - Autoscaling/addon-resizer manifests and securityContext were updated (notably - `containerSecurityContext` for addonResizer). - features: - - Supports JSON-formatted logging. - - New `--kubelet-request-timeout` flag allows tuning kubelet scrape timeouts. - - New `--node-selector` flag can exclude nodes by label selector. - - Metric collection path can be overridden per-node via the `metrics.k8s.io/resource-metrics-path` - node annotation. - - Binaries are now attached to GitHub release artifacts (useful for airgapped/off-cluster - debugging). - breaking_changes: - - Deprecated klog-specific logging flags were removed; if your Helm values or - manifests still set them, metrics-server will fail to start or ignore flags - depending on arg handling. + chart_updates: [Metrics-server manifests were restructured (base-components-overlays) + upstream; the chart may reflect this via updated templates/paths but functional + intent is the same., PodDisruptionBudget API updated to `policy/v1`., Version-specific + high-availability manifests were added upstream; ensure your deployment/replica/PDB + settings align with your cluster version guidance., Manifests were adjusted + to permit running under PodSecurity `restricted` (securityContext/permissions + tightening)., Autoscaling/addon-resizer manifests and securityContext were + updated (notably `containerSecurityContext` for addonResizer).] + features: [Supports JSON-formatted logging., New `--kubelet-request-timeout` + flag allows tuning kubelet scrape timeouts., New `--node-selector` flag + can exclude nodes by label selector., Metric collection path can be overridden + per-node via the `metrics.k8s.io/resource-metrics-path` node annotation., + Binaries are now attached to GitHub release artifacts (useful for airgapped/off-cluster + debugging).] + breaking_changes: ['Deprecated klog-specific logging flags were removed; if + your Helm values or manifests still set them, metrics-server will fail to + start or ignore flags depending on arg handling.'] chart_version: 3.12.0 - images: - - registry.k8s.io/metrics-server/metrics-server:v0.7.0 + images: ['registry.k8s.io/metrics-server/metrics-server:v0.7.0'] - version: 0.6.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: @@ -29383,725 +22413,281 @@ addons: your existing manifests into Helm values. ' - chart_updates: - - Added official Helm chart and chart metadata. - - Added high-availability manifests/configuration options. - - RBAC permissions were minimized and updated; Metrics Server now needs `nodes/metrics` - instead of `nodes/stats`. - - Switched to the Kubelet resource metrics endpoint for collection. - features: - - High availability configuration was added, enabling running multiple replicas - with the appropriate setup. - - An official Helm chart is now available, making installation/upgrade via Helm - supported. - - Metrics collection migrated to the Kubelet resource metrics endpoint, improving - alignment with current kubelet endpoints and behavior. - breaking_changes: - - 'RBAC requirement changed: Metrics Server now needs access to the `nodes/metrics` - resource instead of `nodes/stats`. Custom manifests/RBAC must be updated or - metrics collection will fail/403.' + chart_updates: [Added official Helm chart and chart metadata., Added high-availability + manifests/configuration options., RBAC permissions were minimized and updated; + Metrics Server now needs `nodes/metrics` instead of `nodes/stats`., Switched + to the Kubelet resource metrics endpoint for collection.] + features: ['High availability configuration was added, enabling running multiple + replicas with the appropriate setup.', 'An official Helm chart is now available, + making installation/upgrade via Helm supported.', 'Metrics collection migrated + to the Kubelet resource metrics endpoint, improving alignment with current + kubelet endpoints and behavior.'] + breaking_changes: ['RBAC requirement changed: Metrics Server now needs access + to the `nodes/metrics` resource instead of `nodes/stats`. Custom manifests/RBAC + must be updated or metrics collection will fail/403.'] chart_version: 3.8.0 - images: - - k8s.gcr.io/metrics-server/metrics-server:v0.6.0 + images: ['k8s.gcr.io/metrics-server/metrics-server:v0.6.0'] - version: 0.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' - - '1.10' - - '1.9' - - '1.8' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', + '1.17', '1.16', '1.15', '1.14', '1.13', '1.12', '1.11', '1.10', '1.9', '1.8'] requirements: [] incompatibilities: [] summary: null chart_version: 3.5.0 - images: - - k8s.gcr.io/metrics-server/metrics-server:v0.5.0 - name: metrics-server + images: ['k8s.gcr.io/metrics-server/metrics-server:v0.5.0'] - icon: https://avatars.githubusercontent.com/u/49998002?s=48&v=4 git_url: https://github.com/open-telemetry/opentelemetry-operator release_url: https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v{vsn} versions: - version: 0.154.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.153.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.152.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.151.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.150.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.149.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.148.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.147.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.146.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.145.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.144.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.143.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.142.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.141.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', + '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.140.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.139.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.138.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.137.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.136.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.135.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.134.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.132.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.131.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.129.1 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', + '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.127.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.126.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.125.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.124.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.123.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.122.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.121.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.120.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.119.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.118.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.117.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', + '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.116.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.115.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.114.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.113.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.112.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.111.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.110.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.109.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - name: opentelemetry-operator - icon: https://avatars.githubusercontent.com/u/22860722?s=48&v=4 git_url: https://github.com/rook/rook release_url: https://github.com/rook/rook/releases/tag/v{vsn} helm_repository_url: https://charts.rook.io/release versions: - version: 1.20.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.37', '1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -30115,44 +22701,31 @@ addons: \ values.\n- From v1.19 (still relevant if you are crossing it): `rook-ceph-cluster`\ \ chart changed Ceph image configuration to **separate repository and tag**\ \ (ensure your values match the new schema)." - chart_updates: - - CSI settings removed from the rook operator configmap and operator Helm chart; - new `ceph-csi-drivers` chart/CRs (`OperatorConfig`, `Driver`) become the place - to configure CSI behavior going forward. - - Defaults for CSI CRs are provided in `operator.yaml`; customizations now documented - under CSI Configuration in v1.20 docs. - features: - - "Kubernetes support window moves to v1.31\u2013v1.36 (from v1.30\u2013v1.35\ - \ in v1.19)." - - SSE-S3 object store encryption can now use HashiCorp Vault Agent auth for - key management. - - Rook now cleans up unused CRUSH rules by default after the Ceph mgr starts - (can be disabled). - - Multi-CephCluster concurrent reconcile setting (`ROOK_RECONCILE_CONCURRENT_CLUSTERS`) - is now stable. - - Operator reconciliation is more robust by matching containers by name instead - of declaration order (helps when mutating webhooks reorder containers). - - 'Encrypted host-based OSDs auto-expand when the underlying disk is resized - (with `encryptedDevice: true`).' - - 'Experimental: RGW Accounts via `CephObjectStoreAccount` CRD and `accountRef` - on `CephObjectStoreUser` (currently only testable with Ceph main image).' - - 'Experimental: Two-node clusters can use a ''floating'' mon that migrates - between nodes on failure.' - breaking_changes: - - 'Ceph-CSI operator is now required to manage CSI driver settings; CSI config - is removed from the rook operator configmap/chart, and ongoing CSI changes - must be applied via Ceph-CSI `OperatorConfig`/`Driver` CRs (Helm: `ceph-csi-drivers` - chart).' + chart_updates: ['CSI settings removed from the rook operator configmap and operator + Helm chart; new `ceph-csi-drivers` chart/CRs (`OperatorConfig`, `Driver`) + become the place to configure CSI behavior going forward.', Defaults for + CSI CRs are provided in `operator.yaml`; customizations now documented under + CSI Configuration in v1.20 docs.] + features: ["Kubernetes support window moves to v1.31\u2013v1.36 (from v1.30\u2013\ + v1.35 in v1.19).", SSE-S3 object store encryption can now use HashiCorp + Vault Agent auth for key management., Rook now cleans up unused CRUSH rules + by default after the Ceph mgr starts (can be disabled)., Multi-CephCluster + concurrent reconcile setting (`ROOK_RECONCILE_CONCURRENT_CLUSTERS`) is now + stable., Operator reconciliation is more robust by matching containers by + name instead of declaration order (helps when mutating webhooks reorder + containers)., 'Encrypted host-based OSDs auto-expand when the underlying + disk is resized (with `encryptedDevice: true`).', 'Experimental: RGW Accounts + via `CephObjectStoreAccount` CRD and `accountRef` on `CephObjectStoreUser` + (currently only testable with Ceph main image).', 'Experimental: Two-node + clusters can use a ''floating'' mon that migrates between nodes on failure.'] + breaking_changes: ['Ceph-CSI operator is now required to manage CSI driver settings; + CSI config is removed from the rook operator configmap/chart, and ongoing + CSI changes must be applied via Ceph-CSI `OperatorConfig`/`Driver` CRs (Helm: + `ceph-csi-drivers` chart).'] chart_version: 1.20.0 images: [] - version: 1.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -30166,38 +22739,28 @@ addons: created via the external cluster script/process and that your CSI secrets/configs reference those clients.' chart_updates: [] - features: - - 'Experimental NVMe over Fabrics (NVMe-oF): expose RBD volumes via NVMe/TCP - for in-cluster pods and external clients using standard NVMe initiators.' - - 'CephCSI v3.16 integration: adds NVMe-oF CSI driver support, improved fencing - during node failure, block volume usage stats, and configurable block encryption - cipher.' - - Operator can optionally reconcile multiple CephCluster CRs concurrently via - `ROOK_RECONCILE_CONCURRENT_CLUSTERS>1` when managing multiple clusters. - - 'Improved operator logging: controller log lines include namespaced names - for more consistent troubleshooting.' - breaking_changes: - - "Supported Kubernetes versions are now **v1.30\u2013v1.35**; clusters on older\ - \ Kubernetes must upgrade Kubernetes first." - - Minimum supported Ceph version is **v19.2.0**. If your Rook v1.18 cluster - runs Ceph v18, you must upgrade Ceph to v19.2.0+ before upgrading Rook. - - '`CephFilesystem.spec.metadataServer.activeStandby` behavior changed: when - set to `false`, the standby MDS deployment is scaled down/removed (not just - disabling standby cache). Plan for reduced failover redundancy if you had - `activeStandby=false`.' - - In external mode with an admin keyring provided, Rook no longer creates CSI - clients automatically; CSI client provisioning must be handled explicitly - (typically via the external cluster script). + features: ['Experimental NVMe over Fabrics (NVMe-oF): expose RBD volumes via + NVMe/TCP for in-cluster pods and external clients using standard NVMe initiators.', + 'CephCSI v3.16 integration: adds NVMe-oF CSI driver support, improved fencing + during node failure, block volume usage stats, and configurable block encryption + cipher.', Operator can optionally reconcile multiple CephCluster CRs concurrently + via `ROOK_RECONCILE_CONCURRENT_CLUSTERS>1` when managing multiple clusters., + 'Improved operator logging: controller log lines include namespaced names + for more consistent troubleshooting.'] + breaking_changes: ["Supported Kubernetes versions are now **v1.30\u2013v1.35**;\ + \ clusters on older Kubernetes must upgrade Kubernetes first.", 'Minimum + supported Ceph version is **v19.2.0**. If your Rook v1.18 cluster runs Ceph + v18, you must upgrade Ceph to v19.2.0+ before upgrading Rook.', '`CephFilesystem.spec.metadataServer.activeStandby` + behavior changed: when set to `false`, the standby MDS deployment is scaled + down/removed (not just disabling standby cache). Plan for reduced failover + redundancy if you had `activeStandby=false`.', 'In external mode with an + admin keyring provided, Rook no longer creates CSI clients automatically; + CSI client provisioning must be handled explicitly (typically via the external + cluster script).'] chart_version: 1.19.0 images: [] - version: 1.18.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -30210,180 +22773,135 @@ addons: \ false`.\n- **Install-time manifest note:** If you deploy with raw manifests,\ \ you now need `csi-operator.yaml`. With Helm, this is handled automatically\ \ when `csi.rookUseCsiOperator` is enabled." - chart_updates: - - Ceph CSI Operator integration is now the default/recommended path for configuring - CSI drivers (RBD/CephFS/NFS). Rook will auto-convert existing Rook CSI settings - to Ceph CSI Operator CRs during the v1.18 upgrade and throughout v1.18.x. - - Operator supports Kubernetes v1.29+ minimum (v1.17 required v1.28+). - - Operator validates node topology labels at CephCluster creation to prevent - invalid CRUSH hierarchies; failures occur for new clusters with duplicated - child topology labels across zones unless the check is skipped. - - Adds `clusterID` support fields for certain CRDs (CephBlockPoolRadosNamespace - and CephFilesystemSubVolumeGroup). - - 'Mon failover behavior improved: if the assigned node no longer exists, failover - is immediate (no 20-minute wait).' - features: - - Ceph CSI Operator becomes the default/recommended way to manage CSI (RBD/CephFS/NFS); - Rook v1.18 auto-migrates existing CSI settings to the operator CRs transparently - during upgrade. - - Ceph CSI v3.15 support (via CSI operator or legacy mode for now); note that - the CSI operator will become required in the next release. - - Experimental CephX key rotation support with new `spec.security.cephx` settings; - requires Ceph v19.2.3+ (admin/mon keys not yet rotatable). - - Support specifying `clusterID` in CephBlockPoolRadosNamespace and CephFilesystemSubVolumeGroup - CRs. - - Faster mon failover when the target node is gone (immediate instead of waiting - 20 minutes). - breaking_changes: - - Kubernetes **v1.29** is now the minimum supported version (v1.17 was v1.28). - - 'New clusters only: CephCluster creation now validates topology labels to - prevent misconfigured CRUSH hierarchies; creation can fail if child labels - (e.g., `topology.rook.io/rack`) are duplicated across zones unless `ROOK_SKIP_OSD_TOPOLOGY_CHECK=true` - is set.' - - 'Object storage changes introduced in v1.17 (relevant when coming from 1.17.0): - OBC additional config fields are disabled by default unless `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` - is enabled; CephObjectStoreUser credential management may purge undeclared - extra S3 credentials; Kafka bucket notifications now default Kafka auth mechanism - to `PLAIN` and cannot be set via `opaqueData` mechanism param.' + chart_updates: [Ceph CSI Operator integration is now the default/recommended + path for configuring CSI drivers (RBD/CephFS/NFS). Rook will auto-convert + existing Rook CSI settings to Ceph CSI Operator CRs during the v1.18 upgrade + and throughout v1.18.x., Operator supports Kubernetes v1.29+ minimum (v1.17 + required v1.28+)., Operator validates node topology labels at CephCluster + creation to prevent invalid CRUSH hierarchies; failures occur for new clusters + with duplicated child topology labels across zones unless the check is skipped., + Adds `clusterID` support fields for certain CRDs (CephBlockPoolRadosNamespace + and CephFilesystemSubVolumeGroup)., 'Mon failover behavior improved: if + the assigned node no longer exists, failover is immediate (no 20-minute + wait).'] + features: [Ceph CSI Operator becomes the default/recommended way to manage CSI + (RBD/CephFS/NFS); Rook v1.18 auto-migrates existing CSI settings to the + operator CRs transparently during upgrade., Ceph CSI v3.15 support (via + CSI operator or legacy mode for now); note that the CSI operator will become + required in the next release., Experimental CephX key rotation support with + new `spec.security.cephx` settings; requires Ceph v19.2.3+ (admin/mon keys + not yet rotatable)., Support specifying `clusterID` in CephBlockPoolRadosNamespace + and CephFilesystemSubVolumeGroup CRs., Faster mon failover when the target + node is gone (immediate instead of waiting 20 minutes).] + breaking_changes: [Kubernetes **v1.29** is now the minimum supported version + (v1.17 was v1.28)., 'New clusters only: CephCluster creation now validates + topology labels to prevent misconfigured CRUSH hierarchies; creation can + fail if child labels (e.g., `topology.rook.io/rack`) are duplicated across + zones unless `ROOK_SKIP_OSD_TOPOLOGY_CHECK=true` is set.', 'Object storage + changes introduced in v1.17 (relevant when coming from 1.17.0): OBC additional + config fields are disabled by default unless `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` + is enabled; CephObjectStoreUser credential management may purge undeclared + extra S3 credentials; Kafka bucket notifications now default Kafka auth + mechanism to `PLAIN` and cannot be set via `opaqueData` mechanism param.'] chart_version: 1.18.0 images: [] - version: 1.17.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Rook v1.17 raises the supported Kubernetes floor to v1.28 (v1.16 was v1.27). - Ensure your cluster/control-plane and any constrained environments (e.g., - managed K8s versions) meet this before upgrading. - - ObjectBucketClaim (OBC) flexibility introduced in v1.16 is now disabled by - default in v1.17 for safer defaults; enabling it requires setting the operator - env var `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS`. This may require updating - the operator deployment/Helm values to add the env var if you rely on those - OBC fields. - - 'CephObjectStoreUser behavior changes due to new first-class credential management: - Rook will purge undeclared extra S3 credentials on existing users; plan to - migrate to declarative credential management if you previously rotated credentials - manually.' - - CephBucketTopic Kafka notifications now default `PLAIN` auth mechanism and - no longer allow overriding the mechanism via `spec.endpoint.kafka.opaqueData` - using `&mechanism=`; update affected CephBucketTopic manifests - explicitly if you use another mechanism. - features: - - OBCs can optionally set a pre-existing Ceph RGW user as bucket owner (via - CephObjectStoreUser), avoiding one-user-per-bucket and allowing re-linking - existing buckets to a specified owner. - - Ceph CSI updated to v3.14 with multiple improvements across RBD/CephFS, snapshots, - and other areas (review ceph-csi 3.14 release notes for specifics relevant - to your workloads). - - Experimental support for external monitors (mons) to place a mon outside the - Kubernetes cluster for certain two-datacenter/stretch-like scenarios. - - DNS-based mon endpoint tracking for clients outside the cluster via `rook-ceph-active-mons..svc.cluster.local`, - reducing manual mon endpoint updates when mon IPs change. - - 'Per-node ceph.conf overrides: node-specific ConfigMaps can override `ceph.conf` - for OSDs and OSD prepare jobs on that node.' - breaking_changes: - - Minimum supported Kubernetes version is now v1.28 (was v1.27 in v1.16). - - OBC additionalConfig options that allow user-controlled bucket policy/etc. - are now disabled by default; you must opt in with `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` - if you depend on them. - - CephObjectStoreUser now has first-class credential management; Rook will remove - (purge) any extra S3 credentials not declared in the resource, which can break - setups where admins manually added/rotated credentials on the RGW user. - - Kafka notification auth mechanism defaults to `PLAIN`, and overriding the - mechanism via `opaqueData` query string is no longer supported; manifests - must be adjusted for non-PLAIN auth. + kube: ['1.33', '1.32', '1.31', '1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Rook v1.17 raises the supported Kubernetes floor to v1.28 (v1.16 + was v1.27). Ensure your cluster/control-plane and any constrained environments + (e.g., managed K8s versions) meet this before upgrading.', ObjectBucketClaim + (OBC) flexibility introduced in v1.16 is now disabled by default in v1.17 + for safer defaults; enabling it requires setting the operator env var `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS`. + This may require updating the operator deployment/Helm values to add the + env var if you rely on those OBC fields., 'CephObjectStoreUser behavior + changes due to new first-class credential management: Rook will purge undeclared + extra S3 credentials on existing users; plan to migrate to declarative credential + management if you previously rotated credentials manually.', CephBucketTopic + Kafka notifications now default `PLAIN` auth mechanism and no longer allow + overriding the mechanism via `spec.endpoint.kafka.opaqueData` using `&mechanism=`; update affected CephBucketTopic manifests explicitly if you use + another mechanism.] + features: ['OBCs can optionally set a pre-existing Ceph RGW user as bucket owner + (via CephObjectStoreUser), avoiding one-user-per-bucket and allowing re-linking + existing buckets to a specified owner.', 'Ceph CSI updated to v3.14 with + multiple improvements across RBD/CephFS, snapshots, and other areas (review + ceph-csi 3.14 release notes for specifics relevant to your workloads).', + Experimental support for external monitors (mons) to place a mon outside the + Kubernetes cluster for certain two-datacenter/stretch-like scenarios., 'DNS-based + mon endpoint tracking for clients outside the cluster via `rook-ceph-active-mons..svc.cluster.local`, + reducing manual mon endpoint updates when mon IPs change.', 'Per-node ceph.conf + overrides: node-specific ConfigMaps can override `ceph.conf` for OSDs and + OSD prepare jobs on that node.'] + breaking_changes: [Minimum supported Kubernetes version is now v1.28 (was v1.27 + in v1.16)., OBC additionalConfig options that allow user-controlled bucket + policy/etc. are now disabled by default; you must opt in with `ROOK_OBC_ALLOW_ADDITIONAL_CONFIG_FIELDS` + if you depend on them., 'CephObjectStoreUser now has first-class credential + management; Rook will remove (purge) any extra S3 credentials not declared + in the resource, which can break setups where admins manually added/rotated + credentials on the RGW user.', 'Kafka notification auth mechanism defaults + to `PLAIN`, and overriding the mechanism via `opaqueData` query string is + no longer supported; manifests must be adjusted for non-PLAIN auth.'] chart_version: 1.17.0 images: [] - version: 1.16.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Ceph-CSI driver updated to v3.13, adding volume group snapshots plus various - CephFS/RBD improvements and sidecar updates. - - CephBlockPoolRadosNamespace now supports mirroring, including optional periodic - status monitoring when the parent pool has statusCheck enabled. - - PVC-based OSDs can be migrated to enable/disable encryption. - - Ceph object storage gains multiple RGW instances support and more advanced - configuration options (extra CLI params/ceph.conf settings). - - ObjectBucketClaims can manage S3 bucket policy via additionalConfig.bucketPolicy; - RGW admin ops logging can be enabled via opsLogSidecar. - - Kubernetes support is extended up to v1.32. - breaking_changes: - - Ceph Quincy (v17) support is removed; only Ceph Reef (v18) and Squid (v19) - are supported in Rook v1.16. - - "CSI network \u201Cholder\u201D pods are removed; clusters still using csi-*plugin-holder-*\ - \ must disable/remove them before upgrading." - - Minimum supported Kubernetes version increases to v1.27. + kube: ['1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Ceph-CSI driver updated to v3.13, adding volume group snapshots + plus various CephFS/RBD improvements and sidecar updates.', 'CephBlockPoolRadosNamespace + now supports mirroring, including optional periodic status monitoring when + the parent pool has statusCheck enabled.', PVC-based OSDs can be migrated + to enable/disable encryption., Ceph object storage gains multiple RGW instances + support and more advanced configuration options (extra CLI params/ceph.conf + settings)., ObjectBucketClaims can manage S3 bucket policy via additionalConfig.bucketPolicy; + RGW admin ops logging can be enabled via opsLogSidecar., Kubernetes support + is extended up to v1.32.] + breaking_changes: [Ceph Quincy (v17) support is removed; only Ceph Reef (v18) + and Squid (v19) are supported in Rook v1.16., "CSI network \u201Cholder\u201D\ + \ pods are removed; clusters still using csi-*plugin-holder-* must disable/remove\ + \ them before upgrading.", Minimum supported Kubernetes version increases + to v1.27.] chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Kubernetes minimum supported version increases to 1.26 in v1.15.0 (was 1.25 - in v1.14.0); verify cluster version before upgrading. - - Rook now uses fully-qualified image names (e.g., docker.io/rook/ceph) in operator - manifests and Helm charts; if you mirror images or use private registries, - ensure overrides still work as expected. - - Ceph-CSI sidecars/images updated with Ceph-CSI v3.12; expect rolling restarts - of CSI components during upgrade. - features: - - Adds support for Ceph Squid (v19) in addition to Reef (v18) and Quincy (v17); - note Quincy support will be removed in Rook v1.16. - - Ceph-CSI driver updated to v3.12, bringing new RBD options, log rotation, - and updated sidecar images. - - 'New cluster options to allow updating OSD device class (allowDeviceClassUpdate: - true) and OSD weight (allowOsdCrushWeightUpdate: true) via the CephCluster - CR.' - breaking_changes: - - Minimum supported Kubernetes version is now v1.26; upgrade Kubernetes before - upgrading Rook if needed. - - CephBlockPool updates now error when an invalid deviceClass is specified; - existing pools with invalid device class settings may fail until corrected. - - "CSI network \u201Cholder\u201D pods are now deprecated and should be disabled\ - \ if present; this becomes required before upgrading to Rook v1.16." - - Ceph COSI driver image changes can impact existing COSI Buckets/BucketClaims/BucketAccesses; - follow the upstream migration guide before/after upgrade. - - Object store endpoint behavior changes when spec.hosting is set; use the new - spec.hosting.advertiseEndpoint to get the desired endpoint behavior. + kube: ['1.31', '1.30', '1.29', '1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Kubernetes minimum supported version increases to 1.26 in v1.15.0 + (was 1.25 in v1.14.0); verify cluster version before upgrading., 'Rook now + uses fully-qualified image names (e.g., docker.io/rook/ceph) in operator + manifests and Helm charts; if you mirror images or use private registries, + ensure overrides still work as expected.', Ceph-CSI sidecars/images updated + with Ceph-CSI v3.12; expect rolling restarts of CSI components during upgrade.] + features: [Adds support for Ceph Squid (v19) in addition to Reef (v18) and Quincy + (v17); note Quincy support will be removed in Rook v1.16., 'Ceph-CSI driver + updated to v3.12, bringing new RBD options, log rotation, and updated sidecar + images.', 'New cluster options to allow updating OSD device class (allowDeviceClassUpdate: + true) and OSD weight (allowOsdCrushWeightUpdate: true) via the CephCluster + CR.'] + breaking_changes: [Minimum supported Kubernetes version is now v1.26; upgrade + Kubernetes before upgrading Rook if needed., CephBlockPool updates now error + when an invalid deviceClass is specified; existing pools with invalid device + class settings may fail until corrected., "CSI network \u201Cholder\u201D\ + \ pods are now deprecated and should be disabled if present; this becomes\ + \ required before upgrading to Rook v1.16.", Ceph COSI driver image changes + can impact existing COSI Buckets/BucketClaims/BucketAccesses; follow the + upstream migration guide before/after upgrade., Object store endpoint behavior + changes when spec.hosting is set; use the new spec.hosting.advertiseEndpoint + to get the desired endpoint behavior.] chart_version: 1.15.0 images: [] - version: 1.14.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.25' + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.25'] requirements: [] incompatibilities: [] summary: @@ -30395,116 +22913,81 @@ addons: \ config. If you relied on it (especially if set to `\"true\"`), configure\ \ the equivalent **per-`CephCluster` CSI driver options** before upgrading\ \ (see the v1.14 docs for `csi.driverOptions`).\n" - chart_updates: - - Kubernetes minimum version raised to **v1.25** (cluster must be upgraded first). - - Ceph daemon pods that used the `default` service account now use **`rook-ceph-default`** - (review any RBAC/PSA/PodSecurity policies or tooling that assumed `default`). - - CSI network *plugin holder* pods are being deprecated; optional migration - in v1.14 but plan to disable/migrate ahead of a future required removal. - features: - - "Supports Kubernetes **v1.25\u2013v1.29** (v1.30 planned once released)." - - CephBlockPool CR can set a custom Ceph `application` value. - - RGW object stores can share metadata/data pools using RADOS namespaces to - reduce pool count when multiple object stores exist. - - Adds VolumeSnapshotGroup support for RBD and CephFS CSI drivers. - - Adds S3 virtual-host-style bucket access via `hosting.dnsNames` in CephObjectStore. - - Allows configuring a static prefix for CSI drivers and the OBC provisioner - (default prefix is the `rook-ceph` namespace). - - Adds Azure Key Vault KMS integration for storing OSD encryption keys. - - Adds additional status columns for `kubectl get` output on Rook CRDs. - breaking_changes: - - Minimum supported Kubernetes version is now **v1.25**; upgrade Kubernetes - before upgrading Rook. - - Helm CSI image configuration changed from a single `image` to separate `repository` - + `tag` fields; existing values must be updated. - - CSI network *holder* pods are deprecated; v1.14 migration is optional but - will be required in a future release (plan remediation). - - Operator config `CSI_ENABLE_READ_AFFINITY` removed; configure read-affinity - via each `CephCluster` CSI driver options before upgrading if you previously - enabled it. + chart_updates: [Kubernetes minimum version raised to **v1.25** (cluster must + be upgraded first)., Ceph daemon pods that used the `default` service account + now use **`rook-ceph-default`** (review any RBAC/PSA/PodSecurity policies + or tooling that assumed `default`)., CSI network *plugin holder* pods are + being deprecated; optional migration in v1.14 but plan to disable/migrate + ahead of a future required removal.] + features: ["Supports Kubernetes **v1.25\u2013v1.29** (v1.30 planned once released).", + CephBlockPool CR can set a custom Ceph `application` value., RGW object stores + can share metadata/data pools using RADOS namespaces to reduce pool count + when multiple object stores exist., Adds VolumeSnapshotGroup support for + RBD and CephFS CSI drivers., Adds S3 virtual-host-style bucket access via + `hosting.dnsNames` in CephObjectStore., Allows configuring a static prefix + for CSI drivers and the OBC provisioner (default prefix is the `rook-ceph` + namespace)., Adds Azure Key Vault KMS integration for storing OSD encryption + keys., Adds additional status columns for `kubectl get` output on Rook CRDs.] + breaking_changes: [Minimum supported Kubernetes version is now **v1.25**; upgrade + Kubernetes before upgrading Rook., Helm CSI image configuration changed + from a single `image` to separate `repository` + `tag` fields; existing + values must be updated., CSI network *holder* pods are deprecated; v1.14 + migration is optional but will be required in a future release (plan remediation)., + Operator config `CSI_ENABLE_READ_AFFINITY` removed; configure read-affinity + via each `CephCluster` CSI driver options before upgrading if you previously + enabled it.] chart_version: 1.14.0 images: [] - version: 1.13.0 - kube: - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Default Ceph-CSI driver moves from v3.9 (in 1.12) to v3.10 in 1.13. - - Added experimental `cephConfig` in the `CephCluster` CR to set Ceph config - options via the CR; these settings override existing ceph.conf override mechanisms. - - CSI read-affinity settings are now configured per-cluster in the `CephCluster` - CR instead of the operator ConfigMap. - - CephFS default SubvolumeGroup now enables pinning by default to spread load - predictably across MDS ranks. - - Ceph exporter now uses a reduced-privilege keyring instead of the admin keyring. - - MONs will automatically fail over when `hostNetwork` is changed in the `CephCluster` - CR. - - Rook will honor the label `ceph.rook.io/do-not-reconcile` on all Ceph daemons - to allow advanced maintenance/debug workflows. - breaking_changes: - - Ceph Pacific (v16) support is removed; only Ceph Quincy (v17) and Reef (v18) - are supported in 1.13. - - Minimum Kubernetes version increases to v1.23 (from v1.22 in 1.12). - - Minimum supported Ceph-CSI driver increases to 3.9 (1.12 already required - 3.8+, but 1.13 requires 3.9+). - - Rook admission controller is removed; if you had enabled it, disable it before - upgrading per the 1.13 upgrade guide. + kube: ['1.29', '1.28', '1.27', '1.26', '1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Default Ceph-CSI driver moves from v3.9 (in 1.12) to v3.10 in 1.13., + Added experimental `cephConfig` in the `CephCluster` CR to set Ceph config + options via the CR; these settings override existing ceph.conf override + mechanisms., CSI read-affinity settings are now configured per-cluster in + the `CephCluster` CR instead of the operator ConfigMap., CephFS default + SubvolumeGroup now enables pinning by default to spread load predictably + across MDS ranks., Ceph exporter now uses a reduced-privilege keyring instead + of the admin keyring., MONs will automatically fail over when `hostNetwork` + is changed in the `CephCluster` CR., Rook will honor the label `ceph.rook.io/do-not-reconcile` + on all Ceph daemons to allow advanced maintenance/debug workflows.] + breaking_changes: [Ceph Pacific (v16) support is removed; only Ceph Quincy (v17) + and Reef (v18) are supported in 1.13., Minimum Kubernetes version increases + to v1.23 (from v1.22 in 1.12)., 'Minimum supported Ceph-CSI driver increases + to 3.9 (1.12 already required 3.8+, but 1.13 requires 3.9+).', 'Rook admission + controller is removed; if you had enabled it, disable it before upgrading + per the 1.13 upgrade guide.'] chart_version: 1.13.0 images: [] - version: 1.12.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Support for Ceph Reef (v18). - - Ceph CSI default version bumped to v3.9 (minimum supported v3.8). - - Experimental Ceph COSI driver added to provision object buckets. - - Automation to recover RBD (RWO) volumes after node loss (requires CSI-addons - and K8s v1.26 non-graceful node shutdown feature). - - Multus network validation tool and improvements to external Ceph cluster configuration - script. - - Security hardening by dropping container capabilities. - - Ability to disable ObjectBucketClaim and ObjectBucketNotification controllers. - - 'NFS enhancements: experimental RGW backend for CephNFS, NFS-Ganesha v5.1 - monitoring endpoint support, and kerberos bug fixes.' - breaking_changes: - - Minimum supported Kubernetes version is now v1.22 (was v1.21 in v1.11). - - Minimum supported Ceph-CSI driver is now 3.8; if you pin CSI images/versions, - update them accordingly. - - For CephObjectStores, a manually-set `rgw_run_sync_thread` (via `ceph config - set`) will be overridden based on `disableMultisiteSyncTraffic`; validate - multisite/sync behavior after upgrade. + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Support for Ceph Reef (v18)., Ceph CSI default version bumped to + v3.9 (minimum supported v3.8)., Experimental Ceph COSI driver added to provision + object buckets., Automation to recover RBD (RWO) volumes after node loss + (requires CSI-addons and K8s v1.26 non-graceful node shutdown feature)., + Multus network validation tool and improvements to external Ceph cluster configuration + script., Security hardening by dropping container capabilities., Ability + to disable ObjectBucketClaim and ObjectBucketNotification controllers., + 'NFS enhancements: experimental RGW backend for CephNFS, NFS-Ganesha v5.1 + monitoring endpoint support, and kerberos bug fixes.'] + breaking_changes: [Minimum supported Kubernetes version is now v1.22 (was v1.21 + in v1.11)., 'Minimum supported Ceph-CSI driver is now 3.8; if you pin CSI + images/versions, update them accordingly.', 'For CephObjectStores, a manually-set + `rgw_run_sync_thread` (via `ceph config set`) will be overridden based on + `disableMultisiteSyncTraffic`; validate multisite/sync behavior after upgrade.'] chart_version: 1.12.0 images: [] - version: 1.11.0 - kube: - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -30515,49 +22998,36 @@ addons: \ settings related to **MachineDisruptionBudgets** were removed (see breaking\ \ changes). If you previously set these via chart values/CR, remove them before\ \ upgrading:\n - `manageMachineDisruptionBudgets`\n - `machineDisruptionBudgetNamespace`\n" - chart_updates: - - Charts should no longer assume/enable PodSecurityPolicy by default (`pspEnable` - default is `false`). - - Any chart templating/values that referenced MachineDisruptionBudgets-related - settings must be removed/updated accordingly. - - Expect updated manifests/images for the new default Ceph-CSI version (now - v3.8). - features: - - Ceph-CSI default version is now v3.8, bringing new storage features and fixes - compared to v3.7. - - New `requireMsgr2` option on `CephCluster` allows enforcing msgr2-only communication - (kernel 5.11+), enabling wire features like encryption/compression. - - RGW bucket notifications and topics are now considered stable. - - Ceph exporter daemon becomes the preferred metrics source (performance counters), - reducing load on the Ceph mgr and improving scalability. - - RBD read affinity is available via krbd map options to prefer nearby OSDs - based on CRUSH/topology labels. - - Multi-cluster mirroring with overlapping networks is supported via MCS-compatible - solutions (e.g., Submariner globalnet) for Ceph v17.2.6+. - - Standby Ceph mgr readiness is now handled via readiness probes (active passes, - standby fails) instead of a sidecar. - breaking_changes: - - Kubernetes minimum supported version increased to **v1.21** (ensure the cluster - control plane and nodes meet this before upgrading). - - Minimum supported Ceph-CSI version is **v3.7**; Rook 1.11 deploys **v3.8** - by default, so pinning older CSI versions will not be supported. - - MachineDisruptionBudgets support was removed; delete/stop using related `CephCluster` - fields (`manageMachineDisruptionBudgets`, `machineDisruptionBudgetNamespace`) - and any dependent automation. - - If you relied on PodSecurityPolicy being enabled by default, you must now - explicitly enable it (older K8s only) or migrate to Pod Security Standards/admission - alternatives. + chart_updates: [Charts should no longer assume/enable PodSecurityPolicy by default + (`pspEnable` default is `false`)., Any chart templating/values that referenced + MachineDisruptionBudgets-related settings must be removed/updated accordingly., + Expect updated manifests/images for the new default Ceph-CSI version (now + v3.8).] + features: ['Ceph-CSI default version is now v3.8, bringing new storage features + and fixes compared to v3.7.', 'New `requireMsgr2` option on `CephCluster` + allows enforcing msgr2-only communication (kernel 5.11+), enabling wire + features like encryption/compression.', RGW bucket notifications and topics + are now considered stable., 'Ceph exporter daemon becomes the preferred + metrics source (performance counters), reducing load on the Ceph mgr and + improving scalability.', RBD read affinity is available via krbd map options + to prefer nearby OSDs based on CRUSH/topology labels., 'Multi-cluster mirroring + with overlapping networks is supported via MCS-compatible solutions (e.g., + Submariner globalnet) for Ceph v17.2.6+.', 'Standby Ceph mgr readiness is + now handled via readiness probes (active passes, standby fails) instead + of a sidecar.'] + breaking_changes: [Kubernetes minimum supported version increased to **v1.21** + (ensure the cluster control plane and nodes meet this before upgrading)., + 'Minimum supported Ceph-CSI version is **v3.7**; Rook 1.11 deploys **v3.8** + by default, so pinning older CSI versions will not be supported.', 'MachineDisruptionBudgets + support was removed; delete/stop using related `CephCluster` fields (`manageMachineDisruptionBudgets`, + `machineDisruptionBudgetNamespace`) and any dependent automation.', 'If + you relied on PodSecurityPolicy being enabled by default, you must now explicitly + enable it (older K8s only) or migrate to Pod Security Standards/admission + alternatives.'] chart_version: 1.11.0 images: [] - version: 1.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' + kube: ['1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: @@ -30575,44 +23045,30 @@ addons: \ Ensure your Ceph cluster is **>= v16 (Pacific)** before upgrading to Rook\ \ **v1.10**.\n- **Kubernetes minimum version**: Rook **v1.10** requires **Kubernetes\ \ >= 1.19**." - chart_updates: - - Prometheus alerting rules are now installed/managed by the **cluster Helm - chart** when enabled via `monitoring.createPrometheusRules` (instead of being - created via the `CephCluster` CR setting). - - Helm charts now ship with **default resource requests/limits** for Ceph component - pods (review and tune for your environment). - features: - - Ceph-CSI **v3.7** becomes the default CSI driver version with Rook v1.10 (brings - CSI feature updates per upstream v3.7 notes). - - RGW adds support for **AWS Server Side Encryption** (AWS-SSE:S3) configuration. - - '`customEndpoints` added for Object Multi-site connections in `CephObjectZone`.' - - Host-based clusters can use OSDs on **logical volumes (LVM)** in addition - to raw devices/partitions. - - Toolbox pod now uses the **Ceph image directly**, matching the Ceph version - running in your cluster. - - (From v1.9) Network **encryption** and **compression** settings are configurable - via `CephCluster` (with kernel/Ceph version prerequisites). - breaking_changes: - - MDS liveness/startup probes must be configured on **`CephFilesystem`**, not - `CephCluster` (update your CR manifests accordingly). - - Ceph Octopus (v15) is **no longer supported** in v1.10; upgrade Ceph to **>= - v16** first. - - Rook v1.10 requires **Kubernetes >= 1.19**. - - If you depended on `CephCluster.spec.monitoring.enabled` to create Prometheus - rules, switch to Helm value **`monitoring.createPrometheusRules`**. - - Helm charts now apply **default pod resources** for Ceph components; this - can change scheduling/limits if you were not explicitly setting them. + chart_updates: [Prometheus alerting rules are now installed/managed by the **cluster + Helm chart** when enabled via `monitoring.createPrometheusRules` (instead + of being created via the `CephCluster` CR setting)., Helm charts now ship + with **default resource requests/limits** for Ceph component pods (review + and tune for your environment).] + features: [Ceph-CSI **v3.7** becomes the default CSI driver version with Rook + v1.10 (brings CSI feature updates per upstream v3.7 notes)., 'RGW adds support + for **AWS Server Side Encryption** (AWS-SSE:S3) configuration.', '`customEndpoints` + added for Object Multi-site connections in `CephObjectZone`.', Host-based + clusters can use OSDs on **logical volumes (LVM)** in addition to raw devices/partitions., + 'Toolbox pod now uses the **Ceph image directly**, matching the Ceph version + running in your cluster.', (From v1.9) Network **encryption** and **compression** + settings are configurable via `CephCluster` (with kernel/Ceph version prerequisites).] + breaking_changes: ['MDS liveness/startup probes must be configured on **`CephFilesystem`**, + not `CephCluster` (update your CR manifests accordingly).', Ceph Octopus + (v15) is **no longer supported** in v1.10; upgrade Ceph to **>= v16** first., + Rook v1.10 requires **Kubernetes >= 1.19**., 'If you depended on `CephCluster.spec.monitoring.enabled` + to create Prometheus rules, switch to Helm value **`monitoring.createPrometheusRules`**.', + Helm charts now apply **default pod resources** for Ceph components; this + can change scheduling/limits if you were not explicitly setting them.] chart_version: 1.10.0 images: [] - version: 1.9.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: @@ -30627,998 +23083,315 @@ addons: \ moved:** MDS liveness/startup probes are no longer configured via `CephCluster`;\ \ they are configured via the **`CephFilesystem` CR**. If you set or tuned\ \ MDS probes, migrate those settings accordingly." - chart_updates: - - Prometheus alerting rules are now deployed by the rook-ceph-cluster Helm chart - (when enabled) rather than being created based on `CephCluster.spec.monitoring.enabled`. - - Helm charts now include default CPU/memory resource requests/limits (or requests) - for all Ceph component pods; these may change scheduling behavior and should - be reviewed before upgrade. - features: - - Example clusters now run **2 mgr daemons** (active + standby) for higher availability; - services labeled `app=rook-ceph-mgr` will be updated to point to the new active - mgr after failover. - - '**Network encryption** can be configured via `CephCluster` network settings - (requires Linux kernel 5.11+).' - - '**Network compression** can be configured via `CephCluster` network settings - (requires Ceph Quincy/v17 plus a newer kernel, similar to encryption requirements).' - - CSI pods can be configured with a **custom `ceph.conf`**. - - Updated/added **Ceph Prometheus rules** aligned with upstream Ceph recommendations; - can be created via Helm with `monitoring.createPrometheusRules`. - - RGW pods now use a dedicated **`rook-ceph-rgw` service account**. - - New **`CephBlockPoolRadosNamespace` CRD** to manage RADOS namespaces within - a pool. - breaking_changes: - - MDS liveness/startup probes configuration moved from `CephCluster` to `CephFilesystem`; - existing `CephCluster` probe settings will no longer apply until migrated. - - Helm charts now set default pod resources for Ceph components, which can cause - scheduling/admission changes (e.g., pods may not schedule on small nodes) - unless values are adjusted. - - Prometheus rules are no longer created by `CephCluster.spec.monitoring.enabled`; - Helm users must enable rule creation with `monitoring.createPrometheusRules` - (or manage rules externally). - - The obsolete cross-build container was removed (mostly impacts CI/build workflows, - not runtime clusters). + chart_updates: [Prometheus alerting rules are now deployed by the rook-ceph-cluster + Helm chart (when enabled) rather than being created based on `CephCluster.spec.monitoring.enabled`., + Helm charts now include default CPU/memory resource requests/limits (or requests) + for all Ceph component pods; these may change scheduling behavior and should + be reviewed before upgrade.] + features: [Example clusters now run **2 mgr daemons** (active + standby) for + higher availability; services labeled `app=rook-ceph-mgr` will be updated + to point to the new active mgr after failover., '**Network encryption** + can be configured via `CephCluster` network settings (requires Linux kernel + 5.11+).', '**Network compression** can be configured via `CephCluster` network + settings (requires Ceph Quincy/v17 plus a newer kernel, similar to encryption + requirements).', CSI pods can be configured with a **custom `ceph.conf`**., + Updated/added **Ceph Prometheus rules** aligned with upstream Ceph recommendations; + can be created via Helm with `monitoring.createPrometheusRules`., RGW pods + now use a dedicated **`rook-ceph-rgw` service account**., New **`CephBlockPoolRadosNamespace` + CRD** to manage RADOS namespaces within a pool.] + breaking_changes: [MDS liveness/startup probes configuration moved from `CephCluster` + to `CephFilesystem`; existing `CephCluster` probe settings will no longer + apply until migrated., 'Helm charts now set default pod resources for Ceph + components, which can cause scheduling/admission changes (e.g., pods may + not schedule on small nodes) unless values are adjusted.', Prometheus rules + are no longer created by `CephCluster.spec.monitoring.enabled`; Helm users + must enable rule creation with `monitoring.createPrometheusRules` (or manage + rules externally)., 'The obsolete cross-build container was removed (mostly + impacts CI/build workflows, not runtime clusters).'] chart_version: 1.9.0 images: [] - version: 1.8.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null chart_version: 1.8.0 images: [] - version: 1.7.0 - kube: - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null - version: 1.6.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17', '1.16'] requirements: [] incompatibilities: [] summary: null - version: 1.5.0 - kube: - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' + kube: ['1.21', '1.20', '1.19', '1.18', '1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null - version: 1.4.0 - kube: - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' + kube: ['1.20', '1.19', '1.18', '1.17', '1.16', '1.15', '1.14'] requirements: [] incompatibilities: [] summary: null - name: rook - icon: https://avatars.githubusercontent.com/u/34767428?s=48&v=4 git_url: https://github.com/strimzi/strimzi-kafka-operator release_url: https://github.com/strimzi/strimzi-kafka-operator/releases/tag/{vsn} versions: - version: 0.50.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null - version: 0.49.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null - version: 0.48.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null - version: 0.47.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.46.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.45.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.44.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 0.43.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.42.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.41.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.40.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null - version: 0.39.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 0.38.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 0.37.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 0.36.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: null - version: 0.35.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 0.34.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 0.33.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 0.32.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null - version: 0.31.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.30.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.29.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.28.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.27.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.26.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.25.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.24.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.23.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.22.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.21.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16'] requirements: [] incompatibilities: [] summary: null - version: 0.20.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.19.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.18.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.17.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.16.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.15.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.14.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.13.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] requirements: [] incompatibilities: [] summary: null - version: 0.12.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' - - '1.16' - - '1.15' - - '1.14' - - '1.13' - - '1.12' - - '1.11' - requirements: [] - incompatibilities: [] - summary: null - name: strimzi-kafka + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18', '1.17', + '1.16', '1.15', '1.14', '1.13', '1.12', '1.11'] + requirements: [] + incompatibilities: [] + summary: null - icon: https://github.com/traefik/traefik/raw/master/docs/content/assets/img/traefik.logo-dark.png git_url: https://github.com/traefik/traefik release_url: https://github.com/traefik/traefik/releases/tag/v{vsn} @@ -31626,343 +23399,245 @@ addons: eolApiSlug: traefik versions: - version: 3.7.12 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - v3.7.0 introduced a large batch of new capabilities, mostly around Kubernetes - integrations (Ingress-NGINX provider annotation compatibility, Gateway API - enhancements, and CRD improvements), plus new middleware and UI/observability - options. - - v3.7.12 is primarily a security and stability patch release, fixing three - published CVEs and a handful of correctness/robustness issues (HTTP/3 timeouts, - file provider error context, ingress-nginx edge cases, and service weight - validation). - breaking_changes: - - Potential behavior changes within v3.7.x to watch for include stricter handling/sanitization - of headers and URLs (e.g., removal of untrusted X- headers with underscores, - encoded character handling becoming opt-in) which could affect applications - that relied on previously accepted requests. - - ForwardAuth.TrustForwardHeader was deprecated in v3.7.0; plan to adjust configurations - and validate forward-auth behavior if you were using that option. + kube: ['1.36', '1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['v3.7.0 introduced a large batch of new capabilities, mostly around + Kubernetes integrations (Ingress-NGINX provider annotation compatibility, + Gateway API enhancements, and CRD improvements), plus new middleware and + UI/observability options.', 'v3.7.12 is primarily a security and stability + patch release, fixing three published CVEs and a handful of correctness/robustness + issues (HTTP/3 timeouts, file provider error context, ingress-nginx edge + cases, and service weight validation).'] + breaking_changes: ['Potential behavior changes within v3.7.x to watch for include + stricter handling/sanitization of headers and URLs (e.g., removal of untrusted + X- headers with underscores, encoded character handling becoming opt-in) + which could affect applications that relied on previously accepted requests.', + ForwardAuth.TrustForwardHeader was deprecated in v3.7.0; plan to adjust configurations + and validate forward-auth behavior if you were using that option.] chart_version: 41.4.0 images: [] - version: 3.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Kubernetes ingress-nginx provider gained broad compatibility with many NGINX - annotations (rate limiting, auth snippets, rewrites, timeouts, buffering, - canary, custom headers, allow/whitelist ranges, etc.), making Traefik a more - drop-in replacement for NGINX Ingress setups. - - Gateway API improvements include support for multiple certificateRefs per - listener and secret support for BackendTLSPolicy caCertificateRefs, plus a - bump to gateway-api v1.5.1. - - 'Kubernetes CRDs gained new capabilities: ingressClassName in CRD specs, TraefikService - failover support, and ServersTransport cipherSuites configuration.' - - 'New routing control: configurable provider routing precedence, and wildcard - host support in Host/HostSNI matchers (Ingress/Gateway/ingress-nginx contexts).' - - Observability and logging enhancements include additional Kubernetes Ingress - access-log fields and the ability to emit stdio access logs alongside OTLP - logging. - - Security/HTTP handling additions include a new encodedCharacters middleware, - improved retry logic based on status codes/timeouts/non-idempotent methods, - and options around handling/sanitizing encoded characters. - - Dashboard/UI improvements add a certificates overview/menu, server weight - display, and configurable dashboard name. - breaking_changes: - - ForwardAuth.TrustForwardHeader is deprecated; configurations relying on it - should be reviewed and updated per the v3.7 migration guide. - - Traefik is stricter about suspicious/encoded characters (now rejected by default/with - new opt-in controls); applications depending on unusual encoded URLs may see - new 4xx responses unless configured appropriately. - - Access logs may now be produced for rejected requests, which can change log - volume/alerting expectations. - - 'Ingress NGINX provider: the experimental flag is deprecated and the provider - underwent refactors; some behaviors (e.g., SSL redirect, rewrite-target handling) - changed/fixed and should be validated against your current annotations/config.' + kube: ['1.36', '1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Kubernetes ingress-nginx provider gained broad compatibility with + many NGINX annotations (rate limiting, auth snippets, rewrites, timeouts, + buffering, canary, custom headers, allow/whitelist ranges, etc.), making + Traefik a more drop-in replacement for NGINX Ingress setups.', 'Gateway + API improvements include support for multiple certificateRefs per listener + and secret support for BackendTLSPolicy caCertificateRefs, plus a bump to + gateway-api v1.5.1.', 'Kubernetes CRDs gained new capabilities: ingressClassName + in CRD specs, TraefikService failover support, and ServersTransport cipherSuites + configuration.', 'New routing control: configurable provider routing precedence, + and wildcard host support in Host/HostSNI matchers (Ingress/Gateway/ingress-nginx + contexts).', Observability and logging enhancements include additional Kubernetes + Ingress access-log fields and the ability to emit stdio access logs alongside + OTLP logging., 'Security/HTTP handling additions include a new encodedCharacters + middleware, improved retry logic based on status codes/timeouts/non-idempotent + methods, and options around handling/sanitizing encoded characters.', 'Dashboard/UI + improvements add a certificates overview/menu, server weight display, and + configurable dashboard name.'] + breaking_changes: [ForwardAuth.TrustForwardHeader is deprecated; configurations + relying on it should be reviewed and updated per the v3.7 migration guide., + Traefik is stricter about suspicious/encoded characters (now rejected by default/with + new opt-in controls); applications depending on unusual encoded URLs may + see new 4xx responses unless configured appropriately., 'Access logs may + now be produced for rejected requests, which can change log volume/alerting + expectations.', 'Ingress NGINX provider: the experimental flag is deprecated + and the provider underwent refactors; some behaviors (e.g., SSL redirect, + rewrite-target handling) changed/fixed and should be validated against your + current annotations/config.'] chart_version: 40.0.1 images: [] - version: 3.6.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'ACME: new certificate resolver options, following earlier v3.5 OCSP stapling - and HTTP challenge delay/timeout improvements.' - - 'Health checks: adds TCP health checks and passive health checks (in addition - to v3.5 healthcheck improvements).' - - 'Load balancing: adds "least time" strategy and HighestRandomWeight algorithm - (plus CRD support for HighestRandomWeight).' - - 'Kubernetes: Gateway API bumped to v1.4.0; Ingress can publish ExternalName - services; adds a Knative provider.' - - 'Docker/ECS: can discover non-running Docker containers; ECS gains IPv6 support.' - - "Middleware/server: multi-layer routing; warning when maxBodySize isn\u2019\ - t set." - - 'Plugins: adds syscall support; earlier v3.5 allowed enabling unsafe yaegi - via plugin manifest.' - - 'HTTP/2: adds HPACK table size tuning options.' - - 'Web UI: dashboard continues React migration and adds Hub demo plus layout - tweaks.' - breaking_changes: - - 'Potential behavior change risk: multi-layer routing and new load-balancing/healthcheck - features may alter request routing/traffic patterns if enabled.' - - Gateway API bump may expose/require updated CRDs or behavior differences depending - on cluster/controller versions. - - Ingress prefix-matching behavior was made consistent with Kubernetes docs - in v3.5; if you rely on the old behavior, routes may match differently after - upgrading to >=3.5 (including 3.6). + kube: ['1.35', '1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['ACME: new certificate resolver options, following earlier v3.5 OCSP + stapling and HTTP challenge delay/timeout improvements.', 'Health checks: + adds TCP health checks and passive health checks (in addition to v3.5 healthcheck + improvements).', 'Load balancing: adds "least time" strategy and HighestRandomWeight + algorithm (plus CRD support for HighestRandomWeight).', 'Kubernetes: Gateway + API bumped to v1.4.0; Ingress can publish ExternalName services; adds a + Knative provider.', 'Docker/ECS: can discover non-running Docker containers; + ECS gains IPv6 support.', "Middleware/server: multi-layer routing; warning\ + \ when maxBodySize isn\u2019t set.", 'Plugins: adds syscall support; earlier + v3.5 allowed enabling unsafe yaegi via plugin manifest.', 'HTTP/2: adds + HPACK table size tuning options.', 'Web UI: dashboard continues React migration + and adds Hub demo plus layout tweaks.'] + breaking_changes: ['Potential behavior change risk: multi-layer routing and + new load-balancing/healthcheck features may alter request routing/traffic + patterns if enabled.', Gateway API bump may expose/require updated CRDs + or behavior differences depending on cluster/controller versions., 'Ingress + prefix-matching behavior was made consistent with Kubernetes docs in v3.5; + if you rely on the old behavior, routes may match differently after upgrading + to >=3.5 (including 3.6).'] chart_version: 37.3.0 - images: - - docker.io/traefik:v3.6.0 + images: ['docker.io/traefik:v3.6.0'] eolAt: '2026-08-16' - version: 3.5.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'ACME improvements: OCSP stapling support plus new tuning options for HTTP-01 - challenge delay and ACME HTTP client timeout.' - - 'Kubernetes-related additions: new NGINX Ingress provider and Gateway API - dependency bumped to v1.3.0.' - - 'Ingress behavior change: Prefix path matching is now consistent with Kubernetes - documentation (may affect which Ingress rules match).' - - 'Observability improvements for OpenTelemetry: more resource attribute detectors, - automatic k8s resource attributes, new resourceAttributes option for OTel - metrics, and reduced default tracing span volume with trace verbosity control.' - - 'Dashboard updates: UI migrated to React and improved visualization for Errors - middleware StatusRewrites.' - - 'TLS enhancement: adds X25519MLKEM768 (post-quantum) key exchange option.' - - 'Plugin system: plugin manifests can now allow enabling unsafe mode in Yaegi.' - - 'ForwardAuth middleware: better handling of context-canceled scenarios.' - breaking_changes: - - Potential behavioral change for Kubernetes Ingress Prefix matching; verify - your Ingress rules/routes still match as expected after upgrade, especially - for overlapping prefixes. - - Trace output may change because Traefik produces fewer spans by default due - to new trace verbosity behavior; dashboards/alerts based on span counts may - need adjustment. + kube: ['1.35', '1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['ACME improvements: OCSP stapling support plus new tuning options + for HTTP-01 challenge delay and ACME HTTP client timeout.', 'Kubernetes-related + additions: new NGINX Ingress provider and Gateway API dependency bumped + to v1.3.0.', 'Ingress behavior change: Prefix path matching is now consistent + with Kubernetes documentation (may affect which Ingress rules match).', + 'Observability improvements for OpenTelemetry: more resource attribute detectors, + automatic k8s resource attributes, new resourceAttributes option for OTel + metrics, and reduced default tracing span volume with trace verbosity control.', + 'Dashboard updates: UI migrated to React and improved visualization for Errors + middleware StatusRewrites.', 'TLS enhancement: adds X25519MLKEM768 (post-quantum) + key exchange option.', 'Plugin system: plugin manifests can now allow enabling + unsafe mode in Yaegi.', 'ForwardAuth middleware: better handling of context-canceled + scenarios.'] + breaking_changes: ['Potential behavioral change for Kubernetes Ingress Prefix + matching; verify your Ingress rules/routes still match as expected after + upgrade, especially for overlapping prefixes.', Trace output may change + because Traefik produces fewer spans by default due to new trace verbosity + behavior; dashboards/alerts based on span counts may need adjustment.] chart_version: 37.0.0 - images: - - docker.io/traefik:v3.5.0 + images: ['docker.io/traefik:v3.5.0'] eolAt: '2025-11-07' - version: 3.4.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Security hardening in v3.3.6: request path is now sanitized (collapses /../, - /./ and duplicate slashes) before router matching and before forwarding to - backends.' - - v3.4.0 adds ACME options `acme.profile` and `acme.emailAddresses`. - - v3.4.0 adds a Redis-backed rate limiter middleware. - - v3.4.0 adds `p2c` (power-of-two-choices) load-balancing strategy for services. - - v3.4.0 extends forwardAuth to optionally preserve the original request method. - - 'v3.4.0 improves Kubernetes support: better CRD CEL validations, Gateway API - TLSRoute rule priority, and ingress status for ClusterIP/NodePort services.' - - 'v3.4.0 adds TLS features: add root CAs via ConfigMaps and ability to disable - TLS session tickets.' - - v3.4.0 adds sticky-session cookie domain configuration and WebUI auto theme - option. - breaking_changes: - - 'Potential behavior change starting v3.3.6: request path sanitization can - change routing/backends for paths containing dot-segments or duplicate slashes; - validate against your existing router rules and any apps that rely on raw - paths.' - - v3.4.0 removes the default load-balancing strategy from Kubernetes IngressRoute/CRD - resources; if you relied on the implicit default, you may need to set an explicit - strategy. - - '`defaultRuleSyntax` and `ruleSyntax` are deprecated in v3.4.0 (plan to remove/avoid - using them going forward).' + kube: ['1.35', '1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Security hardening in v3.3.6: request path is now sanitized (collapses + /../, /./ and duplicate slashes) before router matching and before forwarding + to backends.', v3.4.0 adds ACME options `acme.profile` and `acme.emailAddresses`., + v3.4.0 adds a Redis-backed rate limiter middleware., v3.4.0 adds `p2c` (power-of-two-choices) + load-balancing strategy for services., v3.4.0 extends forwardAuth to optionally + preserve the original request method., 'v3.4.0 improves Kubernetes support: + better CRD CEL validations, Gateway API TLSRoute rule priority, and ingress + status for ClusterIP/NodePort services.', 'v3.4.0 adds TLS features: add + root CAs via ConfigMaps and ability to disable TLS session tickets.', v3.4.0 + adds sticky-session cookie domain configuration and WebUI auto theme option.] + breaking_changes: ['Potential behavior change starting v3.3.6: request path + sanitization can change routing/backends for paths containing dot-segments + or duplicate slashes; validate against your existing router rules and any + apps that rely on raw paths.', 'v3.4.0 removes the default load-balancing + strategy from Kubernetes IngressRoute/CRD resources; if you relied on the + implicit default, you may need to set an explicit strategy.', '`defaultRuleSyntax` + and `ruleSyntax` are deprecated in v3.4.0 (plan to remove/avoid using them + going forward).'] chart_version: 35.4.0 - images: - - docker.io/traefik:v3.4.0 + images: ['docker.io/traefik:v3.4.0'] eolAt: '2025-07-23' - version: 3.3.6 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 35.2.0 - images: - - docker.io/traefik:v3.3.6 + images: ['docker.io/traefik:v3.3.6'] eolAt: '2025-05-05' - version: 3.3.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null eolAt: '2025-05-05' - version: 3.2.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null chart_version: 33.0.0 - images: - - docker.io/traefik:v3.2.0 + images: ['docker.io/traefik:v3.2.0'] eolAt: '2025-01-06' - version: 3.1.7 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null eolAt: '2024-10-28' - version: 3.1.4 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Datadog metrics output now better handles `unix://` endpoints by guessing - the socket type when the prefix is `unix` (improves compatibility for Datadog - socket configurations). + features: ['Datadog metrics output now better handles `unix://` endpoints by + guessing the socket type when the prefix is `unix` (improves compatibility + for Datadog socket configurations).'] breaking_changes: [] chart_version: 31.1.1 - images: - - docker.io/traefik:v3.1.4 + images: ['docker.io/traefik:v3.1.4'] eolAt: '2024-10-28' - version: 3.1.3 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Security fixes included in this upgrade: v3.0.2 addressed GHSA-7jmw-8259-q9jx - (CVE-2024-24790 related) and v3.1.3 includes CVE-2024-45410 (GHSA-62c8-mh53-4cqv).' - - 'Kubernetes Ingress improvements: you can configure rule syntax via Ingress - annotation, and empty configuration for the Kubernetes Ingress provider is - allowed again.' - - 'Observability improvements and fixes: updated OpenTelemetry dependencies, - fixed Grafana label_replace for service-name in metrics, and multiple tracing/OTLP - documentation + stability fixes.' - - 'Compression middleware behavior improvements: better Accept-Encoding handling - (including weights) and correct status code forwarding when Brotli compression - is disabled.' - - 'Plugins internal change: removed goexport dependency and added _initialize - (plugin loading/runtime change).' - breaking_changes: - - "Potentially breaking for monitoring: the v3 migration guide notes missing\ - \ metrics removal\u2014verify any dashboards/alerts that rely on Traefik metrics\ - \ that may have been removed/renamed in v3.x." - - 'Kubernetes API version expectations: documentation removes mentions of traefik.io/v1; - ensure your CRDs/manifests align with the supported API versions for Traefik - v3 (commonly traefik.io/v1alpha1 depending on resource).' + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Security fixes included in this upgrade: v3.0.2 addressed GHSA-7jmw-8259-q9jx + (CVE-2024-24790 related) and v3.1.3 includes CVE-2024-45410 (GHSA-62c8-mh53-4cqv).', + 'Kubernetes Ingress improvements: you can configure rule syntax via Ingress + annotation, and empty configuration for the Kubernetes Ingress provider + is allowed again.', 'Observability improvements and fixes: updated OpenTelemetry + dependencies, fixed Grafana label_replace for service-name in metrics, and + multiple tracing/OTLP documentation + stability fixes.', 'Compression middleware + behavior improvements: better Accept-Encoding handling (including weights) + and correct status code forwarding when Brotli compression is disabled.', + 'Plugins internal change: removed goexport dependency and added _initialize + (plugin loading/runtime change).'] + breaking_changes: ["Potentially breaking for monitoring: the v3 migration guide\ + \ notes missing metrics removal\u2014verify any dashboards/alerts that rely\ + \ on Traefik metrics that may have been removed/renamed in v3.x.", 'Kubernetes + API version expectations: documentation removes mentions of traefik.io/v1; + ensure your CRDs/manifests align with the supported API versions for Traefik + v3 (commonly traefik.io/v1alpha1 depending on resource).'] chart_version: 31.1.0 - images: - - docker.io/traefik:v3.1.3 + images: ['docker.io/traefik:v3.1.3'] eolAt: '2024-10-28' - version: 3.0.2 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: null chart_version: 28.3.0 - images: - - docker.io/traefik:v3.0.2 + images: ['docker.io/traefik:v3.0.2'] eolAt: '2024-07-15' - version: 2.11.13 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.33', '1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.11.10 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.32', '1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.11.4 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: null eolAt: '2026-09-07' - version: 2.10.3 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: null @@ -31974,642 +23649,352 @@ addons: helm_repository_url: https://vmware-tanzu.github.io/helm-charts versions: - version: 1.18.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null - version: 1.18.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null - version: 1.17.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Velero v1.17 modernizes fs-backup to a micro-service architecture (new controllers/pods - for PVB/PVR data paths), improving concurrency control, cancel/resume behavior, - and steadier node-agent resource usage. - - 'Windows coverage expands: fs-backup now supports Windows workloads; additional - Windows tolerations added.' - - Adds Kubernetes VolumeGroupSnapshot (beta upstream) support for CSI snapshot - backup and CSI snapshot data movement, including documentation and label-key - configuration. - - Adds PriorityClassName support across server, node-agent, data mover pods, - and repository maintenance jobs. - - Adds node-agent load-soothing via PrepareQueueLength to limit how many data-mover-related - pods are created/pending at once. - - 'Improves resiliency: data movements (PVB/PVR, DU/DD) can resume after node-agent - restarts; cancellation/orphan handling improved; server restart handling improved.' - - Adds resource policy includeExcludePolicy support (reusable include/exclude - filters in a resource policy ConfigMap). - - Removes Restic as a valid uploader type for new installs/backups; retains - restore compatibility until v1.19 via legacy PVR controller. - - Moves repository maintenance job configuration from velero server flags to - a ConfigMap; server flags removed accordingly. - - 'Behavior change: during PVC restore, selected-node annotation is now always - removed when no node mapping exists (previously might be preserved).' - - 'Dependency bumps: Go 1.24.6, Kopia 0.21.1; various controller/runtime/library - updates and observability/metrics additions (e.g., BSL availability gauge, - BSL status checks).' - features: - - Modernized fs-backup to a micro-service architecture with concurrency control - and improved resiliency (cancel/resume, survive node-agent restarts). - - fs-backup now supports backing up/restoring Windows workloads. - - Supports Kubernetes VolumeGroupSnapshot for consistent point-in-time snapshots - across multiple volumes (CSI snapshot + CSI data movement). - - PriorityClass support across Velero components so workloads can be scheduled - with appropriate priority. - - Node-agent PrepareQueueLength to throttle data-mover pod creation and reduce - Pending pod storms in large clusters. - - Resource policy now supports reusable include/exclude filters via includeExcludePolicy. - breaking_changes: - - 'Restic deprecation: `--uploader-type=restic` is no longer a valid install - configuration in v1.17; you can still restore older Restic-based backups until - v1.19.' - - Repository maintenance job settings removed from Velero server flags and must - be configured via the maintenance job ConfigMap instead. - - 'PVC restore behavior change: `selected-node` annotation is always removed - when no node mapping exists (previously could be preserved if the node existed).' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Velero v1.17 modernizes fs-backup to a micro-service architecture + (new controllers/pods for PVB/PVR data paths), improving concurrency control, + cancel/resume behavior, and steadier node-agent resource usage.', 'Windows + coverage expands: fs-backup now supports Windows workloads; additional Windows + tolerations added.', 'Adds Kubernetes VolumeGroupSnapshot (beta upstream) + support for CSI snapshot backup and CSI snapshot data movement, including + documentation and label-key configuration.', 'Adds PriorityClassName support + across server, node-agent, data mover pods, and repository maintenance jobs.', + Adds node-agent load-soothing via PrepareQueueLength to limit how many data-mover-related + pods are created/pending at once., 'Improves resiliency: data movements + (PVB/PVR, DU/DD) can resume after node-agent restarts; cancellation/orphan + handling improved; server restart handling improved.', Adds resource policy + includeExcludePolicy support (reusable include/exclude filters in a resource + policy ConfigMap)., Removes Restic as a valid uploader type for new installs/backups; + retains restore compatibility until v1.19 via legacy PVR controller., Moves + repository maintenance job configuration from velero server flags to a ConfigMap; + server flags removed accordingly., 'Behavior change: during PVC restore, + selected-node annotation is now always removed when no node mapping exists + (previously might be preserved).', 'Dependency bumps: Go 1.24.6, Kopia 0.21.1; + various controller/runtime/library updates and observability/metrics additions + (e.g., BSL availability gauge, BSL status checks).'] + features: ['Modernized fs-backup to a micro-service architecture with concurrency + control and improved resiliency (cancel/resume, survive node-agent restarts).', + fs-backup now supports backing up/restoring Windows workloads., Supports Kubernetes + VolumeGroupSnapshot for consistent point-in-time snapshots across multiple + volumes (CSI snapshot + CSI data movement)., PriorityClass support across + Velero components so workloads can be scheduled with appropriate priority., + Node-agent PrepareQueueLength to throttle data-mover pod creation and reduce + Pending pod storms in large clusters., Resource policy now supports reusable + include/exclude filters via includeExcludePolicy.] + breaking_changes: ['Restic deprecation: `--uploader-type=restic` is no longer + a valid install configuration in v1.17; you can still restore older Restic-based + backups until v1.19.', Repository maintenance job settings removed from + Velero server flags and must be configured via the maintenance job ConfigMap + instead., 'PVC restore behavior change: `selected-node` annotation is always + removed when no node mapping exists (previously could be preserved if the + node existed).'] chart_version: 11.3.2 - images: - - docker.io/bitnamilegacy/kubectl:1.35 - - velero/velero:v1.17.1 + images: ['docker.io/bitnamilegacy/kubectl:1.35', 'velero/velero:v1.17.1'] - version: 1.16.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Windows cluster support: Velero components (node-agent, data mover pods, - maintenance jobs) can run on both Linux and Windows nodes, and the built-in - data mover can back up/restore Windows workloads (with documented limitations).' - - 'Parallel ItemBlock backup: item blocks (and their pre/post hooks) can be - processed concurrently; parallelism is controlled by the new server flag `--item-block-worker-count` - (default 1).' - - 'Data mover restore scalability for WaitForFirstConsumer: new node-agent config - flag `ignoreDelayBinding` allows restores to distribute evenly across nodes - instead of being constrained to the volume-attached node.' - - 'Improved observability for data mover: additional logging of intermediate - object statuses on failures and errors during cleanup, enabled by default - in node-agent logs.' - - 'CSI snapshot usability improvement: retained VolumeSnapshotContent objects - are no longer included in backups, reducing unnecessary sync/restore of CSI - objects across clusters.' - - 'Backup repository maintenance improvements: adds `RecentMaintenance` history - to BackupRepository CRs, recaptures running maintenance jobs after server - restart, skips maintenance/init for readOnly BSLs, and adds configurable `fullMaintenanceInterval` - (normalGC/fastGC/eagerGC).' - - 'Volume Policy enhancement: supports filtering volumes by PVC labels.' - - 'Resource status restore per object: annotation `velero.io/restore-status` - can control whether to restore status for a specific object.' - - Velero restore helper binary merged into main Velero image (velero/velero - image now includes velero, velero-helper, velero-restore-helper). - breaking_changes: - - If you enable parallel ItemBlock processing via `--item-block-worker-count` - > 1, expect changed backup execution characteristics (more concurrency and - resource usage); validate cluster/API server capacity and any custom plugins/hooks - for concurrency safety. - - 'Windows support has functional limitations: fs-backup is not supported for - Windows workloads; security descriptors/NTFS extended attributes are not backed - up/restored, so non-admin workloads may not be supported as expected.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Windows cluster support: Velero components (node-agent, data mover + pods, maintenance jobs) can run on both Linux and Windows nodes, and the + built-in data mover can back up/restore Windows workloads (with documented + limitations).', 'Parallel ItemBlock backup: item blocks (and their pre/post + hooks) can be processed concurrently; parallelism is controlled by the new + server flag `--item-block-worker-count` (default 1).', 'Data mover restore + scalability for WaitForFirstConsumer: new node-agent config flag `ignoreDelayBinding` + allows restores to distribute evenly across nodes instead of being constrained + to the volume-attached node.', 'Improved observability for data mover: additional + logging of intermediate object statuses on failures and errors during cleanup, + enabled by default in node-agent logs.', 'CSI snapshot usability improvement: + retained VolumeSnapshotContent objects are no longer included in backups, + reducing unnecessary sync/restore of CSI objects across clusters.', 'Backup + repository maintenance improvements: adds `RecentMaintenance` history to + BackupRepository CRs, recaptures running maintenance jobs after server restart, + skips maintenance/init for readOnly BSLs, and adds configurable `fullMaintenanceInterval` + (normalGC/fastGC/eagerGC).', 'Volume Policy enhancement: supports filtering + volumes by PVC labels.', 'Resource status restore per object: annotation + `velero.io/restore-status` can control whether to restore status for a specific + object.', 'Velero restore helper binary merged into main Velero image (velero/velero + image now includes velero, velero-helper, velero-restore-helper).'] + breaking_changes: ['If you enable parallel ItemBlock processing via `--item-block-worker-count` + > 1, expect changed backup execution characteristics (more concurrency and + resource usage); validate cluster/API server capacity and any custom plugins/hooks + for concurrency safety.', 'Windows support has functional limitations: fs-backup + is not supported for Windows workloads; security descriptors/NTFS extended + attributes are not backed up/restored, so non-admin workloads may not be + supported as expected.'] chart_version: 10.1.3 - images: - - docker.io/bitnamilegacy/kubectl:1.35 - - velero/velero:v1.16.2 + images: ['docker.io/bitnamilegacy/kubectl:1.35', 'velero/velero:v1.16.2'] - version: 1.15.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Data mover micro service: CSI snapshot data movement now runs in dedicated - backup/restore pods instead of node-agent hostPath access, improving security - isolation, resource control, and resilience.' - - Item Block + ItemBlockAction (IBA) plugin model added to group related resources - (built-in for Pods/PVCs) in preparation for future multi-threaded backups; - in 1.15 the model exists but processing is still single-threaded. - - 'Repository maintenance jobs: you can now steer maintenance jobs to specific - nodes via a new repository maintenance configuration ConfigMap.' - - 'BackupPVC config enhancements for data-mover pods: support read-only mounting - (can speed up expose on some storage like Ceph) and choosing a dedicated StorageClass - for BackupPVCs.' - - 'Backup repository cache sizing: new backup repository configuration ConfigMap - lets you cap client-side cache per repository to avoid ephemeral-storage eviction.' - - 'Performance/stability improvements: fixes a server memory leak after plugin - calls; passes client QPS/burst settings to plugins; Kopia maintenance memory - usage improved via upstream changes.' - breaking_changes: - - 'Restic uploader path for filesystem backups is deprecated starting in 1.15: - backups/restores still succeed but warnings appear when using --uploader-type=restic - or restic-based fs-backup paths; plan migration away from restic.' - - node-agent config ConfigMap name is no longer fixed; if you use a non-default - name you must set the node-agent server parameter node-agent-configmap to - match. - - Repository maintenance job settings are moving from Velero server flags to - a new repository maintenance job configuration ConfigMap; if both are set, - ConfigMap values win (flags remain for backward compatibility). - - Changing PVC selected-node feature is deprecated and will be removed in a - future release; avoid relying on it. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Data mover micro service: CSI snapshot data movement now runs in + dedicated backup/restore pods instead of node-agent hostPath access, improving + security isolation, resource control, and resilience.', Item Block + ItemBlockAction + (IBA) plugin model added to group related resources (built-in for Pods/PVCs) + in preparation for future multi-threaded backups; in 1.15 the model exists + but processing is still single-threaded., 'Repository maintenance jobs: + you can now steer maintenance jobs to specific nodes via a new repository + maintenance configuration ConfigMap.', 'BackupPVC config enhancements for + data-mover pods: support read-only mounting (can speed up expose on some + storage like Ceph) and choosing a dedicated StorageClass for BackupPVCs.', + 'Backup repository cache sizing: new backup repository configuration ConfigMap + lets you cap client-side cache per repository to avoid ephemeral-storage + eviction.', 'Performance/stability improvements: fixes a server memory leak + after plugin calls; passes client QPS/burst settings to plugins; Kopia maintenance + memory usage improved via upstream changes.'] + breaking_changes: ['Restic uploader path for filesystem backups is deprecated + starting in 1.15: backups/restores still succeed but warnings appear when + using --uploader-type=restic or restic-based fs-backup paths; plan migration + away from restic.', node-agent config ConfigMap name is no longer fixed; + if you use a non-default name you must set the node-agent server parameter + node-agent-configmap to match., 'Repository maintenance job settings are + moving from Velero server flags to a new repository maintenance job configuration + ConfigMap; if both are set, ConfigMap values win (flags remain for backward + compatibility).', Changing PVC selected-node feature is deprecated and will + be removed in a future release; avoid relying on it.] chart_version: 8.7.2 - images: - - docker.io/bitnami/kubectl:1.35 - - velero/velero:v1.15.2 + images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.15.2'] - version: 1.14.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Moves kopia/restic repository maintenance out of the Velero server pod into - separate Kubernetes Jobs, reducing OOM risk and allowing configurable job - resource requests. - - Extends VolumePolicies to support additional actions (e.g., `fs-backup` and - `snapshot`) so you can control per-volume backup method without modifying - workloads. - - Adds node selection for data-movement (datamover) pods via a ConfigMap to - constrain where high-resource/long-running datamover pods are scheduled. - - Persists VolumeInfo metadata for restores (not just backups) and enhances - `velero restore describe` to show more volume-handling details. - - Introduces a new Restore workflow phase `Finalizing` to ensure PV label restoration - and post-restore hooks run after volume data movement completes. - - "Adds certificate-based authentication for Azure service principals as an\ - \ alternative to client-secret auth, aligning with Azure\u2019s recommended\ - \ phishing-resistant approach." - breaking_changes: - - CSI plugin code is now merged into the main Velero repo and is installed by - default as an internal plugin; do not install it separately via `velero install - --plugins` for v1.14. - - Default CPU/memory requests and limits for the node-agent are removed, making - node-agent pods BestEffort unless you explicitly set resources; this can change - scheduling/eviction behavior. - - 'Backup namespace filtering behavior changes when `includedNamespaces`/`excludedNamespaces` - are unset but label selectors are set: only namespaces containing matching - resources are included (previously all namespaces were included).' - - Restores may now end `PartiallyFailed` in cases where PV patching during `Finalizing` - is blocked (e.g., PV stuck `Pending`), whereas earlier versions might report - `Complete`. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Moves kopia/restic repository maintenance out of the Velero server + pod into separate Kubernetes Jobs, reducing OOM risk and allowing configurable + job resource requests.', 'Extends VolumePolicies to support additional actions + (e.g., `fs-backup` and `snapshot`) so you can control per-volume backup + method without modifying workloads.', Adds node selection for data-movement + (datamover) pods via a ConfigMap to constrain where high-resource/long-running + datamover pods are scheduled., Persists VolumeInfo metadata for restores + (not just backups) and enhances `velero restore describe` to show more volume-handling + details., Introduces a new Restore workflow phase `Finalizing` to ensure + PV label restoration and post-restore hooks run after volume data movement + completes., "Adds certificate-based authentication for Azure service principals\ + \ as an alternative to client-secret auth, aligning with Azure\u2019s recommended\ + \ phishing-resistant approach."] + breaking_changes: [CSI plugin code is now merged into the main Velero repo and + is installed by default as an internal plugin; do not install it separately + via `velero install --plugins` for v1.14., 'Default CPU/memory requests + and limits for the node-agent are removed, making node-agent pods BestEffort + unless you explicitly set resources; this can change scheduling/eviction + behavior.', 'Backup namespace filtering behavior changes when `includedNamespaces`/`excludedNamespaces` + are unset but label selectors are set: only namespaces containing matching + resources are included (previously all namespaces were included).', 'Restores + may now end `PartiallyFailed` in cases where PV patching during `Finalizing` + is blocked (e.g., PV stuck `Pending`), whereas earlier versions might report + `Complete`.'] chart_version: 7.2.2 - images: - - docker.io/bitnami/kubectl:1.35 - - velero/velero:v1.14.1 + images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.14.1'] - version: 1.13.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Resource Modifiers gained JSON Merge Patch and Strategic Merge Patch support, - enabling more flexible restore-time resource edits from the same ConfigMap - rules. - - Node-agent concurrency controls were added so you can cap/shape how many filesystem - backup and CSI snapshot data-mover operations run per node (globally and per-node). - - Kopia uploader now supports configurable parallel file upload options to speed - up filesystem backups and CSI snapshot data movement. - - Restores can optionally write sparse files for fs-restore and CSI snapshot - data movement to improve performance/space usage in some cases. - - "`velero backup describe` output was enhanced with a new \u201CBackup Volumes\u201D\ - \ section and now shows CSI snapshot data movement details." - - Backups now write a new VolumeInfo metadata file in the repository to record - PV/PVC volume backup method, snapshot info, and status; used to drive PV restore - decisions. - - Improved resilience of CSI snapshot data movement across Velero pod/node-agent - restarts so operations are less likely to get stuck after restarts. - - Backup/restore hook execution details are now tracked in CR status (HooksAttempted/HooksFailed) - and shown in describe output. - - AWS SDK for Go was bumped to v2 for better CPU/memory performance. - - Azure AD/Workload Identity support was extended to Kopia operations (filesystem - backup/data mover/etc.) in addition to native snapshots. - - Runtime bumped to Go 1.21.6 and Kopia bumped to 0.15.0 (plus other dependency - bumps for CVEs). - breaking_changes: - - 'CLI output change: `velero backup describe` reorganized/changed formatting; - scripts parsing the old output may break.' - - 'API type change: `DataUploadSpec.DataMoverConfig` changed from `*map[string]string` - to `map[string]string`; any custom tooling/controllers using this field must - be updated.' - - '`velero install` now enables informer cache by default (previously disabled); - this can increase Velero pod memory usage and may require raising memory limits - or explicitly disabling via `--disable-informer-cache`.' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Resource Modifiers gained JSON Merge Patch and Strategic Merge Patch + support, enabling more flexible restore-time resource edits from the same + ConfigMap rules.', Node-agent concurrency controls were added so you can + cap/shape how many filesystem backup and CSI snapshot data-mover operations + run per node (globally and per-node)., Kopia uploader now supports configurable + parallel file upload options to speed up filesystem backups and CSI snapshot + data movement., Restores can optionally write sparse files for fs-restore + and CSI snapshot data movement to improve performance/space usage in some + cases., "`velero backup describe` output was enhanced with a new \u201C\ + Backup Volumes\u201D section and now shows CSI snapshot data movement details.", + 'Backups now write a new VolumeInfo metadata file in the repository to record + PV/PVC volume backup method, snapshot info, and status; used to drive PV + restore decisions.', Improved resilience of CSI snapshot data movement across + Velero pod/node-agent restarts so operations are less likely to get stuck + after restarts., Backup/restore hook execution details are now tracked in + CR status (HooksAttempted/HooksFailed) and shown in describe output., AWS + SDK for Go was bumped to v2 for better CPU/memory performance., Azure AD/Workload + Identity support was extended to Kopia operations (filesystem backup/data + mover/etc.) in addition to native snapshots., Runtime bumped to Go 1.21.6 + and Kopia bumped to 0.15.0 (plus other dependency bumps for CVEs).] + breaking_changes: ['CLI output change: `velero backup describe` reorganized/changed + formatting; scripts parsing the old output may break.', 'API type change: + `DataUploadSpec.DataMoverConfig` changed from `*map[string]string` to `map[string]string`; + any custom tooling/controllers using this field must be updated.', '`velero + install` now enables informer cache by default (previously disabled); this + can increase Velero pod memory usage and may require raising memory limits + or explicitly disabling via `--disable-informer-cache`.'] chart_version: 6.7.0 - images: - - docker.io/bitnami/kubectl:1.35 - - velero/velero:v1.13.2 + images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.13.2'] - version: 1.12.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'CSI Snapshot Data Movement: can move CSI snapshot contents out of the source - cluster/storage into durable backup storage and restore later (including cross-environment/cloud - scenarios).' - - 'Resource Modifiers (JSON Substitutions): define match filters and JSON patch - operations to mutate resources during restore without writing a custom RestoreItemAction - plugin.' - - 'Multiple VolumeSnapshotClasses support in the Velero CSI plugin: allows choosing - a specific VolumeSnapshotClass per backup instead of relying on a single labeled - class.' - - 'Restore finalizer cleanup: `velero restore delete` now also cleans up restore-associated - data in the backup storage location.' - - 'Runtime/deps refresh: Golang bumped to 1.20.7 and Kopia bumped to 0.13.x - along with other dependency updates.' - breaking_changes: - - Default `uploader-type` changes from `restic` to `kopia`, which can change - filesystem-backup behavior and repository expectations if you relied on restic - defaults. - - 'CSI snapshot timing/timeout behavior changed: snapshot handle creation uses - `backup.spec.csiSnapshotTimeout` (was a fixed 10m) and ReadyToUse waiting - uses operation timeouts (default 4h).' - - Helm chart v4.0.0+ supports multiple BackupStorageLocations (BSL) and VolumeSnapshotLocations - (VSL) and changes their values schema from map to slice; this is not backward - compatible and should be migrated before upgrading. - - Finalizers added to Velero CRs (restore/dataupload/datadownload) can cause - `kubectl delete namespace velero` to hang; use `velero uninstall` or remove/handle - finalizers before namespace deletion. + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['CSI Snapshot Data Movement: can move CSI snapshot contents out of + the source cluster/storage into durable backup storage and restore later + (including cross-environment/cloud scenarios).', 'Resource Modifiers (JSON + Substitutions): define match filters and JSON patch operations to mutate + resources during restore without writing a custom RestoreItemAction plugin.', + 'Multiple VolumeSnapshotClasses support in the Velero CSI plugin: allows choosing + a specific VolumeSnapshotClass per backup instead of relying on a single + labeled class.', 'Restore finalizer cleanup: `velero restore delete` now + also cleans up restore-associated data in the backup storage location.', + 'Runtime/deps refresh: Golang bumped to 1.20.7 and Kopia bumped to 0.13.x + along with other dependency updates.'] + breaking_changes: ['Default `uploader-type` changes from `restic` to `kopia`, + which can change filesystem-backup behavior and repository expectations + if you relied on restic defaults.', 'CSI snapshot timing/timeout behavior + changed: snapshot handle creation uses `backup.spec.csiSnapshotTimeout` + (was a fixed 10m) and ReadyToUse waiting uses operation timeouts (default + 4h).', Helm chart v4.0.0+ supports multiple BackupStorageLocations (BSL) + and VolumeSnapshotLocations (VSL) and changes their values schema from map + to slice; this is not backward compatible and should be migrated before + upgrading., Finalizers added to Velero CRs (restore/dataupload/datadownload) + can cause `kubectl delete namespace velero` to hang; use `velero uninstall` + or remove/handle finalizers before namespace deletion.] chart_version: 5.2.2 - images: - - docker.io/bitnami/kubectl:1.35 - - velero/velero:v1.12.3 + images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.12.3'] - version: 1.11.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', + '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null chart_version: 5.0.2 - images: - - docker.io/bitnami/kubectl:1.35 - - velero/velero:v1.11.1 + images: ['docker.io/bitnami/kubectl:1.35', 'velero/velero:v1.11.1'] - version: 1.10.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null - version: 1.9.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19', '1.18'] requirements: [] incompatibilities: [] summary: null - version: 1.8.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - requirements: [] - incompatibilities: [] - summary: null - name: velero + kube: ['1.28', '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', + '1.19', '1.18'] + requirements: [] + incompatibilities: [] + summary: null - icon: https://avatars.githubusercontent.com/u/33043890?s=48&v=4 git_url: https://github.com/vitessio/vitess release_url: https://github.com/vitessio/vitess/releases/tag/v{vsn} eolApiSlug: vitess versions: - version: 23.0.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.34', '1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null - version: 22.0.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null - version: 21.0.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null - version: 20.0.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 19.0.0 - kube: - - '1.28' - - '1.27' - - '1.26' - - '1.25' + kube: ['1.28', '1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: null - version: 18.0.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 17.0.0 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' + kube: ['1.25', '1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 16.0.0 - kube: - - '1.24' - - '1.23' - - '1.22' + kube: ['1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 15.0.0 - kube: - - '1.24' - - '1.23' - - '1.22' + kube: ['1.24', '1.23', '1.22'] requirements: [] incompatibilities: [] summary: null - version: 14.0.0 - kube: - - '1.22' - - '1.21' - - '1.20' + kube: ['1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: null - version: 13.0.0 - kube: - - '1.22' - - '1.21' - - '1.20' + kube: ['1.22', '1.21', '1.20'] requirements: [] incompatibilities: [] summary: null - version: 12.0.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' - - '1.18' - - '1.17' + kube: ['1.22', '1.21', '1.20', '1.19', '1.18', '1.17'] requirements: [] incompatibilities: [] summary: null - version: 10.0.0 - kube: - - '1.17' - - '1.16' - - '1.15' + kube: ['1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null - version: 9.0.0 - kube: - - '1.17' - - '1.16' - - '1.15' + kube: ['1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null - version: 8.0.0 - kube: - - '1.17' - - '1.16' - - '1.15' + kube: ['1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null - version: 7.0.0 - kube: - - '1.17' - - '1.16' - - '1.15' + kube: ['1.17', '1.16', '1.15'] requirements: [] incompatibilities: [] summary: null - version: 6.0.0 - kube: - - '1.15' - - '1.14' - - '1.13' + kube: ['1.15', '1.14', '1.13'] requirements: [] incompatibilities: [] summary: null @@ -32622,91 +24007,67 @@ addons: eolApiSlug: gatekeeper versions: - version: 3.23.1 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No new user-facing features in v3.23.1; this is primarily a stabilization - patch focused on ValidatingAdmissionPolicy (VAP) generation/reconciliation - behavior and some dependency/security backports. + features: [No new user-facing features in v3.23.1; this is primarily a stabilization + patch focused on ValidatingAdmissionPolicy (VAP) generation/reconciliation + behavior and some dependency/security backports.] breaking_changes: [] chart_version: 3.23.1 - images: - - curlimages/curl:8.20.0 - - openpolicyagent/gatekeeper-crds:v3.23.1 - - openpolicyagent/gatekeeper:v3.23.1 + images: ['curlimages/curl:8.20.0', 'openpolicyagent/gatekeeper-crds:v3.23.1', + 'openpolicyagent/gatekeeper:v3.23.1'] - version: 3.23.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Semantic log lines now include a structured marker field to help log parsers\ - \ distinguish \u201Csemantic\u201D entries." - - Remote cluster mode now supports status resource routing, improving how status - objects are handled across clusters. - - Mutation ApplyTo specs support a new `operations` field so you can scope mutations - by admission operation (e.g., CREATE/UPDATE/DELETE). + features: ["Semantic log lines now include a structured marker field to help\ + \ log parsers distinguish \u201Csemantic\u201D entries.", 'Remote cluster + mode now supports status resource routing, improving how status objects + are handled across clusters.', 'Mutation ApplyTo specs support a new `operations` + field so you can scope mutations by admission operation (e.g., CREATE/UPDATE/DELETE).'] breaking_changes: [] chart_version: 3.23.0 - images: - - curlimages/curl:8.20.0 - - openpolicyagent/gatekeeper-crds:v3.23.0 - - openpolicyagent/gatekeeper:v3.23.0 + images: ['curlimages/curl:8.20.0', 'openpolicyagent/gatekeeper-crds:v3.23.0', + 'openpolicyagent/gatekeeper:v3.23.0'] - version: 3.22.2 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No chart-specific changes are called out in the provided notes for v3.22.2;\ - \ it\u2019s an application-level bugfix release." - - "From v3.22.0, there were some chart-related items included in the app notes\ - \ (e.g., metrics backend configuration options; missing flags exposed as Helm\ - \ values; namespace exemption label merge). If you\u2019re upgrading from\ - \ 3.22.0 these are already in place, but verify your values file doesn\u2019\ - t need to start setting newly-exposed options explicitly." - features: - - v3.22.2 introduces no new Gatekeeper features; it is a patch release. - - v3.22.0 enabled `sync-vap-enforcement-scope` by default, improving ValidatingAdmissionPolicy - (VAP) enforcement scope sync behavior out of the box. - - v3.22.0 added namespace context to both CEL (`namespaceObject`) and Rego (`input.namespace`) - for namespace-aware decisions in admission and audit. - - v3.22.0 added `gator bench` for benchmarking policy performance (latency/throughput/memory) - and `gator policy` for managing policies from gatekeeper-library/bundles. - - v3.22.0 added an option to disable the audit `fake-reader` sidecar when using - audit file-based logging and introduced `--enable-remote-cluster` for running - Gatekeeper outside the managed cluster. - breaking_changes: - - 'Potential behavior change in v3.22.0: `sync-vap-enforcement-scope` is now - true by default, which can change how VAP resources reflect constraint enforcement - actions without additional configuration. Validate this aligns with your expectations - if you rely on VAP integration.' + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No chart-specific changes are called out in the provided notes\ + \ for v3.22.2; it\u2019s an application-level bugfix release.", "From v3.22.0,\ + \ there were some chart-related items included in the app notes (e.g., metrics\ + \ backend configuration options; missing flags exposed as Helm values; namespace\ + \ exemption label merge). If you\u2019re upgrading from 3.22.0 these are\ + \ already in place, but verify your values file doesn\u2019t need to start\ + \ setting newly-exposed options explicitly."] + features: [v3.22.2 introduces no new Gatekeeper features; it is a patch release., + 'v3.22.0 enabled `sync-vap-enforcement-scope` by default, improving ValidatingAdmissionPolicy + (VAP) enforcement scope sync behavior out of the box.', v3.22.0 added namespace + context to both CEL (`namespaceObject`) and Rego (`input.namespace`) for + namespace-aware decisions in admission and audit., v3.22.0 added `gator + bench` for benchmarking policy performance (latency/throughput/memory) and + `gator policy` for managing policies from gatekeeper-library/bundles., v3.22.0 + added an option to disable the audit `fake-reader` sidecar when using audit + file-based logging and introduced `--enable-remote-cluster` for running + Gatekeeper outside the managed cluster.] + breaking_changes: ['Potential behavior change in v3.22.0: `sync-vap-enforcement-scope` + is now true by default, which can change how VAP resources reflect constraint + enforcement actions without additional configuration. Validate this aligns + with your expectations if you rely on VAP integration.'] chart_version: 3.22.2 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.22.2 - - openpolicyagent/gatekeeper:v3.22.2 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.22.2', + 'openpolicyagent/gatekeeper:v3.22.2'] - version: 3.22.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: @@ -32726,72 +24087,55 @@ addons: \ exemption labels behavior changed/merged** to align with GKE recommendations\ \ (#4348). If you use namespace exemption labels, validate the resulting selector/labels\ \ after upgrade.\n" - chart_updates: - - 'Helm chart: metrics backend configuration options were added (#4282).' - - 'Helm chart: namespace exemption labels were merged to fix GKE recommendation - (#4348).' - - 'Helm chart: missing flags were surfaced as Helm values (#4385).' - features: - - '`sync-vap-enforcement-scope` is enabled by default so VAP resources reflect - constraint enforcement actions without extra configuration.' - - 'Policies now get namespace context: CEL can read `namespaceObject` and Rego - can read `input.namespace` for namespace-scoped decisions in admission and - audit.' - - You can disable the forced `fake-reader` audit sidecar when using audit file-based - logging if you already have your own log collection. - - New `gator bench` command benchmarks policy performance (latency percentiles, - throughput, memory profiling, concurrency) to catch regressions in CI/CD. - - New `gator policy` command manages policies from gatekeeper-library (install/upgrade/uninstall), - supports bundles, enforcement overrides, and dry-run previews. - - "Gatekeeper can run out-of-cluster with `--enable-remote-cluster`, avoiding\ - \ crashes when the Gatekeeper pod isn\u2019t present in the managed cluster." - - External data provider timeouts are enforced on the mutation path (default - 5s), reducing risk of long-running calls exhausting webhook timeouts/resources. - breaking_changes: - - 'Behavior change: `sync-vap-enforcement-scope` now defaults to true; environments - expecting the old default may see different VAP/enforcement alignment immediately - after upgrade.' - - If you depended on the presence/behavior of the audit `fake-reader` sidecar - for file-based logging, the new ability to disable it may change your pod - composition (and any tooling that assumes that container exists). - - Namespace exemption label handling changed to match GKE recommendations; label-based - exemptions may match differently until validated. + chart_updates: ['Helm chart: metrics backend configuration options were added + (#4282).', 'Helm chart: namespace exemption labels were merged to fix GKE + recommendation (#4348).', 'Helm chart: missing flags were surfaced as Helm + values (#4385).'] + features: ['`sync-vap-enforcement-scope` is enabled by default so VAP resources + reflect constraint enforcement actions without extra configuration.', 'Policies + now get namespace context: CEL can read `namespaceObject` and Rego can read + `input.namespace` for namespace-scoped decisions in admission and audit.', + You can disable the forced `fake-reader` audit sidecar when using audit file-based + logging if you already have your own log collection., 'New `gator bench` + command benchmarks policy performance (latency percentiles, throughput, + memory profiling, concurrency) to catch regressions in CI/CD.', 'New `gator + policy` command manages policies from gatekeeper-library (install/upgrade/uninstall), + supports bundles, enforcement overrides, and dry-run previews.', "Gatekeeper\ + \ can run out-of-cluster with `--enable-remote-cluster`, avoiding crashes\ + \ when the Gatekeeper pod isn\u2019t present in the managed cluster.", 'External + data provider timeouts are enforced on the mutation path (default 5s), reducing + risk of long-running calls exhausting webhook timeouts/resources.'] + breaking_changes: ['Behavior change: `sync-vap-enforcement-scope` now defaults + to true; environments expecting the old default may see different VAP/enforcement + alignment immediately after upgrade.', 'If you depended on the presence/behavior + of the audit `fake-reader` sidecar for file-based logging, the new ability + to disable it may change your pod composition (and any tooling that assumes + that container exists).', Namespace exemption label handling changed to + match GKE recommendations; label-based exemptions may match differently + until validated.] chart_version: 3.22.0 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.22.0 - - openpolicyagent/gatekeeper:v3.22.0 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.22.0', + 'openpolicyagent/gatekeeper:v3.22.0'] - version: 3.21.1 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Adds a timeout enforcement for External Data provider requests (bug fix). - - "Dependency/security bumps: containerd 1.7.28\u21921.7.29, golang.org/x/crypto\ - \ 0.43.0\u21920.45.0, kubectl bumped to resolve a CVE, and Go toolchain bump\ - \ (commit 7534a62\u219204741b0)." - features: - - No new user-facing features in 3.21.1; it is primarily a bugfix and dependency/security - update release. - breaking_changes: - - No breaking changes called out in the 3.21.1 application release notes compared - to 3.21.0. + chart_updates: [Adds a timeout enforcement for External Data provider requests + (bug fix)., "Dependency/security bumps: containerd 1.7.28\u21921.7.29, golang.org/x/crypto\ + \ 0.43.0\u21920.45.0, kubectl bumped to resolve a CVE, and Go toolchain\ + \ bump (commit 7534a62\u219204741b0)."] + features: [No new user-facing features in 3.21.1; it is primarily a bugfix and + dependency/security update release.] + breaking_changes: [No breaking changes called out in the 3.21.1 application + release notes compared to 3.21.0.] chart_version: 3.21.1 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.21.1 - - openpolicyagent/gatekeeper:v3.21.1 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.21.1', + 'openpolicyagent/gatekeeper:v3.21.1'] eolAt: '2026-07-09' - version: 3.21.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -32811,66 +24155,49 @@ addons: \ notable change): optional in 3.21.0 but will **default to true in v3.22**\ \ and later be removed. Decide now whether to enable it in 3.21.0 to match\ \ future behavior and avoid a surprise scope change.\n" - chart_updates: - - PodSecurityPolicy manifests were removed from the Helm chart (PSP is deprecated/removed - upstream). - - Chart adds configuration hooks for automounting SA tokens, deployment annotations, - and injecting extra volumes/volumeMounts. - - Chart adds `extraEnvs` support for injecting environment variables into Gatekeeper - components. - - Chart includes changes to support dual-stack webhook Service behavior in clusters - using dual-stack networking. - features: - - "`--sync-vap-enforcement-scope` flag introduced to align ValidatingAdmissionPolicy\ - \ (VAP) enforcement scope with Gatekeeper\u2019s webhook/config/namespace\ - \ exemptions for consistent enforcement." - - ConstraintTemplates can now specify which operations (CREATE/UPDATE/DELETE) - they apply to, enabling operation-level enforcement granularity. - - External Data / Provider API gains new metrics and status reporting for improved - observability. - - Webhook Service adds dual-stack support for IPv4/IPv6 clusters. - - Helm chart supports configurable automountServiceAccountToken, deployment - annotations, extra volumes/volumeMounts, and `extraEnvs` injection. - breaking_changes: - - Helm chart removes PodSecurityPolicy resources; clusters or installs depending - on PSP must transition to Pod Security Admission or alternative controls. - - 'VAP behavior is trending toward a breaking change in v3.22+: if you currently - set `--sync-vap-enforcement-scope=false`, future versions will change how - Gatekeeper generates/scopes VAP resources (flag will default true then be - removed).' + chart_updates: [PodSecurityPolicy manifests were removed from the Helm chart + (PSP is deprecated/removed upstream)., 'Chart adds configuration hooks for + automounting SA tokens, deployment annotations, and injecting extra volumes/volumeMounts.', + Chart adds `extraEnvs` support for injecting environment variables into Gatekeeper + components., Chart includes changes to support dual-stack webhook Service + behavior in clusters using dual-stack networking.] + features: ["`--sync-vap-enforcement-scope` flag introduced to align ValidatingAdmissionPolicy\ + \ (VAP) enforcement scope with Gatekeeper\u2019s webhook/config/namespace\ + \ exemptions for consistent enforcement.", 'ConstraintTemplates can now + specify which operations (CREATE/UPDATE/DELETE) they apply to, enabling + operation-level enforcement granularity.', External Data / Provider API + gains new metrics and status reporting for improved observability., Webhook + Service adds dual-stack support for IPv4/IPv6 clusters., 'Helm chart supports + configurable automountServiceAccountToken, deployment annotations, extra + volumes/volumeMounts, and `extraEnvs` injection.'] + breaking_changes: [Helm chart removes PodSecurityPolicy resources; clusters + or installs depending on PSP must transition to Pod Security Admission or + alternative controls., 'VAP behavior is trending toward a breaking change + in v3.22+: if you currently set `--sync-vap-enforcement-scope=false`, future + versions will change how Gatekeeper generates/scopes VAP resources (flag + will default true then be removed).'] chart_version: 3.21.0 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.21.0 - - openpolicyagent/gatekeeper:v3.21.0 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.21.0', + 'openpolicyagent/gatekeeper:v3.21.0'] eolAt: '2026-07-09' - version: 3.20.1 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Patch/minor app release update from Gatekeeper v3.20.0 to v3.20.1; no functional - chart behavior changes called out in the provided notes. - - 'Component/toolchain refresh: kubectl and Go versions bumped via cherry-picks; - internal frameworks dependency bumped to v0.18.1.' + chart_updates: [Patch/minor app release update from Gatekeeper v3.20.0 to v3.20.1; + no functional chart behavior changes called out in the provided notes., + 'Component/toolchain refresh: kubectl and Go versions bumped via cherry-picks; + internal frameworks dependency bumped to v0.18.1.'] features: [] breaking_changes: [] chart_version: 3.20.1 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.20.1 - - openpolicyagent/gatekeeper:v3.20.1 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.20.1', + 'openpolicyagent/gatekeeper:v3.20.1'] eolAt: '2026-03-09' - version: 3.20.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -32898,38 +24225,29 @@ addons: \ VAP resource generation, you\u2019ll likely need to set the relevant flags/values\ \ to disable it (and validate your operations include `generate` only where\ \ desired).\n" - chart_updates: - - Introduces/uses a new `Connection` CRD to configure connections to violation - export backends (replacing a ConfigMap-based approach). - - Webhook rules updated to include the `pods/resize` subresource; Helm templating - gained a knob/variable to manage mutating subresources. - - Webhook startup behavior changed by removing the webhook readinessProbe at - pod start (affects rendered Deployment/Pod spec). - features: - - New driver to export violations to disk (useful for local retention or sidecar - pickup). - - VAP (Validating Admission Policy) integration is now beta and enabled by default; - Gatekeeper can generate VAP/VAPB resources for CEL-based native validation. - - Export connections are now modeled via a `Connection` custom resource instead - of a ConfigMap. - breaking_changes: - - If you previously configured export connections via a ConfigMap, you must - migrate to the new `Connection` CRD or exports may stop working. - - "Because VAP generation is enabled by default in v3.20.0, new VAP/VAPB resources\ - \ may be created automatically (and require appropriate RBAC/operations configuration),\ - \ which can change admission behavior if you weren\u2019t previously using\ - \ VAP." + chart_updates: [Introduces/uses a new `Connection` CRD to configure connections + to violation export backends (replacing a ConfigMap-based approach)., Webhook + rules updated to include the `pods/resize` subresource; Helm templating + gained a knob/variable to manage mutating subresources., Webhook startup + behavior changed by removing the webhook readinessProbe at pod start (affects + rendered Deployment/Pod spec).] + features: [New driver to export violations to disk (useful for local retention + or sidecar pickup)., VAP (Validating Admission Policy) integration is now + beta and enabled by default; Gatekeeper can generate VAP/VAPB resources + for CEL-based native validation., Export connections are now modeled via + a `Connection` custom resource instead of a ConfigMap.] + breaking_changes: ['If you previously configured export connections via a ConfigMap, + you must migrate to the new `Connection` CRD or exports may stop working.', + "Because VAP generation is enabled by default in v3.20.0, new VAP/VAPB resources\ + \ may be created automatically (and require appropriate RBAC/operations\ + \ configuration), which can change admission behavior if you weren\u2019\ + t previously using VAP."] chart_version: 3.20.0 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.20.0 - - openpolicyagent/gatekeeper:v3.20.0 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.20.0', + 'openpolicyagent/gatekeeper:v3.20.0'] eolAt: '2026-03-09' - version: 3.19.1 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -32943,65 +24261,50 @@ addons: \ constraints** (introduced in v3.19.0). If you rely on referential constraints,\ \ confirm the default behavior in your current values/manifests and set the\ \ flag explicitly if needed." - chart_updates: - - v3.19.1 is a patch release with no user-facing feature additions; it primarily - contains a bug fix related to deleting Gatekeeper resources when the delete - operation is enabled. - - 'CI/test updates only: v3.19.1 bumps Kubernetes versions used in testing/CRD - Dockerfile; no direct runtime impact expected.' - features: - - (v3.19.0) Gatekeeper ConstraintTemplates can use OPA **Rego v1** syntax via - the updated Rego driver. - - (v3.19.0) Pub/Sub was generalized into an **export mechanism**, enabling additional - violation export backends (e.g., disk). - - (v3.19.0) `gator test` gained a `--deny-only` flag to focus on deny results. - breaking_changes: - - (v3.19.0) **Breaking/behavioral change:** `--operation=generate` is now required - for CRD and VAP/VAPB generation. Missing this flag can prevent expected generation - behavior and may impact upgrades/installations that depended on implicit generation. + chart_updates: [v3.19.1 is a patch release with no user-facing feature additions; + it primarily contains a bug fix related to deleting Gatekeeper resources + when the delete operation is enabled., 'CI/test updates only: v3.19.1 bumps + Kubernetes versions used in testing/CRD Dockerfile; no direct runtime impact + expected.'] + features: [(v3.19.0) Gatekeeper ConstraintTemplates can use OPA **Rego v1** + syntax via the updated Rego driver., '(v3.19.0) Pub/Sub was generalized + into an **export mechanism**, enabling additional violation export backends + (e.g., disk).', (v3.19.0) `gator test` gained a `--deny-only` flag to focus + on deny results.] + breaking_changes: ['(v3.19.0) **Breaking/behavioral change:** `--operation=generate` + is now required for CRD and VAP/VAPB generation. Missing this flag can prevent + expected generation behavior and may impact upgrades/installations that + depended on implicit generation.'] chart_version: 3.19.1 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.19.1 - - openpolicyagent/gatekeeper:v3.19.1 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.19.1', + 'openpolicyagent/gatekeeper:v3.19.1'] eolAt: '2025-11-19' - version: 3.19.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart-specific changelog was provided in the notes; treat this as - an application upgrade summary only. - - v3.19.0 adds/adjusts operational flags and mechanisms (notably generation - operations and export mechanism changes) that may require deployment arg updates - in your Helm values if you set extraArgs/extraContainers. - features: - - OPA Rego v1 syntax support is now available for ConstraintTemplates (via updated - Rego driver). - - Pub/Sub violation distribution has been generalized into an export mechanism - to enable additional backends (e.g., disk) for exporting violations. - - '`gator test` gained a `--deny-only` flag to focus tests on deny outcomes.' - breaking_changes: - - "`--operation=generate` is now required to guard CRD and VAP/VAPB generation;\ - \ ensure your singleton deployment (commonly gatekeeper-audit) includes `--operation=generate`,\ - \ and if you don\u2019t run audit you must add it to the controller-manager\ - \ deployment." + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [No Helm chart-specific changelog was provided in the notes; + treat this as an application upgrade summary only., v3.19.0 adds/adjusts + operational flags and mechanisms (notably generation operations and export + mechanism changes) that may require deployment arg updates in your Helm + values if you set extraArgs/extraContainers.] + features: [OPA Rego v1 syntax support is now available for ConstraintTemplates + (via updated Rego driver)., 'Pub/Sub violation distribution has been generalized + into an export mechanism to enable additional backends (e.g., disk) for + exporting violations.', '`gator test` gained a `--deny-only` flag to focus + tests on deny outcomes.'] + breaking_changes: ["`--operation=generate` is now required to guard CRD and\ + \ VAP/VAPB generation; ensure your singleton deployment (commonly gatekeeper-audit)\ + \ includes `--operation=generate`, and if you don\u2019t run audit you must\ + \ add it to the controller-manager deployment."] chart_version: 3.19.0 - images: - - curlimages/curl:8.12.0 - - openpolicyagent/gatekeeper-crds:v3.19.0 - - openpolicyagent/gatekeeper:v3.19.0 + images: ['curlimages/curl:8.12.0', 'openpolicyagent/gatekeeper-crds:v3.19.0', + 'openpolicyagent/gatekeeper:v3.19.0'] eolAt: '2025-11-19' - version: 3.18.3 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -33014,34 +24317,26 @@ addons: \ (VAP/VAPB) generation**.\n- **Values that exist since 3.18.0:** Helm chart\ \ supports `logStatsAdmission` and `logStatsAudit` values (new in 3.18.0).\ \ No additional values changes were called out in the 3.18.3 notes you provided." - chart_updates: - - '3.18.0 chart: added Helm values for `logStatsAdmission` and `logStatsAudit`.' - - '3.18.x: no chart template changes were explicitly listed in the 3.18.3 snippet - beyond cherry-picked bugfixes; treat as patch-level maintenance update.' - features: - - (3.18.0) CEL-based policies enforced through Gatekeeper (ValidatingAdmissionPolicy - support) reached GA. - - (3.18.0) Added support for `generate` operation and waiting for VAPB generation - (generation controller behavior). - - (3.18.0) Added config pod status reporting (observability/status improvements). - - (3.18.0) Helm chart gained `logStatsAdmission` / `logStatsAudit` toggles for - stats logging. - breaking_changes: - - '`--operation=generate` is now required on a singleton deployment to handle - CRD and VAP/VAPB generation; without it, generated artifacts may not be created/guarded - as expected. This impacts deployments that previously relied on default operations - behavior.' + chart_updates: ['3.18.0 chart: added Helm values for `logStatsAdmission` and + `logStatsAudit`.', '3.18.x: no chart template changes were explicitly listed + in the 3.18.3 snippet beyond cherry-picked bugfixes; treat as patch-level + maintenance update.'] + features: [(3.18.0) CEL-based policies enforced through Gatekeeper (ValidatingAdmissionPolicy + support) reached GA., (3.18.0) Added support for `generate` operation and + waiting for VAPB generation (generation controller behavior)., (3.18.0) + Added config pod status reporting (observability/status improvements)., + (3.18.0) Helm chart gained `logStatsAdmission` / `logStatsAudit` toggles for + stats logging.] + breaking_changes: ['`--operation=generate` is now required on a singleton deployment + to handle CRD and VAP/VAPB generation; without it, generated artifacts may + not be created/guarded as expected. This impacts deployments that previously + relied on default operations behavior.'] chart_version: 3.18.3 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.18.3 - - openpolicyagent/gatekeeper:v3.18.3 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.18.3', + 'openpolicyagent/gatekeeper:v3.18.3'] eolAt: '2025-07-24' - version: 3.18.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -33061,97 +24356,77 @@ addons: \ alpha flags unless explicitly set through Helm\u201D. If you previously\ \ relied on alpha feature gates being enabled implicitly, you may need to\ \ set the corresponding Helm flags explicitly." - chart_updates: - - CEL-based policies (Kubernetes native validation / VAP integration) moved - from **beta** to **GA** in 3.18.0. - - 'A new operations model requirement was introduced: generation (CRDs, VAP/VAPB) - is now gated behind the explicit `generate` operation.' - - Helm chart gained new knobs for stats logging (`logStatsAdmission`, `logStatsAudit`) - and added `commonLabels` support on Deployments. - - 'Several chart/manifest quality fixes: PDB lint fix; NetworkPolicy ingress - rule Helm warning fix.' - - Internal refactors around CEL driver/framework extraction; OPA bumped to 0.68.0; - CI now pushes images to ghcr.io as well. - features: - - CEL-based policy enforcement via ValidatingAdmissionPolicy (VAP) is now GA, - making the Kubernetes-native validation path a first-class, production-ready - option. - - Gatekeeper now supports an explicit `generate` operation and can wait for - ValidatingAdmissionPolicyBinding (VAPB) generation, improving determinism - around generated resources. - - Helm chart adds `logStatsAdmission` and `logStatsAudit` to control stats logging - in admission/audit components, and adds `commonLabels` for consistent labeling - across Deployments. - - Gator gains additional capabilities (sync test support and expansion in `gator - verify`) useful for policy testing workflows. - breaking_changes: - - '**Generation is now opt-in via operations**: you must enable `--operation=generate` - on whichever Gatekeeper deployment is responsible for generating CRDs and - VAP/VAPB resources, or generation will not occur.' - - "If you were using Gatekeeper\u2019s VAP generation via annotations (older\ - \ behavior highlighted in 3.17.0 notes), you must migrate to the `generateVAP`\ - \ fields in ConstraintTemplates/Constraints; annotations are no longer the\ - \ mechanism." + chart_updates: [CEL-based policies (Kubernetes native validation / VAP integration) + moved from **beta** to **GA** in 3.18.0., 'A new operations model requirement + was introduced: generation (CRDs, VAP/VAPB) is now gated behind the explicit + `generate` operation.', 'Helm chart gained new knobs for stats logging (`logStatsAdmission`, + `logStatsAudit`) and added `commonLabels` support on Deployments.', 'Several + chart/manifest quality fixes: PDB lint fix; NetworkPolicy ingress rule Helm + warning fix.', Internal refactors around CEL driver/framework extraction; + OPA bumped to 0.68.0; CI now pushes images to ghcr.io as well.] + features: ['CEL-based policy enforcement via ValidatingAdmissionPolicy (VAP) + is now GA, making the Kubernetes-native validation path a first-class, production-ready + option.', 'Gatekeeper now supports an explicit `generate` operation and + can wait for ValidatingAdmissionPolicyBinding (VAPB) generation, improving + determinism around generated resources.', 'Helm chart adds `logStatsAdmission` + and `logStatsAudit` to control stats logging in admission/audit components, + and adds `commonLabels` for consistent labeling across Deployments.', Gator + gains additional capabilities (sync test support and expansion in `gator + verify`) useful for policy testing workflows.] + breaking_changes: ['**Generation is now opt-in via operations**: you must enable + `--operation=generate` on whichever Gatekeeper deployment is responsible + for generating CRDs and VAP/VAPB resources, or generation will not occur.', + "If you were using Gatekeeper\u2019s VAP generation via annotations (older\ + \ behavior highlighted in 3.17.0 notes), you must migrate to the `generateVAP`\ + \ fields in ConstraintTemplates/Constraints; annotations are no longer the\ + \ mechanism."] chart_version: 3.18.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.18.0 - - openpolicyagent/gatekeeper:v3.18.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.18.0', + 'openpolicyagent/gatekeeper:v3.18.0'] eolAt: '2025-07-24' - version: 3.17.2 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Gatekeeper 3.17 introduces/solidifies Kubernetes-native validation (CEL/VAP) - support and related manifest/chart wiring: CEL-based policies via ValidatingAdmissionPolicy - are beta; VAP/VAPBinding generation moved from annotations to explicit fields - in ConstraintTemplate/Constraint; and constraint enforcement can now be scoped - per enforcement point via `spec.scopedEnforcementActions`.' - - Helm chart gains knobs to make the ServiceAccount name configurable and optionally - disable SA creation (useful when binding to pre-created RBAC/IRSA/GSA). - - Helm chart adds optional RollingUpdate strategy parameters for the controller-manager/audit - deployments, enabling finer control of maxUnavailable/maxSurge during upgrades. - - Controller-manager and audit deployments can now receive separate podLabels, - improving labeling/selection and observability alignment. - - 'Various CEL/VAP wiring fixes: include CEL flags on audit deployment; only - set webhook matchConditions when non-empty; updated VAP/VAPBinding API generation - behavior (0.30 API; create v1 or v1beta1 VAP/VAPB) and avoid setting alpha - flags unless explicitly enabled via Helm.' - - '3.17.2 is a patch release with a key bugfix: fixes a nil-pointer when converting - VAPBinding from v1beta1 to v1, plus security/library updates (crypto/net).' - features: - - "CEL-based policies enforced via Gatekeeper\u2019s ValidatingAdmissionPolicy\ - \ integration (beta in 3.17.0)." - - Constraints can now specify different enforcement actions per enforcement - point (webhook, audit, gator, VAP) using `spec.scopedEnforcementActions`. - - Support for Kubernetes CONNECT operations in request matching. - - 'More flexible Helm operations: configurable ServiceAccount (and ability to - opt out of creating it), plus optional RollingUpdate strategy tuning, and - separate podLabels for controller-manager vs audit.' - breaking_changes: - - If you previously generated VAP/VAPBinding via annotations, 3.17.0 changes - this to use explicit fields in ConstraintTemplate and Constraint; you must - update those resources or VAP generation may stop working/behave differently. - - VAP/VAPBinding generation behavior and API versions are more strict/explicit - in 3.17.x (v1 vs v1beta1 selection and alpha flags only when configured), - so clusters/templates relying on prior implicit defaults may need review. + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Gatekeeper 3.17 introduces/solidifies Kubernetes-native validation + (CEL/VAP) support and related manifest/chart wiring: CEL-based policies + via ValidatingAdmissionPolicy are beta; VAP/VAPBinding generation moved + from annotations to explicit fields in ConstraintTemplate/Constraint; and + constraint enforcement can now be scoped per enforcement point via `spec.scopedEnforcementActions`.', + Helm chart gains knobs to make the ServiceAccount name configurable and optionally + disable SA creation (useful when binding to pre-created RBAC/IRSA/GSA)., + 'Helm chart adds optional RollingUpdate strategy parameters for the controller-manager/audit + deployments, enabling finer control of maxUnavailable/maxSurge during upgrades.', + 'Controller-manager and audit deployments can now receive separate podLabels, + improving labeling/selection and observability alignment.', 'Various CEL/VAP + wiring fixes: include CEL flags on audit deployment; only set webhook matchConditions + when non-empty; updated VAP/VAPBinding API generation behavior (0.30 API; + create v1 or v1beta1 VAP/VAPB) and avoid setting alpha flags unless explicitly + enabled via Helm.', '3.17.2 is a patch release with a key bugfix: fixes + a nil-pointer when converting VAPBinding from v1beta1 to v1, plus security/library + updates (crypto/net).'] + features: ["CEL-based policies enforced via Gatekeeper\u2019s ValidatingAdmissionPolicy\ + \ integration (beta in 3.17.0).", 'Constraints can now specify different + enforcement actions per enforcement point (webhook, audit, gator, VAP) using + `spec.scopedEnforcementActions`.', Support for Kubernetes CONNECT operations + in request matching., 'More flexible Helm operations: configurable ServiceAccount + (and ability to opt out of creating it), plus optional RollingUpdate strategy + tuning, and separate podLabels for controller-manager vs audit.'] + breaking_changes: ['If you previously generated VAP/VAPBinding via annotations, + 3.17.0 changes this to use explicit fields in ConstraintTemplate and Constraint; + you must update those resources or VAP generation may stop working/behave + differently.', 'VAP/VAPBinding generation behavior and API versions are + more strict/explicit in 3.17.x (v1 vs v1beta1 selection and alpha flags + only when configured), so clusters/templates relying on prior implicit defaults + may need review.'] chart_version: 3.17.2 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.17.2 - - openpolicyagent/gatekeeper:v3.17.2 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.17.2', + 'openpolicyagent/gatekeeper:v3.17.2'] eolAt: '2025-04-09' - version: 3.17.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -33174,40 +24449,31 @@ addons: \ relied on Helm enabling those feature gates implicitly, you may now need\ \ to set them explicitly (or ensure your cluster supports the beta/stable\ \ API you want).\n" - chart_updates: - - Expose configurable ServiceAccount name + allow disabling SA creation. - - Add optional `rollingUpdate` strategy parameters to the Helm chart. - - Split pod label configuration between controller-manager and audit Deployments. - - Stop enabling alpha VAP/VAPB feature-gates implicitly unless explicitly set - via Helm. - - Update generated manifests to include YAML document separators (affects rendered - output, not behavior). - features: - - CEL-based policies enforced through Gatekeeper (via Kubernetes ValidatingAdmissionPolicy - integration) are **beta** in 3.17; Gatekeeper can generate/enforce CEL/VAP - resources. - - New `scopedEnforcementActions` lets you enforce different actions per enforcement - point (webhook, audit, gator, VAP) within the same Constraint. - - Support for Kubernetes `CONNECT` operations was added to admission handling. - - 'Improved control over VAP generation intent: Gatekeeper checks template intent - before generating VAPBindings.' - breaking_changes: - - "If you used VAP generation via **annotations**, those are no longer the mechanism\ - \ in 3.17\u2014policy manifests must be updated to the new fields-based configuration." - - If you depended on Helm implicitly setting **alpha** feature flags for VAP/VAPB - generation, that default behavior is removed; you may need to explicitly configure - feature gates or rely on the appropriate Kubernetes API version support. + chart_updates: [Expose configurable ServiceAccount name + allow disabling SA + creation., Add optional `rollingUpdate` strategy parameters to the Helm + chart., Split pod label configuration between controller-manager and audit + Deployments., Stop enabling alpha VAP/VAPB feature-gates implicitly unless + explicitly set via Helm., 'Update generated manifests to include YAML document + separators (affects rendered output, not behavior).'] + features: [CEL-based policies enforced through Gatekeeper (via Kubernetes ValidatingAdmissionPolicy + integration) are **beta** in 3.17; Gatekeeper can generate/enforce CEL/VAP + resources., 'New `scopedEnforcementActions` lets you enforce different actions + per enforcement point (webhook, audit, gator, VAP) within the same Constraint.', + Support for Kubernetes `CONNECT` operations was added to admission handling., + 'Improved control over VAP generation intent: Gatekeeper checks template intent + before generating VAPBindings.'] + breaking_changes: ["If you used VAP generation via **annotations**, those are\ + \ no longer the mechanism in 3.17\u2014policy manifests must be updated\ + \ to the new fields-based configuration.", 'If you depended on Helm implicitly + setting **alpha** feature flags for VAP/VAPB generation, that default behavior + is removed; you may need to explicitly configure feature gates or rely on + the appropriate Kubernetes API version support.'] chart_version: 3.17.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.17.0 - - openpolicyagent/gatekeeper:v3.17.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.17.0', + 'openpolicyagent/gatekeeper:v3.17.0'] eolAt: '2025-04-09' - version: 3.16.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -33237,34 +24503,25 @@ addons: moving to/adding `matchConditions` improves correctness or performance. ' - chart_updates: - - 'Helm: added `disableAudit` option to disable the audit deployment/job/component.' - - 'Helm: added ability to enable/configure VAP integration (alpha).' - - 'Helm: added `matchConditions` support in ValidatingWebhookConfiguration and - MutatingWebhookConfiguration manifests.' - features: - - 'Alpha: integration with Kubernetes Validating Admission Policy (VAP), including - support for generating VAP artifacts and enabling it via Helm.' - - 'Operational flexibility: ability to disable Gatekeeper audit via a Helm option - (`disableAudit`).' - - 'Webhook configurability: support for Kubernetes webhook `matchConditions` - to refine when Gatekeeper webhooks trigger.' - breaking_changes: - - '`validate-template-rego` flag has been removed; Gatekeeper will no longer - validate ConstraintTemplate Rego via that flag. Use Gator for shift-left template - validation to avoid unexpected failures/behavior changes in CI/CD or admission - workflows.' + chart_updates: ['Helm: added `disableAudit` option to disable the audit deployment/job/component.', + 'Helm: added ability to enable/configure VAP integration (alpha).', 'Helm: + added `matchConditions` support in ValidatingWebhookConfiguration and MutatingWebhookConfiguration + manifests.'] + features: ['Alpha: integration with Kubernetes Validating Admission Policy (VAP), + including support for generating VAP artifacts and enabling it via Helm.', + 'Operational flexibility: ability to disable Gatekeeper audit via a Helm option + (`disableAudit`).', 'Webhook configurability: support for Kubernetes webhook + `matchConditions` to refine when Gatekeeper webhooks trigger.'] + breaking_changes: ['`validate-template-rego` flag has been removed; Gatekeeper + will no longer validate ConstraintTemplate Rego via that flag. Use Gator + for shift-left template validation to avoid unexpected failures/behavior + changes in CI/CD or admission workflows.'] chart_version: 3.16.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.16.0 - - openpolicyagent/gatekeeper:v3.16.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.16.0', + 'openpolicyagent/gatekeeper:v3.16.0'] eolAt: '2024-12-12' - version: 3.15.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -33279,64 +24536,48 @@ addons: \ explicit Helm values changes were called out in the provided notes for v3.15.0.\ \ (Some Helm-related exposure was in v3.14.0, e.g. external data provider\ \ cache TTL, but that\u2019s already in your current version.)" - chart_updates: - - Adds/introduces **SyncSets** support (alpha) including a new SyncSet controller - and readiness tracking (`#3030`). - - 'Switches telemetry/instrumentation plumbing: **moving to OpenTelemetry from - OpenCensus** (`#3011`). This may impact how metrics/traces are emitted/collected - depending on your setup.' - - 'CI/build change: **drops arm/v7 builds for the CRD image** (`#3074`), which - can affect users running Gatekeeper components on 32-bit ARM nodes.' - - 'Validation hardening: Gatekeeper now **only validates Gatekeeper resources**, - adds support for validating DELETE config operations, and adds name length - checks/limits for certain resources (e.g., ExpansionTemplate names <64).' - features: - - '**SyncSets (alpha)**: New mechanism to replicate/sync data into Gatekeeper - via SyncSets, plus readiness reporting so you can tell when required data - has been replicated.' - - '**Improved resource validation behaviors**: Additional validation around - Gatekeeper resources and operations (including DELETE validation and stricter - naming constraints) to prevent invalid configs from being accepted.' - breaking_changes: - - '**PodSecurityPolicy default behavior changed**: PSP is disabled by default - in v3.15.0; clusters relying on Gatekeeper-created PSP objects will need to - adjust installation/values or move to PSA.' - - "**arm/v7 CRD image no longer built**: If you deploy the CRD image on 32-bit\ - \ ARM (arm/v7), you\u2019ll need an alternative architecture or image strategy\ - \ after upgrading." + chart_updates: [Adds/introduces **SyncSets** support (alpha) including a new + SyncSet controller and readiness tracking (`#3030`)., 'Switches telemetry/instrumentation + plumbing: **moving to OpenTelemetry from OpenCensus** (`#3011`). This may + impact how metrics/traces are emitted/collected depending on your setup.', + 'CI/build change: **drops arm/v7 builds for the CRD image** (`#3074`), which + can affect users running Gatekeeper components on 32-bit ARM nodes.', 'Validation + hardening: Gatekeeper now **only validates Gatekeeper resources**, adds + support for validating DELETE config operations, and adds name length checks/limits + for certain resources (e.g., ExpansionTemplate names <64).'] + features: ['**SyncSets (alpha)**: New mechanism to replicate/sync data into + Gatekeeper via SyncSets, plus readiness reporting so you can tell when required + data has been replicated.', '**Improved resource validation behaviors**: + Additional validation around Gatekeeper resources and operations (including + DELETE validation and stricter naming constraints) to prevent invalid configs + from being accepted.'] + breaking_changes: ['**PodSecurityPolicy default behavior changed**: PSP is disabled + by default in v3.15.0; clusters relying on Gatekeeper-created PSP objects + will need to adjust installation/values or move to PSA.', "**arm/v7 CRD\ + \ image no longer built**: If you deploy the CRD image on 32-bit ARM (arm/v7),\ + \ you\u2019ll need an alternative architecture or image strategy after upgrading."] chart_version: 3.15.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.15.0 - - openpolicyagent/gatekeeper:v3.15.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.15.0', + 'openpolicyagent/gatekeeper:v3.15.0'] eolAt: '2024-08-21' - version: 3.14.2 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'v3.14.1: Audit and controller-manager pods gained updated labels, which may - affect label selectors used by monitoring/NetworkPolicies.' - - 'v3.14.2: No new functional features; this patch release is primarily security - dependency updates addressing multiple CVEs/advisories.' + features: ['v3.14.1: Audit and controller-manager pods gained updated labels, + which may affect label selectors used by monitoring/NetworkPolicies.', 'v3.14.2: + No new functional features; this patch release is primarily security dependency + updates addressing multiple CVEs/advisories.'] breaking_changes: [] chart_version: 3.14.2 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.14.2 - - openpolicyagent/gatekeeper:v3.14.2 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.2', + 'openpolicyagent/gatekeeper:v3.14.2'] eolAt: '2024-05-09' - version: 3.14.1 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -33365,38 +24606,28 @@ addons: - **Audit cert rotation enabled by default** in `v3.14.0` (PR #2875). If your environment has strict cert/secret management expectations, confirm the generated/rotated cert behavior is acceptable.' - chart_updates: - - '`v3.14.1` is a patch release with a small surface area: adds pod labels and - includes a panic-logging fix.' - - '`v3.14.0` contains the bulk of chart/app changes for this upgrade path, including - label standardization and new/changed flags exposed via Helm.' - - 'Default behaviors to note from `v3.14.0`: audit cert rotation enabled by - default; external data provider caching behavior clarified/fixed.' - features: - - (v3.14.1) Audit and controller-manager pods updated to include additional - pod labels; mainly affects observability/selection/label-based policies. - - (v3.14.0) Improved experimental Validating Admission Policy (VAP) support - and updated bundled OPA to v0.57.1. - - (v3.14.0) Support multiple sync sources and enhancements to replay/testing - output. - - (v3.14.0) External data provider response cache TTL configurable; TTL=0 disables - caching. - breaking_changes: - - No explicit breaking changes are called out in the provided notes for v3.14.0 - or v3.14.1. However, label changes (recommended labels + new pod labels) can - be *operationally breaking* if you rely on exact label matches/selectors in - policies, monitoring, or automation. + chart_updates: ['`v3.14.1` is a patch release with a small surface area: adds + pod labels and includes a panic-logging fix.', '`v3.14.0` contains the bulk + of chart/app changes for this upgrade path, including label standardization + and new/changed flags exposed via Helm.', 'Default behaviors to note from + `v3.14.0`: audit cert rotation enabled by default; external data provider + caching behavior clarified/fixed.'] + features: [(v3.14.1) Audit and controller-manager pods updated to include additional + pod labels; mainly affects observability/selection/label-based policies., + (v3.14.0) Improved experimental Validating Admission Policy (VAP) support + and updated bundled OPA to v0.57.1., (v3.14.0) Support multiple sync sources + and enhancements to replay/testing output., (v3.14.0) External data provider + response cache TTL configurable; TTL=0 disables caching.] + breaking_changes: ['No explicit breaking changes are called out in the provided + notes for v3.14.0 or v3.14.1. However, label changes (recommended labels + + new pod labels) can be *operationally breaking* if you rely on exact label + matches/selectors in policies, monitoring, or automation.'] chart_version: 3.14.1 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.14.1 - - openpolicyagent/gatekeeper:v3.14.1 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.1', + 'openpolicyagent/gatekeeper:v3.14.1'] eolAt: '2024-05-09' - version: 3.14.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -33413,38 +24644,28 @@ addons: \ Helm values. Also note behavior: **TTL=0 disables the cache**.\n\nNo explicit\ \ breaking Helm values removals/renames were present in the provided notes;\ \ treat the above as additive changes and validate with `helm diff`." - chart_updates: - - Updated OPA dependency to **v0.57.1**. - - Improved experimental **Validating Admission Policy (VAP)** support (CEL-based - / native validation demo and driver improvements). - - Constraint framework upgraded to include a new **Kubernetes Native Validation** - driver schema. - - Support for **multiple sync sources** (sync subsystem enhancements). - - Audit certificate rotation enabled by default (bug fix) and other chart/controller - flag fixes around webhook name flags. - features: - - Adds recommended Helm/Kubernetes application labels to resources, improving - consistency with common tooling and dashboards. - - Allows configuring the controller-manager Deployment `revisionHistoryLimit` - through Helm values. - - Adds support for multiple sync sources, improving how Gatekeeper syncs external - or cluster objects into OPA. - - Upgrades the constraint framework with a new Kubernetes Native Validation - driver schema (relevant to VAP/CEL workflows). - - Exposes external data provider response cache TTL via Helm; TTL can be tuned - or set to 0 to disable caching. + chart_updates: [Updated OPA dependency to **v0.57.1**., Improved experimental + **Validating Admission Policy (VAP)** support (CEL-based / native validation + demo and driver improvements)., Constraint framework upgraded to include + a new **Kubernetes Native Validation** driver schema., Support for **multiple + sync sources** (sync subsystem enhancements)., Audit certificate rotation + enabled by default (bug fix) and other chart/controller flag fixes around + webhook name flags.] + features: ['Adds recommended Helm/Kubernetes application labels to resources, + improving consistency with common tooling and dashboards.', Allows configuring + the controller-manager Deployment `revisionHistoryLimit` through Helm values., + 'Adds support for multiple sync sources, improving how Gatekeeper syncs external + or cluster objects into OPA.', Upgrades the constraint framework with a + new Kubernetes Native Validation driver schema (relevant to VAP/CEL workflows)., + Exposes external data provider response cache TTL via Helm; TTL can be tuned + or set to 0 to disable caching.] breaking_changes: [] chart_version: 3.14.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.14.0 - - openpolicyagent/gatekeeper:v3.14.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.14.0', + 'openpolicyagent/gatekeeper:v3.14.0'] eolAt: '2024-05-09' - version: 3.13.2 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -33456,32 +24677,23 @@ addons: \ **deployment strategy** for `controller-manager`.\n - Support adding **PriorityClass**\ \ to Jobs.\n - Pre-upgrade hook job: retries configured (helps reliability\ \ during upgrades).\n" - chart_updates: - - v3.13.2 release is functionally identical to v3.13.1, but **adds/publishes - the Helm chart artifact** for the release tag. - - In 3.13.0 line, chart-related fixes/robustness improvements mentioned include - webhook retry logic for Helm probes and retry configuration on the pre-upgrade - hook job. - features: - - 'Audit: added PubSub support for audit eventing/integration.' - - ExpansionTemplates graduated to **beta** (more stable API/behavior expectations). - - Added an experimental **ValidatingAdmissionPolicy (VAP) driver** prototype. - - Added support for **External Data Provider audit response cache** (performance/availability - improvement). - - Added **observability statistics/metrics** for admission, audit, and gator - CLI. + chart_updates: ['v3.13.2 release is functionally identical to v3.13.1, but **adds/publishes + the Helm chart artifact** for the release tag.', 'In 3.13.0 line, chart-related + fixes/robustness improvements mentioned include webhook retry logic for + Helm probes and retry configuration on the pre-upgrade hook job.'] + features: ['Audit: added PubSub support for audit eventing/integration.', ExpansionTemplates + graduated to **beta** (more stable API/behavior expectations)., Added an + experimental **ValidatingAdmissionPolicy (VAP) driver** prototype., Added + support for **External Data Provider audit response cache** (performance/availability + improvement)., 'Added **observability statistics/metrics** for admission, + audit, and gator CLI.'] breaking_changes: [] chart_version: 3.13.2 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.13.2 - - openpolicyagent/gatekeeper:v3.13.2 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.13.2', + 'openpolicyagent/gatekeeper:v3.13.2'] eolAt: '2024-02-05' - version: 3.13.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33501,40 +24713,30 @@ addons: may behave differently (more resilient rather than failing fast). ' - chart_updates: - - Adds support for configuring the controller-manager Deployment strategy (chart-level - capability). - - Adds `webhookURL` configuration option to the chart. - - Improves Helm hook jobs/probe-webhook behavior with retries (more robust upgrades). - features: - - Audit gained PubSub support, enabling external event-driven integrations for - audit output/processing. - - ExpansionTemplate moved to beta and expansion gained recursive expansion capabilities, - improving workload validation workflows. - - Experimental Kubernetes ValidatingAdmissionPolicy (VAP) driver/prototype was - added as a step toward CEL-based admission integration. - - External Data Provider Audit Cache was added to cache external data responses - during audit, reducing repeated calls and improving performance. - - New observability statistics are available for admission, audit, and the gator - CLI for improved monitoring and troubleshooting. - breaking_changes: - - ExpansionTemplate CRD graduation to **beta** may involve CRD schema/behavior - changes; verify your existing ExpansionTemplates against the new CRD and re-apply - CRDs during upgrade. - - Gatekeeper dependencies were upgraded to Kubernetes v1.27.2 / controller-runtime - v0.15.0; if you run very old Kubernetes versions, confirm compatibility before - upgrading. + chart_updates: [Adds support for configuring the controller-manager Deployment + strategy (chart-level capability)., Adds `webhookURL` configuration option + to the chart., Improves Helm hook jobs/probe-webhook behavior with retries + (more robust upgrades).] + features: ['Audit gained PubSub support, enabling external event-driven integrations + for audit output/processing.', 'ExpansionTemplate moved to beta and expansion + gained recursive expansion capabilities, improving workload validation workflows.', + Experimental Kubernetes ValidatingAdmissionPolicy (VAP) driver/prototype was + added as a step toward CEL-based admission integration., 'External Data + Provider Audit Cache was added to cache external data responses during audit, + reducing repeated calls and improving performance.', 'New observability + statistics are available for admission, audit, and the gator CLI for improved + monitoring and troubleshooting.'] + breaking_changes: [ExpansionTemplate CRD graduation to **beta** may involve + CRD schema/behavior changes; verify your existing ExpansionTemplates against + the new CRD and re-apply CRDs during upgrade., 'Gatekeeper dependencies + were upgraded to Kubernetes v1.27.2 / controller-runtime v0.15.0; if you + run very old Kubernetes versions, confirm compatibility before upgrading.'] chart_version: 3.13.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.13.0 - - openpolicyagent/gatekeeper:v3.13.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.13.0', + 'openpolicyagent/gatekeeper:v3.13.0'] eolAt: '2024-02-05' - version: 3.12.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33553,38 +24755,26 @@ addons: \ templates; this can show up as resource diffs on upgrade.\n\n_No explicit\ \ breaking Helm values removals are called out in the provided notes, but\ \ expect diffs due to the above additions/templating fixes._" - chart_updates: - - Adds a NetworkPolicy manifest for the controller-manager (Helm chart feature). - - Probe webhook job/container behavior updated to run with `curl` as entrypoint. - - Fixes Helm static templates to include missing namespaces (may change rendered - manifests). - - Adds support to configure the WebhookConfiguration name; updates pre-install - CRD image handling. - features: - - New `AssignImage` mutator enables image mutation use-cases (e.g., rewriting - images to an approved registry). - - "Gatekeeper can emit admission/audit events into the **involved object\u2019\ - s namespace**, improving discoverability during debugging." - - OPA dependency updated to **v0.49.2** (behavior/performance/security changes - come from OPA). - - Multi-engine groundwork added to support future integration with Kubernetes - CEL `ValidatingAdmissionPolicy`. - - New `--exempt-namespace-suffix` flag allows exempting namespaces by suffix - pattern. - - 'Logging improvements: ability to write logs to a custom file and more verbose - audit logging.' + chart_updates: [Adds a NetworkPolicy manifest for the controller-manager (Helm + chart feature)., Probe webhook job/container behavior updated to run with + `curl` as entrypoint., Fixes Helm static templates to include missing namespaces + (may change rendered manifests)., Adds support to configure the WebhookConfiguration + name; updates pre-install CRD image handling.] + features: ['New `AssignImage` mutator enables image mutation use-cases (e.g., + rewriting images to an approved registry).', "Gatekeeper can emit admission/audit\ + \ events into the **involved object\u2019s namespace**, improving discoverability\ + \ during debugging.", OPA dependency updated to **v0.49.2** (behavior/performance/security + changes come from OPA)., Multi-engine groundwork added to support future + integration with Kubernetes CEL `ValidatingAdmissionPolicy`., New `--exempt-namespace-suffix` + flag allows exempting namespaces by suffix pattern., 'Logging improvements: + ability to write logs to a custom file and more verbose audit logging.'] breaking_changes: [] chart_version: 3.12.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.12.0 - - openpolicyagent/gatekeeper:v3.12.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.12.0', + 'openpolicyagent/gatekeeper:v3.12.0'] eolAt: '2023-11-01' - version: 3.11.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33614,37 +24804,29 @@ addons: \ you will likely need to provide CA bundles and client certs/keys (via chart\ \ values or secrets) and ensure the provider endpoints are HTTPS with proper\ \ trust.\n" - chart_updates: - - Gatekeeper migrated away from PodSecurityPolicy (PSP) toward Pod Security - Admission (PSA) in the v3.10 timeframe; ensure your chart install no longer - expects PSP resources on Kubernetes >=1.25. - - Helm chart includes enhancements for scheduling (topology spread), hook jobs - configurability/labels, and better webhook/probe configurability from v3.10. - - v3.11 chart bugfixes improve Helm hook job installation behavior and correct - pod security label handling. - features: - - External Data promoted to beta; external data providers must now be accessed - with TLS/mTLS. - - Gator CLI promoted to beta; adds tracing support, AdmissionReview support, - and the ability to specify an OCI image for test/expand workflows. - - Audit logs can include resource labels (helpful for correlating violations). - breaking_changes: - - If you use External Data, TLS/mTLS is now required for provider communication; - non-TLS provider endpoints/configs will stop working until updated. - - If you previously depended on PSP objects being installed by the chart, Kubernetes - v1.25+ clusters will require PSA-based configuration instead (PSP removal - may require policy/process changes). + chart_updates: [Gatekeeper migrated away from PodSecurityPolicy (PSP) toward + Pod Security Admission (PSA) in the v3.10 timeframe; ensure your chart install + no longer expects PSP resources on Kubernetes >=1.25., 'Helm chart includes + enhancements for scheduling (topology spread), hook jobs configurability/labels, + and better webhook/probe configurability from v3.10.', v3.11 chart bugfixes + improve Helm hook job installation behavior and correct pod security label + handling.] + features: [External Data promoted to beta; external data providers must now + be accessed with TLS/mTLS., 'Gator CLI promoted to beta; adds tracing support, + AdmissionReview support, and the ability to specify an OCI image for test/expand + workflows.', Audit logs can include resource labels (helpful for correlating + violations).] + breaking_changes: ['If you use External Data, TLS/mTLS is now required for provider + communication; non-TLS provider endpoints/configs will stop working until + updated.', 'If you previously depended on PSP objects being installed by + the chart, Kubernetes v1.25+ clusters will require PSA-based configuration + instead (PSP removal may require policy/process changes).'] chart_version: 3.11.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.11.0 - - openpolicyagent/gatekeeper:v3.11.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.11.0', + 'openpolicyagent/gatekeeper:v3.11.0'] eolAt: '2023-08-08' - version: 3.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33672,43 +24854,32 @@ addons: \ values.\n* If you experienced probe-related restarts/timeouts, consider\ \ tuning the new **probe timeout** values.\n* If you run multiple replicas\ \ across zones/nodes, consider enabling **topology spread** for HA.\n" - chart_updates: - - Chart updates to support Kubernetes v1.25+ by removing PodSecurityPolicy resources - and aligning with Pod Security Admission (PSA). - - 'Helm chart enhancements to make operational settings configurable: probe - timeout configuration, webhook configuration annotations, controller topology - spread constraints, and more hook-job options/standardized labels.' - - Chart fixes related to labeling exempted namespaces and general helm upgrade - reliability (helm upgrade test additions). - - Chart changes to explicitly specify `curl` usage in webhook probing job, improving - portability across images/environments. - features: - - PodSecurityPolicy removal and migration guidance toward Pod Security Admission - for Kubernetes v1.25+ clusters. - - Mutation promoted to stable (v1), indicating API/behavior stability for mutation - features. - - 'Alpha feature introduced: validation of workload resources (new workload-focused - validation capability).' - - 'Operational and security hardening knobs: ability to inject external certs - and configure minimum TLS version for the controller manager.' - - 'Helm usability improvements: configurable webhook annotations, probe timeout - tuning, and topology spread constraints for controller scheduling.' - - New audit metric `audit_last_run_end_time` to improve observability of audit - execution. - breaking_changes: - - Clusters relying on PodSecurityPolicy (especially Kubernetes v1.25+) must - migrate to Pod Security Admission; PSP resources are removed in this release - and will no longer be applied/created by the chart. + chart_updates: [Chart updates to support Kubernetes v1.25+ by removing PodSecurityPolicy + resources and aligning with Pod Security Admission (PSA)., 'Helm chart enhancements + to make operational settings configurable: probe timeout configuration, + webhook configuration annotations, controller topology spread constraints, + and more hook-job options/standardized labels.', Chart fixes related to + labeling exempted namespaces and general helm upgrade reliability (helm + upgrade test additions)., 'Chart changes to explicitly specify `curl` usage + in webhook probing job, improving portability across images/environments.'] + features: [PodSecurityPolicy removal and migration guidance toward Pod Security + Admission for Kubernetes v1.25+ clusters., 'Mutation promoted to stable + (v1), indicating API/behavior stability for mutation features.', 'Alpha + feature introduced: validation of workload resources (new workload-focused + validation capability).', 'Operational and security hardening knobs: ability + to inject external certs and configure minimum TLS version for the controller + manager.', 'Helm usability improvements: configurable webhook annotations, + probe timeout tuning, and topology spread constraints for controller scheduling.', + New audit metric `audit_last_run_end_time` to improve observability of audit + execution.] + breaking_changes: [Clusters relying on PodSecurityPolicy (especially Kubernetes + v1.25+) must migrate to Pod Security Admission; PSP resources are removed + in this release and will no longer be applied/created by the chart.] chart_version: 3.10.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.10.0 - - openpolicyagent/gatekeeper:v3.10.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.10.0', + 'openpolicyagent/gatekeeper:v3.10.0'] - version: 3.9.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33736,39 +24907,30 @@ addons: \n> Note: The provided notes don\u2019t include exact Helm value keys; use\ \ `helm show values` for the target chart version and diff your current `values.yaml`\ \ against it." - chart_updates: - - Adds post-upgrade job to label exempted namespaces (and fixes templating for - that label). - - Adds webhook `objectSelector` support in chart templates. - - Adds gatekeeper-webhook post-install hook. - - Allows overriding securityContexts; adds podSecurityContext value support. - - Adds ability to configure affinity for `upgradeCRDs` jobs and to set job annotations. - - Adds Helm chart support for selecting metrics backend / exporters. - features: - - External Data gains TLS/mTLS support for calling external providers. - - Gatekeeper can validate Kubernetes subresources (more granular admission control). - - Adds OpenCensus and Stackdriver exporters for metrics/telemetry. - - Performance improvements including automaxprocs integration and earlier compilation/memory - optimizations from 3.8.x. - - Helm chart gains richer webhook targeting controls (objectSelector, custom - rules, reinvocationPolicy) and improved upgrade/uninstall hooks. - breaking_changes: - - 'Avoid deploying **Gatekeeper v3.8.0**: it is marked **DO NOT USE** due to - a bug that can cause unenforced violations when using the `config` resource - without sync; upgrade via **v3.8.1+** before moving to v3.9.0.' - - If you rely on namespace exemption behavior, the introduction of namespace - labeling and related hooks/jobs may change how exemptions are applied; verify - labels and RBAC for the upgrade job/webhook hooks before upgrading. + chart_updates: [Adds post-upgrade job to label exempted namespaces (and fixes + templating for that label)., Adds webhook `objectSelector` support in chart + templates., Adds gatekeeper-webhook post-install hook., Allows overriding + securityContexts; adds podSecurityContext value support., Adds ability to + configure affinity for `upgradeCRDs` jobs and to set job annotations., Adds + Helm chart support for selecting metrics backend / exporters.] + features: [External Data gains TLS/mTLS support for calling external providers., + Gatekeeper can validate Kubernetes subresources (more granular admission control)., + Adds OpenCensus and Stackdriver exporters for metrics/telemetry., Performance + improvements including automaxprocs integration and earlier compilation/memory + optimizations from 3.8.x., 'Helm chart gains richer webhook targeting controls + (objectSelector, custom rules, reinvocationPolicy) and improved upgrade/uninstall + hooks.'] + breaking_changes: ['Avoid deploying **Gatekeeper v3.8.0**: it is marked **DO + NOT USE** due to a bug that can cause unenforced violations when using the + `config` resource without sync; upgrade via **v3.8.1+** before moving to + v3.9.0.', 'If you rely on namespace exemption behavior, the introduction + of namespace labeling and related hooks/jobs may change how exemptions are + applied; verify labels and RBAC for the upgrade job/webhook hooks before + upgrading.'] chart_version: 3.9.0 - images: - - curlimages/curl:7.83.1 - - openpolicyagent/gatekeeper-crds:v3.9.0 - - openpolicyagent/gatekeeper:v3.9.0 + images: ['curlimages/curl:7.83.1', 'openpolicyagent/gatekeeper-crds:v3.9.0', 'openpolicyagent/gatekeeper:v3.9.0'] - version: 3.8.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33804,45 +24966,32 @@ addons: > Note: v3.8.0 is marked **DO NOT USE** upstream due to an enforcement bug when using `config` without sync; prefer **v3.8.1+** for the upgrade.' - chart_updates: - - "Performance-focused release: significant improvements to constraint template\ - \ compilation (~16%) and major reductions in webhook CPU/memory (1.5x\u2013\ - 4x) plus audit memory (~2x)." - - Adds a TLS checker for the webhook and bumps default TLS min version to 1.3. - - Adds metric and operational improvements around mutation (conflicting mutators - metric; mutation-status operation). - - Improves matching capabilities (suffix-based matching; additional webhook - label exemptions). - - 'CLI/tooling changes: `gktest` renamed to `gator`; `gator test` renamed to - `gator verify` (docs/UX updates).' - - Dependency updates include upgrading embedded OPA to **v0.39.0**. - features: - - External Data now supports **mutation**, enabling mutation responses driven - by external providers. - - New Prometheus metric for **conflicting mutators**, improving observability - of mutation configuration issues. - - Customizable webhook configuration rules and reinvocation policy allow tighter - integration with cluster admission policies. - - Suffix-based resource matching expands how constraints/targets can match resource - kinds/names. - breaking_changes: - - '**Do not deploy v3.8.0**: upstream warns of a bug that can cause **unenforced - violations** when using the `config` resource without sync; upgrade to **v3.8.1+** - instead.' - - Default minimum TLS for webhooks changes to **TLS 1.3**; clusters/components - that only support TLS 1.2 may fail webhook calls unless you explicitly configure - the min TLS version. - - 'CLI rename: `gator test` becomes `gator verify` (and `gktest` renamed to - `gator`), which can break scripts/CI pipelines relying on old command names.' + chart_updates: ["Performance-focused release: significant improvements to constraint\ + \ template compilation (~16%) and major reductions in webhook CPU/memory\ + \ (1.5x\u20134x) plus audit memory (~2x).", Adds a TLS checker for the webhook + and bumps default TLS min version to 1.3., Adds metric and operational improvements + around mutation (conflicting mutators metric; mutation-status operation)., + Improves matching capabilities (suffix-based matching; additional webhook + label exemptions)., 'CLI/tooling changes: `gktest` renamed to `gator`; `gator + test` renamed to `gator verify` (docs/UX updates).', Dependency updates + include upgrading embedded OPA to **v0.39.0**.] + features: ['External Data now supports **mutation**, enabling mutation responses + driven by external providers.', 'New Prometheus metric for **conflicting + mutators**, improving observability of mutation configuration issues.', + Customizable webhook configuration rules and reinvocation policy allow tighter + integration with cluster admission policies., Suffix-based resource matching + expands how constraints/targets can match resource kinds/names.] + breaking_changes: ['**Do not deploy v3.8.0**: upstream warns of a bug that can + cause **unenforced violations** when using the `config` resource without + sync; upgrade to **v3.8.1+** instead.', Default minimum TLS for webhooks + changes to **TLS 1.3**; clusters/components that only support TLS 1.2 may + fail webhook calls unless you explicitly configure the min TLS version., + 'CLI rename: `gator test` becomes `gator verify` (and `gktest` renamed to + `gator`), which can break scripts/CI pipelines relying on old command names.'] chart_version: 3.8.0 - images: - - openpolicyagent/gatekeeper-crds:v3.8.0 - - openpolicyagent/gatekeeper:v3.8.0 + images: ['openpolicyagent/gatekeeper-crds:v3.8.0', 'openpolicyagent/gatekeeper:v3.8.0'] - version: 3.7.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33861,40 +25010,29 @@ addons: - No explicit value key removals were called out in the provided notes; validate your existing `values.yaml` against the new chart defaults before upgrading.' - chart_updates: - - 'Mutation feature status updated: mutation is now **Beta** in v3.7.0 (was - earlier stage in v3.6.x).' - - 'New mutator type: **ModifySet** mutator added.' - - 'New alpha feature: **External Data** for validation added (gated behind a - flag).' - - 'Webhook TLS hardening: minimum TLS version raised to **1.2**; configurable - via `--tls-min-version` (with TLS 1.3 planned as default in v3.8.0).' - - 'Audit memory improvements: audit can write cache to disk to reduce memory - usage; Helm adds knobs for RAM-disk option.' - - 'New alpha tooling: **Gator CLI** introduced for local testing of ConstraintTemplates/Constraints - without a Kubernetes cluster.' - features: - - Mutation is now Beta, making mutation capabilities more production-ready and - supported than prior versions. - - ModifySet mutator added, enabling set-style modifications as part of mutation. - - External Data for validation (alpha) allows Gatekeeper policies to consult - out-of-process providers for decisions. - - Gator CLI (alpha) provides a way to test templates/constraints locally without - Kubernetes. - - Audit memory usage reduced via cache-to-disk capability; optional RAM-disk - support via Helm values. - breaking_changes: - - Webhook TLS minimum version is now TLS 1.2; clients using TLS 1.0/1.1 will - fail to connect unless updated. (You can configure the minimum via `--tls-min-version`.) + chart_updates: ['Mutation feature status updated: mutation is now **Beta** in + v3.7.0 (was earlier stage in v3.6.x).', 'New mutator type: **ModifySet** + mutator added.', 'New alpha feature: **External Data** for validation added + (gated behind a flag).', 'Webhook TLS hardening: minimum TLS version raised + to **1.2**; configurable via `--tls-min-version` (with TLS 1.3 planned as + default in v3.8.0).', 'Audit memory improvements: audit can write cache + to disk to reduce memory usage; Helm adds knobs for RAM-disk option.', 'New + alpha tooling: **Gator CLI** introduced for local testing of ConstraintTemplates/Constraints + without a Kubernetes cluster.'] + features: ['Mutation is now Beta, making mutation capabilities more production-ready + and supported than prior versions.', 'ModifySet mutator added, enabling + set-style modifications as part of mutation.', External Data for validation + (alpha) allows Gatekeeper policies to consult out-of-process providers for + decisions., Gator CLI (alpha) provides a way to test templates/constraints + locally without Kubernetes., Audit memory usage reduced via cache-to-disk + capability; optional RAM-disk support via Helm values.] + breaking_changes: [Webhook TLS minimum version is now TLS 1.2; clients using + TLS 1.0/1.1 will fail to connect unless updated. (You can configure the + minimum via `--tls-min-version`.)] chart_version: 3.7.0 - images: - - openpolicyagent/gatekeeper-crds:v3.7.0 - - openpolicyagent/gatekeeper:v3.7.0 + images: ['openpolicyagent/gatekeeper-crds:v3.7.0', 'openpolicyagent/gatekeeper:v3.7.0'] - version: 3.6.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33907,45 +25045,34 @@ addons: - **PDB API version auto-selection:** Helm chart dynamically selects the **PodDisruptionBudget\ \ API version** based on cluster version; remove any workarounds/overrides\ \ you carried for older/newer K8s.\n" - chart_updates: - - ConstraintTemplate CRD moves to **v1** (requires CRD update in the cluster). - - Gatekeeper and controller-runtime metrics are unified into a **single endpoint** - (affects scraping/ServiceMonitor/Prometheus config). - - 'Mutation subsystem improvements: large **System.Mutate runtime reduction**, - watch/constraint controller **race condition fixes**, and new mutation features - (namespace prefix matching; integer `keyValue` support in mutation path parser).' - - Removed **non-specific webhook request metrics**; request duration metric - buckets updated (upper limit 3s). - - Adds metrics reporting for mutation. - - Updates Kubernetes dependency/support matrix (notably K8s v1.22 updates). - features: - - ConstraintTemplate CRD is now served as v1, modernizing the API and aligning - with newer Kubernetes CRD versions. - - Mutation performance improved significantly (reported ~87% reduction for System.Mutate - runtime). - - Namespace and excludedNamespaces matching now supports prefix-based matching - for more flexible scoping. - - Mutation path parser/mutators support integer keyValue, enabling more precise - mutations on numeric keys. - - 'Helm chart improvements: configurable controller-manager/audit ports and - hooks to upgrade CRDs.' - - 'Metrics enhancements: unified metrics endpoint and mutation metrics reporting.' - breaking_changes: - - '**ConstraintTemplate CRD moves to v1**; clusters must have updated CRDs before/with - the upgrade, and any tooling expecting the older CRD version may need adjustment.' - - 'Metrics surface changes: **non-specific webhook request metrics removed** - and metrics endpoint behavior changes (unified endpoint), which can break - existing dashboards/alerts/scrape configs.' + chart_updates: [ConstraintTemplate CRD moves to **v1** (requires CRD update + in the cluster)., Gatekeeper and controller-runtime metrics are unified + into a **single endpoint** (affects scraping/ServiceMonitor/Prometheus config)., + 'Mutation subsystem improvements: large **System.Mutate runtime reduction**, + watch/constraint controller **race condition fixes**, and new mutation features + (namespace prefix matching; integer `keyValue` support in mutation path + parser).', Removed **non-specific webhook request metrics**; request duration + metric buckets updated (upper limit 3s)., Adds metrics reporting for mutation., + Updates Kubernetes dependency/support matrix (notably K8s v1.22 updates).] + features: ['ConstraintTemplate CRD is now served as v1, modernizing the API + and aligning with newer Kubernetes CRD versions.', Mutation performance + improved significantly (reported ~87% reduction for System.Mutate runtime)., + Namespace and excludedNamespaces matching now supports prefix-based matching + for more flexible scoping., 'Mutation path parser/mutators support integer + keyValue, enabling more precise mutations on numeric keys.', 'Helm chart + improvements: configurable controller-manager/audit ports and hooks to upgrade + CRDs.', 'Metrics enhancements: unified metrics endpoint and mutation metrics + reporting.'] + breaking_changes: ['**ConstraintTemplate CRD moves to v1**; clusters must have + updated CRDs before/with the upgrade, and any tooling expecting the older + CRD version may need adjustment.', 'Metrics surface changes: **non-specific + webhook request metrics removed** and metrics endpoint behavior changes + (unified endpoint), which can break existing dashboards/alerts/scrape configs.'] chart_version: 3.6.0 - images: - - line/kubectl-kustomize:1.20.4-4.0.5 - - openpolicyagent/gatekeeper-crds:v3.6.0 - - openpolicyagent/gatekeeper:v3.6.0 + images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper-crds:v3.6.0', + 'openpolicyagent/gatekeeper:v3.6.0'] - version: 3.5.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -33962,34 +25089,23 @@ addons: - **v3.5.0 webhook defaults**: v3.5.0 adds default configs to the `MutatingWebhookConfiguration`; review any custom webhook settings/overrides to ensure they still match your desired behavior.' - chart_updates: - - Helm v2 chart removed; Helm v3 chart is the supported path (v3.4.0). - - 'Helm: removed `crd-install` hook (v3.4.0).' - - 'Helm: mutation components added to chart behind `experimentalEnableMutation` - flag (v3.4.0).' - - 'Helm: removed duplicate `affinity` key (bugfix in v3.4.0).' - - MutatingWebhookConfiguration now ships with default configuration values (v3.5.0). - features: - - Kubernetes v1.22+ compatibility (v3.5.0). - - Mutation support available as an alpha feature and deployable via Helm with - `experimentalEnableMutation` (introduced in v3.4.0). - - Improved user feedback for invalid inputs (v3.4.0). - breaking_changes: - - Helm v2 chart removed starting in v3.4.0; you must use Helm v3 for install/upgrade - going forward. - - Validation metrics `request_count` and `request_duration_seconds` are deprecated - in favor of `validation_request_count` and `validation_request_duration_seconds` - (introduced in v3.4.0); update dashboards/alerts before the old names are - removed in a future release. + chart_updates: [Helm v2 chart removed; Helm v3 chart is the supported path (v3.4.0)., + 'Helm: removed `crd-install` hook (v3.4.0).', 'Helm: mutation components added + to chart behind `experimentalEnableMutation` flag (v3.4.0).', 'Helm: removed + duplicate `affinity` key (bugfix in v3.4.0).', MutatingWebhookConfiguration + now ships with default configuration values (v3.5.0).] + features: [Kubernetes v1.22+ compatibility (v3.5.0)., Mutation support available + as an alpha feature and deployable via Helm with `experimentalEnableMutation` + (introduced in v3.4.0)., Improved user feedback for invalid inputs (v3.4.0).] + breaking_changes: [Helm v2 chart removed starting in v3.4.0; you must use Helm + v3 for install/upgrade going forward., Validation metrics `request_count` + and `request_duration_seconds` are deprecated in favor of `validation_request_count` + and `validation_request_duration_seconds` (introduced in v3.4.0); update + dashboards/alerts before the old names are removed in a future release.] chart_version: 3.5.0 - images: - - line/kubectl-kustomize:1.20.4-4.0.5 - - openpolicyagent/gatekeeper:v3.5.0 + images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper:v3.5.0'] - version: 3.4.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -34013,29 +25129,20 @@ addons: for deprecation** in favor of `validation_request_count` and `validation_request_duration_seconds`; update dashboards/alerts accordingly (not an immediate break in 3.4.0, but plan ahead).' - chart_updates: - - Helm v2 chart support removed; Helm v3 chart is the supported install/upgrade - path. - - Helm chart gains support for mutation (alpha) behind `experimentalEnableMutation`. - - 'Helm chart fix: removed duplicate `affinity` key.' - - 'Helm chart change: removed `crd-install` hook (Helm v3 CRD handling).' - features: - - Mutation is available as an alpha feature and can be deployed via experimental - manifests or enabled in the Helm v3 chart with `experimentalEnableMutation`. - - "Added better \u201Cinvalid input\u201D feedback to help users diagnose bad\ - \ policy/constraint inputs." - breaking_changes: - - Helm v2 chart has been removed as of v3.4.0; any Helm v2-based install/upgrade - process must be migrated to Helm v3. + chart_updates: [Helm v2 chart support removed; Helm v3 chart is the supported + install/upgrade path., Helm chart gains support for mutation (alpha) behind + `experimentalEnableMutation`., 'Helm chart fix: removed duplicate `affinity` + key.', 'Helm chart change: removed `crd-install` hook (Helm v3 CRD handling).'] + features: [Mutation is available as an alpha feature and can be deployed via + experimental manifests or enabled in the Helm v3 chart with `experimentalEnableMutation`., + "Added better \u201Cinvalid input\u201D feedback to help users diagnose bad\ + \ policy/constraint inputs."] + breaking_changes: [Helm v2 chart has been removed as of v3.4.0; any Helm v2-based + install/upgrade process must be migrated to Helm v3.] chart_version: 3.4.0 - images: - - line/kubectl-kustomize:1.20.4-4.0.5 - - openpolicyagent/gatekeeper:v3.4.0 + images: ['line/kubectl-kustomize:1.20.4-4.0.5', 'openpolicyagent/gatekeeper:v3.4.0'] - version: 3.3.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: @@ -34065,61 +25172,47 @@ addons: on your desired behavior. ' - chart_updates: - - 'Helm chart feature additions focused on configurability: optional namespace - creation, configurable PriorityClass, read-only root filesystem option, tunable - webhook timeouts/delete behavior, configurable validation webhook workers, - and ability to set different settings for audit vs controller components.' - features: - - Helm chart can optionally create the namespace, improving compatibility with - GitOps or pre-provisioned namespaces. - - PriorityClass can be set for controller-manager and audit deployments to control - scheduling precedence. - - New `readiness-retries` flag allows tuning how many readiness checks/retries - Gatekeeper performs before declaring failure. - - Config resource is now validated to be named `config`, reducing misconfiguration - drift. - - Audit and controller can now have different settings, enabling more precise - performance vs enforcement tuning. - - Admission validation webhook worker count is configurable to control concurrency - and throughput. - - 'Experimental mutation system improvements: CRD validation, mutation cache, - assign/assignmetadata controllers, and better mutation webhook behavior.' + chart_updates: ['Helm chart feature additions focused on configurability: optional + namespace creation, configurable PriorityClass, read-only root filesystem + option, tunable webhook timeouts/delete behavior, configurable validation + webhook workers, and ability to set different settings for audit vs controller + components.'] + features: ['Helm chart can optionally create the namespace, improving compatibility + with GitOps or pre-provisioned namespaces.', PriorityClass can be set for + controller-manager and audit deployments to control scheduling precedence., + New `readiness-retries` flag allows tuning how many readiness checks/retries + Gatekeeper performs before declaring failure., 'Config resource is now validated + to be named `config`, reducing misconfiguration drift.', 'Audit and controller + can now have different settings, enabling more precise performance vs enforcement + tuning.', Admission validation webhook worker count is configurable to control + concurrency and throughput., 'Experimental mutation system improvements: + CRD validation, mutation cache, assign/assignmetadata controllers, and better + mutation webhook behavior.'] breaking_changes: [] chart_version: 3.3.0 - images: - - openpolicyagent/gatekeeper:v3.3.0 + images: ['openpolicyagent/gatekeeper:v3.3.0'] - version: 3.2.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Gatekeeper library was moved out of the main Gatekeeper repository into its - own repository: https://github.com/open-policy-agent/gatekeeper-library.' - breaking_changes: - - If you relied on Gatekeeper constraint templates/constraints from the in-repo - library or referenced it as part of your upgrade process, you now need to - pull those artifacts from the separate gatekeeper-library repository instead. + features: ['Gatekeeper library was moved out of the main Gatekeeper repository + into its own repository: https://github.com/open-policy-agent/gatekeeper-library.'] + breaking_changes: ['If you relied on Gatekeeper constraint templates/constraints + from the in-repo library or referenced it as part of your upgrade process, + you now need to pull those artifacts from the separate gatekeeper-library + repository instead.'] chart_version: 3.2.0 - images: - - openpolicyagent/gatekeeper:v3.2.0 + images: ['openpolicyagent/gatekeeper:v3.2.0'] - version: 3.1.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 3.1.0 - images: - - openpolicyagent/gatekeeper:v3.1.0 + images: ['openpolicyagent/gatekeeper:v3.1.0'] name: gatekeeper - icon: https://docs.tigera.io/img/calico-logo.webp git_url: https://github.com/projectcalico/calico @@ -34129,266 +25222,183 @@ addons: eolApiSlug: calico versions: - version: 3.32.2 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details provided in the supplied notes; both releases reference - external GitHub release-notes files for specifics. + features: [No feature details provided in the supplied notes; both releases + reference external GitHub release-notes files for specifics.] breaking_changes: [] chart_version: 3.32.2 - images: - - quay.io/tigera/operator:v1.42.6 + images: ['quay.io/tigera/operator:v1.42.6'] - version: 3.32.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifacts now explicitly include separate CRD Helm charts (`crd.projectcalico.org/v1` - and a tech-preview `projectcalico.org/v3`) alongside the tigera-operator chart, - which may change how you manage CRDs during upgrades. - - Calico v3.32.0 introduces a new set of images/binaries/manifests packaged - in `release-v3.32.0.tgz` and updated `tigera-operator-v3.32.0.tgz`, indicating - component image/tag updates across the stack. - breaking_changes: - - No breaking changes were included in the provided notes excerpt; review the - linked v3.32.0 release-notes markdown for any upgrade-impacting changes (API/CRD, - configuration defaults, deprecations). + features: ['Release artifacts now explicitly include separate CRD Helm charts + (`crd.projectcalico.org/v1` and a tech-preview `projectcalico.org/v3`) alongside + the tigera-operator chart, which may change how you manage CRDs during upgrades.', + 'Calico v3.32.0 introduces a new set of images/binaries/manifests packaged + in `release-v3.32.0.tgz` and updated `tigera-operator-v3.32.0.tgz`, indicating + component image/tag updates across the stack.'] + breaking_changes: ['No breaking changes were included in the provided notes + excerpt; review the linked v3.32.0 release-notes markdown for any upgrade-impacting + changes (API/CRD, configuration defaults, deprecations).'] chart_version: 3.32.0 - images: - - quay.io/tigera/operator:v1.42.0 + images: ['quay.io/tigera/operator:v1.42.0'] - version: 3.31.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Upgrade Calico/tigera-operator bundle from v3.30.0 to v3.31.0 (new release - artifacts for Linux/Windows, OpenShift bundle, and updated calicoctl binaries). + features: ['Upgrade Calico/tigera-operator bundle from v3.30.0 to v3.31.0 (new + release artifacts for Linux/Windows, OpenShift bundle, and updated calicoctl + binaries).'] breaking_changes: [] chart_version: 3.31.0 - images: - - quay.io/tigera/operator:v1.40.0 + images: ['quay.io/tigera/operator:v1.40.0'] - version: 3.30.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifact updates for Calico v3.30.0 including updated tigera-operator - Helm chart bundle and associated images/manifests. - - Updated calicoctl and Windows artifacts published as part of the v3.30.0 release - bundle. + features: [Release artifact updates for Calico v3.30.0 including updated tigera-operator + Helm chart bundle and associated images/manifests., Updated calicoctl and + Windows artifacts published as part of the v3.30.0 release bundle.] breaking_changes: [] chart_version: 3.30.0 - images: - - quay.io/tigera/operator:v1.38.0 + images: ['quay.io/tigera/operator:v1.38.0'] eolAt: '2026-04-30' - version: 3.29.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Bumped Calico and tigera-operator chart artifacts from v3.28.0 to v3.29.0 - (new release bundles and Helm chart tarball). - breaking_changes: - - No breaking changes were provided in the supplied notes; review the v3.29.0 - release notes document and tigera-operator chart changelog for any API/values - deprecations before upgrading. + features: [Bumped Calico and tigera-operator chart artifacts from v3.28.0 to + v3.29.0 (new release bundles and Helm chart tarball).] + breaking_changes: [No breaking changes were provided in the supplied notes; + review the v3.29.0 release notes document and tigera-operator chart changelog + for any API/values deprecations before upgrading.] chart_version: 3.29.0 - images: - - quay.io/tigera/operator:v1.36.0 + images: ['quay.io/tigera/operator:v1.36.0'] eolAt: '2025-10-21' - version: 3.28.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Bumps Calico release from v3.27.0 to v3.28.0 (new images/binaries/manifests - and tigera-operator Helm chart tarball). + features: [Bumps Calico release from v3.27.0 to v3.28.0 (new images/binaries/manifests + and tigera-operator Helm chart tarball).] breaking_changes: [] chart_version: 3.28.0 - images: - - quay.io/tigera/operator:v1.34.0 + images: ['quay.io/tigera/operator:v1.34.0'] eolAt: '2025-05-05' - version: 3.27.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Calico release v3.27.0 (includes tigera-operator-v3.27.0 Helm chart) published - 2023-12-15; upgrade from v3.26.0 changes the Calico components to 3.27.0 images/manifests - bundled in the release artifact. - breaking_changes: - - No breaking changes or feature details were provided in the supplied notes - beyond artifact listings; review the full v3.27.0 release notes markdown to - identify any required config or API changes before upgrading. + features: [Calico release v3.27.0 (includes tigera-operator-v3.27.0 Helm chart) + published 2023-12-15; upgrade from v3.26.0 changes the Calico components + to 3.27.0 images/manifests bundled in the release artifact.] + breaking_changes: [No breaking changes or feature details were provided in the + supplied notes beyond artifact listings; review the full v3.27.0 release + notes markdown to identify any required config or API changes before upgrading.] chart_version: 3.27.0 - images: - - quay.io/tigera/operator:v1.32.3 + images: ['quay.io/tigera/operator:v1.32.3'] eolAt: '2024-10-29' - version: 3.26.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifacts updated to Calico v3.26.0, including tigera-operator Helm - v3 chart package and updated binaries/images/manifests bundle. - - Added an OpenShift manifest bundle (ocp.tgz) to the v3.26.0 release assets - list (in addition to the standard release tarball and Helm chart). + features: ['Release artifacts updated to Calico v3.26.0, including tigera-operator + Helm v3 chart package and updated binaries/images/manifests bundle.', Added + an OpenShift manifest bundle (ocp.tgz) to the v3.26.0 release assets list + (in addition to the standard release tarball and Helm chart).] breaking_changes: [] chart_version: 3.26.0 - images: - - quay.io/tigera/operator:v1.30.0 + images: ['quay.io/tigera/operator:v1.30.0'] eolAt: '2024-05-11' - version: 3.25.0 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Bumps Tigera Operator / Calico Helm chart artifact from `tigera-operator-v3.24.1.tgz`\ - \ to `tigera-operator-v3.25.0.tgz` (chart package size ~106KB \u2192 ~107KB)." - features: - - New Calico release v3.25.0 available with updated container images, binaries, - manifests, and Helm chart artifact (`release-v3.25.0.tgz`, `tigera-operator-v3.25.0.tgz`). + chart_updates: ["Bumps Tigera Operator / Calico Helm chart artifact from `tigera-operator-v3.24.1.tgz`\ + \ to `tigera-operator-v3.25.0.tgz` (chart package size ~106KB \u2192 ~107KB)."] + features: ['New Calico release v3.25.0 available with updated container images, + binaries, manifests, and Helm chart artifact (`release-v3.25.0.tgz`, `tigera-operator-v3.25.0.tgz`).'] breaking_changes: [] chart_version: 3.25.0 - images: - - quay.io/tigera/operator:v1.29.0 + images: ['quay.io/tigera/operator:v1.29.0'] eolAt: '2023-12-15' - version: 3.24.1 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release artifacts updated to Calico v3.24.1 including updated container images, - binaries, manifests, and the tigera-operator Helm v3 chart package. + features: ['Release artifacts updated to Calico v3.24.1 including updated container + images, binaries, manifests, and the tigera-operator Helm v3 chart package.'] breaking_changes: [] chart_version: 3.24.1 - images: - - quay.io/tigera/operator:v1.28.1 + images: ['quay.io/tigera/operator:v1.28.1'] - version: 3.23.4 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Version bump of the tigera-operator Helm chart packaged with Calico from v3.22.5 - to v3.23.4 (chart artifact `tigera-operator-v3.23.4.tgz`). - features: - - Upgrade Calico/Tigera components from the v3.22 series to the v3.23 series - (operator/chart version bump). - breaking_changes: - - No breaking changes are stated in the provided release-note excerpts; review - the full v3.23 release notes for any required manual steps before upgrading. + chart_updates: [Version bump of the tigera-operator Helm chart packaged with + Calico from v3.22.5 to v3.23.4 (chart artifact `tigera-operator-v3.23.4.tgz`).] + features: [Upgrade Calico/Tigera components from the v3.22 series to the v3.23 + series (operator/chart version bump).] + breaking_changes: [No breaking changes are stated in the provided release-note + excerpts; review the full v3.23 release notes for any required manual steps + before upgrading.] chart_version: 3.23.4 - images: - - quay.io/tigera/operator:v1.27.14 + images: ['quay.io/tigera/operator:v1.27.14'] - version: 3.22.5 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Calico v3.22.5 release package provides updated container images/binaries/manifests - and a tigera-operator Helm chart bundle (`tigera-operator-v3.22.5.tgz`). - breaking_changes: - - No breaking changes were provided in the supplied release note excerpts; consult - the full v3.21/v3.22 release notes to identify any upgrade-impacting changes - between 3.20.6 and 3.22.5. + features: [Calico v3.22.5 release package provides updated container images/binaries/manifests + and a tigera-operator Helm chart bundle (`tigera-operator-v3.22.5.tgz`).] + breaking_changes: [No breaking changes were provided in the supplied release + note excerpts; consult the full v3.21/v3.22 release notes to identify any + upgrade-impacting changes between 3.20.6 and 3.22.5.] chart_version: 3.22.5 - images: - - quay.io/tigera/operator:v1.25.13 + images: ['quay.io/tigera/operator:v1.25.13'] - version: 3.20.6 - kube: - - '1.30' - - '1.29' - - '1.28' - - '1.27' + kube: ['1.30', '1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 3.20.6 - images: - - quay.io/tigera/operator:v1.20.9 + images: ['quay.io/tigera/operator:v1.20.9'] name: tigera-operator - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/argo-cd/plural/icons/argo-stacked-color-square.png?raw=true git_url: https://github.com/argoproj/argo-cd @@ -34397,763 +25407,575 @@ addons: eolApiSlug: argocd versions: - version: 3.5.2 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'ApplicationSet: restores `ignoreApplicationDifferences` behavior after normalization, - which improves diff/sync accuracy when using AppSet-generated apps.' - - 'Repository/Helm sources: fixes handling of an untyped Helm source in `UpdateRevisionForPaths`, - reducing errors when path-based revision updates run against Helm repos.' - - 'UI: applications and appset pages receive small improvements (operation state - visible in app list; remove kind filter on appset page).' - - 'Dependency: Dex updated to v2.45.1 (may include security/bug fixes from Dex).' + features: ['ApplicationSet: restores `ignoreApplicationDifferences` behavior + after normalization, which improves diff/sync accuracy when using AppSet-generated + apps.', 'Repository/Helm sources: fixes handling of an untyped Helm source + in `UpdateRevisionForPaths`, reducing errors when path-based revision updates + run against Helm repos.', 'UI: applications and appset pages receive small + improvements (operation state visible in app list; remove kind filter on + appset page).', 'Dependency: Dex updated to v2.45.1 (may include security/bug + fixes from Dex).'] breaking_changes: [] chart_version: 10.8.1 - images: - - ecr-public.aws.com/docker/library/redis:8.6.4-alpine - - ghcr.io/dexidp/dex:v2.45.1 - - quay.io/argoproj/argocd:v3.5.2 + images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', + 'quay.io/argoproj/argocd:v3.5.2'] - version: 3.5.1 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No new features in v3.5.1; this is a patch release focused on stability, performance, - and security hardening. + features: ['No new features in v3.5.1; this is a patch release focused on stability, + performance, and security hardening.'] breaking_changes: [] chart_version: 10.4.0 - images: - - ecr-public.aws.com/docker/library/redis:8.6.4-alpine - - ghcr.io/dexidp/dex:v2.45.1 - - quay.io/argoproj/argocd:v3.5.1 + images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', + 'quay.io/argoproj/argocd:v3.5.1'] - version: 3.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Helm rendering now uses Helm 4, which may change manifest output and requires - validating chart compatibility and any custom tooling/plugins tied to Helm - 3. - - ApplicationSet controller can manage applications concurrently, improving - performance for large numbers of generated Applications but increasing burstiness - against the Kubernetes API. - - Webhook-triggered application refreshes now support configurable jitter to - reduce thundering-herd refresh spikes. - - Repo-server gains mTLS support, enabling mutual TLS between Argo CD components - and the repo-server for hardened transport security. - - Source Integrity checking is introduced (CLI support and hydrator opt-in for - dry sources, alpha), enabling signature/integrity verification of sources - with policy-driven enforcement. - - 'UI gains deeper ApplicationSet visibility: AppSet appears in the Application - resource tree, has preview apps and an Apps tab, and additional filtering - options (repo URL, target revision).' - - Helm valueFiles now support wildcard glob patterns, allowing simpler configuration - for multi-environment values overlays. - - 'Server cache behavior is tightened: objects from non-allowed namespaces are - dropped before entering cache, improving isolation in multi-namespace setups.' - - Authentication improvements include optional relaxed strict impersonation - enforcement and better OIDC session handling (refresh tokens to renew expired - sessions). - breaking_changes: - - Migration from Helm 3 to Helm 4 is a major tooling change that can affect - manifest rendering/output; test all Helm-based applications and custom plugins, - and verify repo-server image/tooling expectations. - - If you rely on ApplicationSet cluster generator Kubernetes version labels - from earlier behavior (3.4 series note), ensure secrets use the vMajor.Minor.Patch - format under argocd.argoproj.io/kubernetes-version; mismatches can break cluster - selection logic. + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Helm rendering now uses Helm 4, which may change manifest output + and requires validating chart compatibility and any custom tooling/plugins + tied to Helm 3.', 'ApplicationSet controller can manage applications concurrently, + improving performance for large numbers of generated Applications but increasing + burstiness against the Kubernetes API.', Webhook-triggered application refreshes + now support configurable jitter to reduce thundering-herd refresh spikes., + 'Repo-server gains mTLS support, enabling mutual TLS between Argo CD components + and the repo-server for hardened transport security.', 'Source Integrity + checking is introduced (CLI support and hydrator opt-in for dry sources, + alpha), enabling signature/integrity verification of sources with policy-driven + enforcement.', 'UI gains deeper ApplicationSet visibility: AppSet appears + in the Application resource tree, has preview apps and an Apps tab, and + additional filtering options (repo URL, target revision).', 'Helm valueFiles + now support wildcard glob patterns, allowing simpler configuration for multi-environment + values overlays.', 'Server cache behavior is tightened: objects from non-allowed + namespaces are dropped before entering cache, improving isolation in multi-namespace + setups.', Authentication improvements include optional relaxed strict impersonation + enforcement and better OIDC session handling (refresh tokens to renew expired + sessions).] + breaking_changes: ['Migration from Helm 3 to Helm 4 is a major tooling change + that can affect manifest rendering/output; test all Helm-based applications + and custom plugins, and verify repo-server image/tooling expectations.', + 'If you rely on ApplicationSet cluster generator Kubernetes version labels + from earlier behavior (3.4 series note), ensure secrets use the vMajor.Minor.Patch + format under argocd.argoproj.io/kubernetes-version; mismatches can break + cluster selection logic.'] chart_version: 10.3.2 - images: - - ecr-public.aws.com/docker/library/redis:8.6.4-alpine - - ghcr.io/dexidp/dex:v2.45.1 - - quay.io/argoproj/argocd:v3.5.0 + images: ['ecr-public.aws.com/docker/library/redis:8.6.4-alpine', 'ghcr.io/dexidp/dex:v2.45.1', + 'quay.io/argoproj/argocd:v3.5.0'] - version: 3.4.1 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Cluster generator K8s version label format changes to match Helm: ApplicationSets - using Cluster Generator with `argocd.argoproj.io/auto-label-cluster-info` - must switch from `Major.Minor` to `argocd.argoproj.io/kubernetes-version` - in `vMajor.Minor.Patch` format.' - - 'ApplicationSet improvements: status now includes a Health field, plus new - watch/listResourceEvents APIs and multiple UI enhancements for AppSets.' - - 'Controller features: can pause reconciliation for a specific cluster via - an annotation; adds application-level sync option for Prune+Delete.' - - 'Helm rendering enhancement: supports wildcard/glob patterns for `valueFiles`; - also supports custom User-Agent headers when fetching Helm repos.' - - 'Hydrator enhancements: configurable authorName/Email for hydration commits - and multiple correctness fixes; UI adds hydrator support in app create/summary.' - - 'Observability/security: adds OpenTelemetry instrumentation for auth/handlers; - disables gRPC DNS TXT lookups by default; adds tighter cert/known-hosts limits - during stream parsing.' - breaking_changes: - - 'Cluster version format change impacts ApplicationSet Cluster Generators: - update any selectors/templating that rely on Kubernetes version labels to - use `argocd.argoproj.io/kubernetes-version` with `vMajor.Minor.Patch` (e.g., - `v1.30.2`) instead of `Major.Minor` (e.g., `1.30`).' + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Cluster generator K8s version label format changes to match Helm: + ApplicationSets using Cluster Generator with `argocd.argoproj.io/auto-label-cluster-info` + must switch from `Major.Minor` to `argocd.argoproj.io/kubernetes-version` + in `vMajor.Minor.Patch` format.', 'ApplicationSet improvements: status now + includes a Health field, plus new watch/listResourceEvents APIs and multiple + UI enhancements for AppSets.', 'Controller features: can pause reconciliation + for a specific cluster via an annotation; adds application-level sync option + for Prune+Delete.', 'Helm rendering enhancement: supports wildcard/glob + patterns for `valueFiles`; also supports custom User-Agent headers when + fetching Helm repos.', 'Hydrator enhancements: configurable authorName/Email + for hydration commits and multiple correctness fixes; UI adds hydrator support + in app create/summary.', 'Observability/security: adds OpenTelemetry instrumentation + for auth/handlers; disables gRPC DNS TXT lookups by default; adds tighter + cert/known-hosts limits during stream parsing.'] + breaking_changes: ['Cluster version format change impacts ApplicationSet Cluster + Generators: update any selectors/templating that rely on Kubernetes version + labels to use `argocd.argoproj.io/kubernetes-version` with `vMajor.Minor.Patch` + (e.g., `v1.30.2`) instead of `Major.Minor` (e.g., `1.30`).'] chart_version: 9.5.13 - images: - - ecr-public.aws.com/docker/library/redis:8.2.3-alpine - - ghcr.io/dexidp/dex:v2.45.1 - - quay.io/argoproj/argocd:v3.4.1 + images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.45.1', + 'quay.io/argoproj/argocd:v3.4.1'] - version: 3.3.8 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Server-Side Apply (SSA) becomes a central part of the 3.3 line, including - SSA diffs and automatic migration away from the legacy kubectl client-side - apply field manager. - - ApplicationSet improvements include new pprof endpoints, Progressive Sync - maturity, status/resource count controls, and multiple reconciliation/finalizer - fixes. - - New/expanded custom actions and health checks (e.g., CloudNativePG actions, - PR merge action, more KEDA/Ceph/Crossplane/GatewayAPI-related health logic) - improve operational workflows and UI feedback. - - Repository integration enhancements such as GitHub App auth without installation - ID and optional shallow clones reduce friction and improve performance. - breaking_changes: - - If Argo CD is managing its own installation (app-of-apps/self-managed), the - upgrade may fail unless the managing Application uses `ServerSideApply=true`; - some environments may also need the temporary workaround `ClientSideApplyMigration=false` - to avoid a client-side apply migration error. - - Behavior changes around apply/diff (SSA, server-side dry-run, apply-out-of-sync-only, - replace/force options) can alter sync outcomes; validate sync options and - test against critical apps before rolling out broadly. + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Server-Side Apply (SSA) becomes a central part of the 3.3 line, + including SSA diffs and automatic migration away from the legacy kubectl + client-side apply field manager.', 'ApplicationSet improvements include + new pprof endpoints, Progressive Sync maturity, status/resource count controls, + and multiple reconciliation/finalizer fixes.', 'New/expanded custom actions + and health checks (e.g., CloudNativePG actions, PR merge action, more KEDA/Ceph/Crossplane/GatewayAPI-related + health logic) improve operational workflows and UI feedback.', Repository + integration enhancements such as GitHub App auth without installation ID + and optional shallow clones reduce friction and improve performance.] + breaking_changes: ['If Argo CD is managing its own installation (app-of-apps/self-managed), + the upgrade may fail unless the managing Application uses `ServerSideApply=true`; + some environments may also need the temporary workaround `ClientSideApplyMigration=false` + to avoid a client-side apply migration error.', 'Behavior changes around + apply/diff (SSA, server-side dry-run, apply-out-of-sync-only, replace/force + options) can alter sync outcomes; validate sync options and test against + critical apps before rolling out broadly.'] chart_version: 9.5.10 - images: - - ecr-public.aws.com/docker/library/redis:8.2.3-alpine - - ghcr.io/dexidp/dex:v2.45.1 - - quay.io/argoproj/argocd:v3.3.8 + images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.45.1', + 'quay.io/argoproj/argocd:v3.3.8'] - version: 3.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Argo CD 3.3.0 is a new minor release compared to 3.2.1, with a major internal - shift toward server-side apply (SSA) support and related migration logic (e.g., - client-side apply migration, server-side diffs). - - Install/upgrade guidance now recommends (or requires in some scenarios) `kubectl - apply --server-side --force-conflicts`, which hints at increased reliance - on SSA semantics and field ownership/managedFields. - - Large volume of improvements across sync engine behavior (ordering of Namespace/CRD - creation, pruning order), cluster cache scalability, UI enhancements, and - additional built-in health checks and custom actions. - - If you are coming from 3.2.1 specifically, note that 3.2.1 was primarily bugfixes - (UI null-safety, repo-server git detached concurrency fix) and docs tweaks; - the big behavioral changes arrive in 3.3.0. - features: - - 'Server-Side Apply and Server-Side Diffs: adds SSA manager configuration, - SSA support, and server-side diffing to improve accuracy and scalability of - diffs.' - - 'Self-managed Argo CD upgrade improvements: auto-migration logic exists for - kubectl client-side apply fields when moving to SSA workflows.' - - 'Sync behavior enhancements: create Namespaces/CRDs earlier (before PreSync), - prune in reverse sync-wave order, and new/expanded sync options like ApplyOutOfSyncOnly - and Force via annotation.' - - 'Operational additions: many new/expanded custom actions (e.g., CloudNativePG - actions, PR merge action, KEDA pause) and more health checks (Ceph, Crossplane - updates, HPA v2, KEDA, ServiceBinding/Instance, etc.).' - - 'Repo/credentials improvements: GitHub App auth support without installation - ID; Redis secret credentials can be provided via volume mounts; shallow clone - option for repos.' - - 'UX/CLI improvements: custom icons support, better sync warnings, richer CLI - completion (including PowerShell) and new CLI flags/filters.' - breaking_changes: - - If Argo CD manages itself (an Application deploys Argo CD), you must set `ServerSideApply=true` - on that Application or the upgrade can fail. - - In some self-managed setups (notably Kustomize), you may also need `ClientSideApplyMigration=false` - to avoid client-side apply migration errors during sync. - - The move toward SSA/managedFields can change diff/apply behavior (field ownership - conflicts, need for `--force-conflicts`), so expect potential one-time reconciliation - noise and conflict resolution work during/after upgrade. + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Argo CD 3.3.0 is a new minor release compared to 3.2.1, with + a major internal shift toward server-side apply (SSA) support and related + migration logic (e.g., client-side apply migration, server-side diffs).', + 'Install/upgrade guidance now recommends (or requires in some scenarios) `kubectl + apply --server-side --force-conflicts`, which hints at increased reliance + on SSA semantics and field ownership/managedFields.', 'Large volume of improvements + across sync engine behavior (ordering of Namespace/CRD creation, pruning + order), cluster cache scalability, UI enhancements, and additional built-in + health checks and custom actions.', 'If you are coming from 3.2.1 specifically, + note that 3.2.1 was primarily bugfixes (UI null-safety, repo-server git + detached concurrency fix) and docs tweaks; the big behavioral changes arrive + in 3.3.0.'] + features: ['Server-Side Apply and Server-Side Diffs: adds SSA manager configuration, + SSA support, and server-side diffing to improve accuracy and scalability + of diffs.', 'Self-managed Argo CD upgrade improvements: auto-migration logic + exists for kubectl client-side apply fields when moving to SSA workflows.', + 'Sync behavior enhancements: create Namespaces/CRDs earlier (before PreSync), + prune in reverse sync-wave order, and new/expanded sync options like ApplyOutOfSyncOnly + and Force via annotation.', 'Operational additions: many new/expanded custom + actions (e.g., CloudNativePG actions, PR merge action, KEDA pause) and more + health checks (Ceph, Crossplane updates, HPA v2, KEDA, ServiceBinding/Instance, + etc.).', 'Repo/credentials improvements: GitHub App auth support without + installation ID; Redis secret credentials can be provided via volume mounts; + shallow clone option for repos.', 'UX/CLI improvements: custom icons support, + better sync warnings, richer CLI completion (including PowerShell) and new + CLI flags/filters.'] + breaking_changes: ['If Argo CD manages itself (an Application deploys Argo CD), + you must set `ServerSideApply=true` on that Application or the upgrade can + fail.', 'In some self-managed setups (notably Kustomize), you may also need + `ClientSideApplyMigration=false` to avoid client-side apply migration errors + during sync.', 'The move toward SSA/managedFields can change diff/apply + behavior (field ownership conflicts, need for `--force-conflicts`), so expect + potential one-time reconciliation noise and conflict resolution work during/after + upgrade.'] chart_version: 9.4.2 - images: - - ecr-public.aws.com/docker/library/redis:8.2.3-alpine - - ghcr.io/dexidp/dex:v2.44.0 - - quay.io/argoproj/argocd:v3.3.0 + images: ['ecr-public.aws.com/docker/library/redis:8.2.3-alpine', 'ghcr.io/dexidp/dex:v2.44.0', + 'quay.io/argoproj/argocd:v3.3.0'] - version: 3.2.1 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Repo Server: fixes a concurrency issue when processing detached git states, - reducing chance of stuck/failed refreshes in busy repos.' - - 'UI: multiple small fixes (null-safe status panel rendering, prevent overlapping - elements, add resource units in tooltips, avoid rendering ApplicationSelector - when panel hidden).' + features: ['Repo Server: fixes a concurrency issue when processing detached + git states, reducing chance of stuck/failed refreshes in busy repos.', 'UI: + multiple small fixes (null-safe status panel rendering, prevent overlapping + elements, add resource units in tooltips, avoid rendering ApplicationSelector + when panel hidden).'] breaking_changes: [] chart_version: 9.1.8 - images: - - ecr-public.aws.com/docker/library/redis:8.2.2-alpine - - ghcr.io/dexidp/dex:v2.44.0 - - quay.io/argoproj/argocd:v3.2.1 + images: ['ecr-public.aws.com/docker/library/redis:8.2.2-alpine', 'ghcr.io/dexidp/dex:v2.44.0', + 'quay.io/argoproj/argocd:v3.2.1'] eolAt: '2026-08-04' - version: 3.2.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Internal tooling bumps: embedded Helm upgraded to 3.18.4 (via 3.18.3) and - embedded Kustomize upgraded to 5.7.0.' - - New/updated health check scripts and resource_customizations shipped with - the release (CronJob actions/health changes, plus additional CRD health checks - such as Coralogix, DatadogMetric, ClickHouse operator, ExtensionService, GitOps - Promoter, 3scale, etc.). - - 'Security fix included: repository.GetDetailedProject no longer exposes repository - secrets.' - - Performance/behavioral fixes around auto-sync loops and controller CPU (reduced - settings DB calls), plus webhook handler hardening (panic recovery; informer - usage to reduce memory). - - 'Source Hydrator enhancements: commit message templating, credential templates, - preserve non-hydrated files, repo URL normalization, parallelized repo-server - calls.' - features: - - 'ApplicationSet: pprof endpoints added; progressive sync deletion can happen - in order; improved status/debug logging; concurrency ceiling effectively removed.' - - 'CLI: server-side diff is supported; new `argocd get-resource` command; password - can be read from stdin / prompted for bcrypt operations.' - - 'Controller: when retrying a failed sync, Argo CD can sync a newer revision - than the original failed revision.' - - 'Observability: OpenTelemetry trace context propagation added for HTTP requests; - new metrics to track number of users.' - - 'Server/UI: gRPC health check endpoint for argocd-server; UI improvements - like sortable columns and prune option during rollback, plus richer repo connection - status messages.' + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Internal tooling bumps: embedded Helm upgraded to 3.18.4 (via + 3.18.3) and embedded Kustomize upgraded to 5.7.0.', 'New/updated health + check scripts and resource_customizations shipped with the release (CronJob + actions/health changes, plus additional CRD health checks such as Coralogix, + DatadogMetric, ClickHouse operator, ExtensionService, GitOps Promoter, 3scale, + etc.).', 'Security fix included: repository.GetDetailedProject no longer + exposes repository secrets.', 'Performance/behavioral fixes around auto-sync + loops and controller CPU (reduced settings DB calls), plus webhook handler + hardening (panic recovery; informer usage to reduce memory).', 'Source Hydrator + enhancements: commit message templating, credential templates, preserve + non-hydrated files, repo URL normalization, parallelized repo-server calls.'] + features: ['ApplicationSet: pprof endpoints added; progressive sync deletion + can happen in order; improved status/debug logging; concurrency ceiling + effectively removed.', 'CLI: server-side diff is supported; new `argocd + get-resource` command; password can be read from stdin / prompted for bcrypt + operations.', 'Controller: when retrying a failed sync, Argo CD can sync + a newer revision than the original failed revision.', 'Observability: OpenTelemetry + trace context propagation added for HTTP requests; new metrics to track + number of users.', 'Server/UI: gRPC health check endpoint for argocd-server; + UI improvements like sortable columns and prune option during rollback, + plus richer repo connection status messages.'] breaking_changes: [] chart_version: 9.1.4 - images: - - ecr-public.aws.com/docker/library/redis:8.2.2-alpine - - ghcr.io/dexidp/dex:v2.44.0 - - quay.io/argoproj/argocd:v3.2.0 + images: ['ecr-public.aws.com/docker/library/redis:8.2.2-alpine', 'ghcr.io/dexidp/dex:v2.44.0', + 'quay.io/argoproj/argocd:v3.2.0'] eolAt: '2026-08-04' - version: 3.1.1 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - No Helm chart-specific changelog was provided in the notes you pasted; the - v3.1.1 notes are application release notes only. - - "If you are upgrading via Helm, verify the argo-cd Helm chart version that\ - \ corresponds to app v3.1.1 and review that chart\u2019s CHANGELOG for values/schema\ - \ changes, hook/job changes, and CRD handling." - features: - - No new user-facing features called out for v3.1.1; this is a patch release - focused on fixes and small manifest tweaks. - - Manifests add OCI-related environment variables (helps OCI/registry integrations - when using upstream install manifests). + chart_updates: [No Helm chart-specific changelog was provided in the notes you + pasted; the v3.1.1 notes are application release notes only., "If you are\ + \ upgrading via Helm, verify the argo-cd Helm chart version that corresponds\ + \ to app v3.1.1 and review that chart\u2019s CHANGELOG for values/schema\ + \ changes, hook/job changes, and CRD handling."] + features: [No new user-facing features called out for v3.1.1; this is a patch + release focused on fixes and small manifest tweaks., Manifests add OCI-related + environment variables (helps OCI/registry integrations when using upstream + install manifests).] breaking_changes: [] chart_version: 8.3.3 - images: - - ecr-public.aws.com/docker/library/redis:7.2.8-alpine - - ghcr.io/dexidp/dex:v2.44.0 - - quay.io/argoproj/argocd:v3.1.1 + images: ['ecr-public.aws.com/docker/library/redis:7.2.8-alpine', 'ghcr.io/dexidp/dex:v2.44.0', + 'quay.io/argoproj/argocd:v3.1.1'] eolAt: '2026-05-05' - version: 3.1.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Application version bump from v3.0.x to v3.1.0 (new images/manifests). - - 'Tooling bundled with Argo CD updated: Helm upgraded to 3.18.x; Kustomize - upgraded to 5.7.0.' - - Various health-check/resource customization additions (Karpenter, Crossplane/Upbound, - Kyverno, Logstash, RabbitMQ topology, OpenTelemetryCollector, Grafana Operator, - Gateway API, Contour HTTPProxy, etc.). - - Security hardening around static assets/commit-server traversal protection - and other fixes. - - UI enhancements including Progressive Sync integration and improved repo/pod - views. - - CLI improvements including plugin support and additional commands/aliases. - features: - - 'CLI: adds official plugin support and a new whoami alias.' - - 'UI: Progressive Sync feature integrated and additional usability improvements - (sorting, resource display toggles, autosync enabled field).' - - 'ApplicationSet: enhancements such as Bitbucket Cloud PR generator target-branch - support and git file generator file-exclusion support.' - - 'Repo/OCI: OCI support continues (beta) plus related UI polish and OCI client - fixes; also adds GitHub API rate limit metrics.' - - 'Operations/Health: many new built-in health checks/resource customizations - for popular CRDs (Crossplane, Kyverno, KEDA, Grafana Operator, OpenTelemetryCollector, - etc.).' - breaking_changes: - - 'Potential API/schema change around SyncPolicy automated sync: field is `enabled` - (and a UI field was added); ensure any manifests/automation referencing older - field names are updated.' - - Toolchain bumps (Helm 3.18.x, Kustomize 5.7.0) can change rendering/diff behavior - compared to 3.0.x; validate any edge-case charts/kustomize builds in staging. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Application version bump from v3.0.x to v3.1.0 (new images/manifests)., + 'Tooling bundled with Argo CD updated: Helm upgraded to 3.18.x; Kustomize + upgraded to 5.7.0.', 'Various health-check/resource customization additions + (Karpenter, Crossplane/Upbound, Kyverno, Logstash, RabbitMQ topology, OpenTelemetryCollector, + Grafana Operator, Gateway API, Contour HTTPProxy, etc.).', Security hardening + around static assets/commit-server traversal protection and other fixes., + UI enhancements including Progressive Sync integration and improved repo/pod + views., CLI improvements including plugin support and additional commands/aliases.] + features: ['CLI: adds official plugin support and a new whoami alias.', 'UI: + Progressive Sync feature integrated and additional usability improvements + (sorting, resource display toggles, autosync enabled field).', 'ApplicationSet: + enhancements such as Bitbucket Cloud PR generator target-branch support + and git file generator file-exclusion support.', 'Repo/OCI: OCI support + continues (beta) plus related UI polish and OCI client fixes; also adds + GitHub API rate limit metrics.', 'Operations/Health: many new built-in health + checks/resource customizations for popular CRDs (Crossplane, Kyverno, KEDA, + Grafana Operator, OpenTelemetryCollector, etc.).'] + breaking_changes: ['Potential API/schema change around SyncPolicy automated + sync: field is `enabled` (and a UI field was added); ensure any manifests/automation + referencing older field names are updated.', 'Toolchain bumps (Helm 3.18.x, + Kustomize 5.7.0) can change rendering/diff behavior compared to 3.0.x; validate + any edge-case charts/kustomize builds in staging.'] chart_version: 8.3.0 - images: - - ecr-public.aws.com/docker/library/redis:7.2.8-alpine - - ghcr.io/dexidp/dex:v2.43.1 - - quay.io/argoproj/argocd:v3.1.0 + images: ['ecr-public.aws.com/docker/library/redis:7.2.8-alpine', 'ghcr.io/dexidp/dex:v2.43.1', + 'quay.io/argoproj/argocd:v3.1.0'] eolAt: '2026-05-05' - version: 3.0.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Argo CD 3.0.0 is a major release with multiple default-behavior changes (RBAC, - diffing/compare, tracking method, logging, controller processing) that can - affect existing installations during upgrade. - - Repo-server tooling bumped (Helm 3.17.0, kubectl 1.32.1) and Kubernetes support - updated (supports Kubernetes 1.32; older versions removed from e2e). - - 'Redis usage changed: application health status is stored in Redis by default; - Redis image upgraded (7.0.15-alpine -> 7.2.7-alpine).' - - 'Security posture and supply chain: images signed with cosign and SLSA3 provenance; - some dependency CVE bumps included.' - - Legacy repo support removed; behavior of ApplicationSet selectors and diff - ignore defaults changed; some deprecated metrics removed. - features: - - Azure Workload Identity support added for Git/OCI repositories and for Microsoft - Entra (Azure AD) SSO flows. - - Application controller now stores application health status in Redis by default, - improving performance/scalability for large installs. - - Batch event processing enabled by default in the controller to reduce event - storm impact. - - Helm tooling upgraded to Helm v3.17.0 and kubectl upgraded to 1.32.x, improving - compatibility with newer clusters. - - Bearer token authentication support added (including UI/Helm repo connect - flows). - - 'Kustomize enhancements: ignore missing components and support --include-templates - for label processing.' - - 'UI improvements: better log search (match case), log highlighting, sync-wave - display, repo filtering, and various UX fixes.' - - More metrics exposed (including additional kubectl metrics and cluster name/labels - in cluster metrics). - breaking_changes: - - RBAC enforcement for logs is enabled by default; users/roles that previously - could view logs may be denied until RBAC is updated. - - Fine-grained RBAC inheritance is disabled by default, which can change effective - permissions for inherited roles/policies. - - "Compare/diff defaults changed: compare options default values updated, known\ - \ interim resources excluded by default, and Argo CD now ignores .status updates\ - \ and other high-churn diffs by default\u2014this can change sync/diff outcomes." - - Default resource tracking method changed to annotation, which can affect how - existing resources are associated with applications if you relied on the prior - default. - - Default logging switched to JSON, which can break log parsers/alerts expecting - text logs. - - Legacy repo support removed; any clusters/repos relying on legacy repository - handling must be migrated. - - Deprecated metrics removed; dashboards/alerts referencing old metric names - will break. - - 'ApplicationSet behavior change: nested selectors are always applied, potentially - altering generated ApplicationSets/app selection.' - - Default jitter added (60s) which can change timing/behavior of periodic operations - and reconciliation cadence. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Argo CD 3.0.0 is a major release with multiple default-behavior + changes (RBAC, diffing/compare, tracking method, logging, controller processing) + that can affect existing installations during upgrade.', 'Repo-server tooling + bumped (Helm 3.17.0, kubectl 1.32.1) and Kubernetes support updated (supports + Kubernetes 1.32; older versions removed from e2e).', 'Redis usage changed: + application health status is stored in Redis by default; Redis image upgraded + (7.0.15-alpine -> 7.2.7-alpine).', 'Security posture and supply chain: images + signed with cosign and SLSA3 provenance; some dependency CVE bumps included.', + Legacy repo support removed; behavior of ApplicationSet selectors and diff + ignore defaults changed; some deprecated metrics removed.] + features: [Azure Workload Identity support added for Git/OCI repositories and + for Microsoft Entra (Azure AD) SSO flows., 'Application controller now stores + application health status in Redis by default, improving performance/scalability + for large installs.', Batch event processing enabled by default in the controller + to reduce event storm impact., 'Helm tooling upgraded to Helm v3.17.0 and + kubectl upgraded to 1.32.x, improving compatibility with newer clusters.', + Bearer token authentication support added (including UI/Helm repo connect + flows)., 'Kustomize enhancements: ignore missing components and support + --include-templates for label processing.', 'UI improvements: better log + search (match case), log highlighting, sync-wave display, repo filtering, + and various UX fixes.', More metrics exposed (including additional kubectl + metrics and cluster name/labels in cluster metrics).] + breaking_changes: [RBAC enforcement for logs is enabled by default; users/roles + that previously could view logs may be denied until RBAC is updated., 'Fine-grained + RBAC inheritance is disabled by default, which can change effective permissions + for inherited roles/policies.', "Compare/diff defaults changed: compare\ + \ options default values updated, known interim resources excluded by default,\ + \ and Argo CD now ignores .status updates and other high-churn diffs by\ + \ default\u2014this can change sync/diff outcomes.", 'Default resource tracking + method changed to annotation, which can affect how existing resources are + associated with applications if you relied on the prior default.', 'Default + logging switched to JSON, which can break log parsers/alerts expecting text + logs.', Legacy repo support removed; any clusters/repos relying on legacy + repository handling must be migrated., Deprecated metrics removed; dashboards/alerts + referencing old metric names will break., 'ApplicationSet behavior change: + nested selectors are always applied, potentially altering generated ApplicationSets/app + selection.', Default jitter added (60s) which can change timing/behavior + of periodic operations and reconciliation cadence.] chart_version: 8.0.1 - images: - - ghcr.io/dexidp/dex:v2.42.1 - - public.ecr.aws/docker/library/redis:7.2.8-alpine - - quay.io/argoproj/argocd:v3.0.0 + images: ['ghcr.io/dexidp/dex:v2.42.1', 'public.ecr.aws/docker/library/redis:7.2.8-alpine', + 'quay.io/argoproj/argocd:v3.0.0'] eolAt: '2026-02-02' - version: 2.14.11 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Hydrator: webhook handling now understands `sourceHydrator` fields, improving - support for hydration workflows triggered via webhooks.' + features: ['Hydrator: webhook handling now understands `sourceHydrator` fields, + improving support for hydration workflows triggered via webhooks.'] breaking_changes: [] chart_version: 7.9.1 - images: - - ghcr.io/dexidp/dex:v2.42.1 - - public.ecr.aws/docker/library/redis:7.2.8-alpine - - quay.io/argoproj/argocd:v2.14.11 + images: ['ghcr.io/dexidp/dex:v2.42.1', 'public.ecr.aws/docker/library/redis:7.2.8-alpine', + 'quay.io/argoproj/argocd:v2.14.11'] eolAt: '2025-11-04' - version: 2.14.1 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "v2.14.1 release notes provided don\u2019t enumerate feature changes; they\ - \ mainly reference the full changelog diff from v2.14.0 to v2.14.1 and standard\ - \ install/upgrade guidance." - - v2.13.2 notes list bug fixes in CLI core mode appset generation, multi-source - sync ordering, API server secret reads, repo deletion with invalid URLs, Bitbucket - Cloud PR author parsing, and a repo-server memory leak fix. - breaking_changes: - - "No breaking changes are called out in the provided notes; because you\u2019\ - re crossing a minor version (2.13 \u2192 2.14), you should still review the\ - \ official Argo CD upgrading docs for any 2.14-specific breaking changes not\ - \ included here." + features: ["v2.14.1 release notes provided don\u2019t enumerate feature changes;\ + \ they mainly reference the full changelog diff from v2.14.0 to v2.14.1\ + \ and standard install/upgrade guidance.", 'v2.13.2 notes list bug fixes + in CLI core mode appset generation, multi-source sync ordering, API server + secret reads, repo deletion with invalid URLs, Bitbucket Cloud PR author + parsing, and a repo-server memory leak fix.'] + breaking_changes: ["No breaking changes are called out in the provided notes;\ + \ because you\u2019re crossing a minor version (2.13 \u2192 2.14), you should\ + \ still review the official Argo CD upgrading docs for any 2.14-specific\ + \ breaking changes not included here."] chart_version: 7.8.0 - images: - - ghcr.io/dexidp/dex:v2.41.1 - - public.ecr.aws/docker/library/redis:7.4.2-alpine - - quay.io/argoproj/argocd:v2.14.1 + images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.2-alpine', + 'quay.io/argoproj/argocd:v2.14.1'] eolAt: '2025-11-04' - version: 2.13.2 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - '(v2.13.0) UI extensions: Argo CD now supports configuring extensions individually, - allowing per-extension settings rather than a single shared config.' - - '(v2.13.0) Self-heal exponential backoff: self-heal retries can use an exponential - backoff between attempts to reduce thrash during repeated drift.' + features: ['(v2.13.0) UI extensions: Argo CD now supports configuring extensions + individually, allowing per-extension settings rather than a single shared + config.', '(v2.13.0) Self-heal exponential backoff: self-heal retries can + use an exponential backoff between attempts to reduce thrash during repeated + drift.'] breaking_changes: [] chart_version: 7.7.12 - images: - - ghcr.io/dexidp/dex:v2.41.1 - - public.ecr.aws/docker/library/redis:7.4.1-alpine - - quay.io/argoproj/argocd:v2.13.2 + images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.1-alpine', + 'quay.io/argoproj/argocd:v2.13.2'] eolAt: '2025-08-13' - version: 2.13.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'v2.13.0: UI extensions can now be configured individually, allowing more - granular extension setup per extension rather than a single shared config.' - - 'v2.13.0: Self-heal can use exponential backoff between attempts, reducing - thrash on frequently-drifting resources and smoothing controller load.' - - 'v2.12.0: Added a custom health check for Cluster API AWSManagedControlPlane - resources (useful if you manage CAPI AWS clusters via Argo CD).' + features: ['v2.13.0: UI extensions can now be configured individually, allowing + more granular extension setup per extension rather than a single shared + config.', 'v2.13.0: Self-heal can use exponential backoff between attempts, + reducing thrash on frequently-drifting resources and smoothing controller + load.', 'v2.12.0: Added a custom health check for Cluster API AWSManagedControlPlane + resources (useful if you manage CAPI AWS clusters via Argo CD).'] breaking_changes: [] chart_version: 7.7.3 - images: - - ghcr.io/dexidp/dex:v2.41.1 - - public.ecr.aws/docker/library/redis:7.4.1-alpine - - quay.io/argoproj/argocd:v2.13.0 + images: ['ghcr.io/dexidp/dex:v2.41.1', 'public.ecr.aws/docker/library/redis:7.4.1-alpine', + 'quay.io/argoproj/argocd:v2.13.0'] eolAt: '2025-08-13' - version: 2.12.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Adds a custom health check for Cluster API\u2019s AWSManagedControlPlane\ - \ resource, improving health reporting for that CRD when managed by Argo CD." - breaking_changes: - - 'Known issue in 2.12.0: ApplicationSets using git generators with a templated - `spec.template.spec.project` can fail to reconcile due to a bug in the new - git signature verification feature (fixed in 2.12.2). Consider upgrading to - >=2.12.2 or avoiding that pattern during the upgrade.' + features: ["Adds a custom health check for Cluster API\u2019s AWSManagedControlPlane\ + \ resource, improving health reporting for that CRD when managed by Argo\ + \ CD."] + breaking_changes: ['Known issue in 2.12.0: ApplicationSets using git generators + with a templated `spec.template.spec.project` can fail to reconcile due + to a bug in the new git signature verification feature (fixed in 2.12.2). + Consider upgrading to >=2.12.2 or avoiding that pattern during the upgrade.'] chart_version: 7.4.3 - images: - - ghcr.io/dexidp/dex:v2.38.0 - - public.ecr.aws/docker/library/redis:7.2.4-alpine - - quay.io/argoproj/argocd:v2.12.0 + images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', + 'quay.io/argoproj/argocd:v2.12.0'] eolAt: '2025-05-06' - version: 2.11.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Argo CD 2.11.0 is a new minor release over 2.10.7; release notes provided\ - \ here don\u2019t enumerate specific feature highlights beyond standard installation,\ - \ signing, and upgrade pointers." - breaking_changes: - - No breaking changes are listed in the provided release-note excerpts; consult - the full changelog diff and the official upgrading guide for any minor-version - upgrade considerations. + features: ["Argo CD 2.11.0 is a new minor release over 2.10.7; release notes\ + \ provided here don\u2019t enumerate specific feature highlights beyond\ + \ standard installation, signing, and upgrade pointers."] + breaking_changes: [No breaking changes are listed in the provided release-note + excerpts; consult the full changelog diff and the official upgrading guide + for any minor-version upgrade considerations.] chart_version: 6.9.3 - images: - - ghcr.io/dexidp/dex:v2.38.0 - - public.ecr.aws/docker/library/redis:7.2.4-alpine - - quay.io/argoproj/argocd:v2.11.0 + images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', + 'quay.io/argoproj/argocd:v2.11.0'] eolAt: '2025-02-03' - version: 2.10.7 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 2.10.0 is the base for this patch-line upgrade; it introduced multiple controller/server/repo-server - features and fixes, plus a known HA controller issue in 2.10.0 that is fixed - in 2.10.1+. - - v2.10.7 is a patch release; the GitHub release page primarily points to the - compare view (v2.10.6...v2.10.7) rather than listing highlights on the page - itself. - features: - - In 2.10.0, Application Controller added sync jitter (to reduce sync thundering - herd) and a grace period for repo errors to avoid overly aggressive Unknown - sync states. - - In 2.10.0, Argo CD added Server-Side Diff and improved support for Server-Side - Apply scenarios (notably around auto-creating namespaces). - - In 2.10.0, ApplicationSets gained advanced templating via templatePatch and - additional sprig functions (e.g., slugify). - - In 2.10.0, Argo CD added PostDelete hook support and improved UI capabilities - (e.g., status panel extensions, better prompts around pruning, recursive Helm - values file detection). - - In 2.10.0, security/SSO improvements included PKCE web login flow and optional - OIDC UserInfo group-claim retrieval, plus better security logging when access - is blocked. - breaking_changes: - - No explicit breaking changes are shown in the provided notes for 2.10.0 or - 2.10.7; treat this as 'none called out' rather than 'none exist' and still - follow the upstream upgrading guide when jumping minor versions (not applicable - here since it's a patch upgrade within 2.10). + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['2.10.0 is the base for this patch-line upgrade; it introduced + multiple controller/server/repo-server features and fixes, plus a known + HA controller issue in 2.10.0 that is fixed in 2.10.1+.', v2.10.7 is a patch + release; the GitHub release page primarily points to the compare view (v2.10.6...v2.10.7) + rather than listing highlights on the page itself.] + features: ['In 2.10.0, Application Controller added sync jitter (to reduce sync + thundering herd) and a grace period for repo errors to avoid overly aggressive + Unknown sync states.', 'In 2.10.0, Argo CD added Server-Side Diff and improved + support for Server-Side Apply scenarios (notably around auto-creating namespaces).', + 'In 2.10.0, ApplicationSets gained advanced templating via templatePatch and + additional sprig functions (e.g., slugify).', 'In 2.10.0, Argo CD added + PostDelete hook support and improved UI capabilities (e.g., status panel + extensions, better prompts around pruning, recursive Helm values file detection).', + 'In 2.10.0, security/SSO improvements included PKCE web login flow and optional + OIDC UserInfo group-claim retrieval, plus better security logging when access + is blocked.'] + breaking_changes: [No explicit breaking changes are shown in the provided notes + for 2.10.0 or 2.10.7; treat this as 'none called out' rather than 'none + exist' and still follow the upstream upgrading guide when jumping minor + versions (not applicable here since it's a patch upgrade within 2.10).] chart_version: 6.7.15 - images: - - ghcr.io/dexidp/dex:v2.38.0 - - public.ecr.aws/docker/library/redis:7.2.4-alpine - - quay.io/argoproj/argocd:v2.10.7 + images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.2.4-alpine', + 'quay.io/argoproj/argocd:v2.10.7'] eolAt: '2024-11-04' - version: 2.10.0 - kube: - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart changelog was provided in the notes you pasted (these are Argo - CD application release notes), so there are no chart-specific template/RBAC/Service - changes I can accurately call out from this input alone. - features: - - 'Server-Side Diff: Argo CD can compute diffs using Kubernetes server-side - apply semantics, improving diff accuracy for SSA-managed fields.' - - 'PostDelete hook support: adds a new hook type so you can run cleanup jobs - after an app is deleted.' - - 'Controller sync jitter: introduces jitter to reconciliation timing to reduce - thundering-herd behavior across many apps/controllers.' - - 'UI status panel extensions: allows adding/using UI extensions in the application - status panel without modifying core UI.' - - 'OIDC UserInfo group claims (optional): can query the OIDC UserInfo endpoint - to populate group claims when they are not present in the ID token.' - - "Kustomize Components support: supports Kustomize \u201Ccomponents\u201D for\ - \ more modular overlays." - - 'Notifications self-service: adds functionality enabling users to manage certain - notifications behavior via Argo CD.' - - 'Improved observability and networking options: supports secured OTLP endpoints/headers - for OpenTelemetry and adds support for ALL_PROXY.' - breaking_changes: - - 'Known issue (operationally impactful): Argo CD 2.10.0 has a major issue with - the application-controller when running in HA mode; upstream indicates the - fix is in 2.10.1, so upgrading straight to 2.10.0 in HA is risky and may be - effectively a breaking change for HA deployments.' - - "API hardening change: content-type enforcement for API requests was introduced\ - \ (with an option to disable the check); clients/proxies that don\u2019t set\ - \ Content-Type correctly may start failing until adjusted." + kube: ['1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['No Helm chart changelog was provided in the notes you pasted + (these are Argo CD application release notes), so there are no chart-specific + template/RBAC/Service changes I can accurately call out from this input + alone.'] + features: ['Server-Side Diff: Argo CD can compute diffs using Kubernetes server-side + apply semantics, improving diff accuracy for SSA-managed fields.', 'PostDelete + hook support: adds a new hook type so you can run cleanup jobs after an + app is deleted.', 'Controller sync jitter: introduces jitter to reconciliation + timing to reduce thundering-herd behavior across many apps/controllers.', + 'UI status panel extensions: allows adding/using UI extensions in the application + status panel without modifying core UI.', 'OIDC UserInfo group claims (optional): + can query the OIDC UserInfo endpoint to populate group claims when they + are not present in the ID token.', "Kustomize Components support: supports\ + \ Kustomize \u201Ccomponents\u201D for more modular overlays.", 'Notifications + self-service: adds functionality enabling users to manage certain notifications + behavior via Argo CD.', 'Improved observability and networking options: + supports secured OTLP endpoints/headers for OpenTelemetry and adds support + for ALL_PROXY.'] + breaking_changes: ['Known issue (operationally impactful): Argo CD 2.10.0 has + a major issue with the application-controller when running in HA mode; upstream + indicates the fix is in 2.10.1, so upgrading straight to 2.10.0 in HA is + risky and may be effectively a breaking change for HA deployments.', "API\ + \ hardening change: content-type enforcement for API requests was introduced\ + \ (with an option to disable the check); clients/proxies that don\u2019\ + t set Content-Type correctly may start failing until adjusted."] chart_version: 6.0.13 - images: - - ghcr.io/dexidp/dex:v2.38.0 - - public.ecr.aws/docker/library/redis:7.0.15-alpine - - quay.io/argoproj/argocd:v2.10.0 + images: ['ghcr.io/dexidp/dex:v2.38.0', 'public.ecr.aws/docker/library/redis:7.0.15-alpine', + 'quay.io/argoproj/argocd:v2.10.0'] eolAt: '2024-11-04' - version: 2.9.4 - kube: - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - No Helm chart changelog was provided in the notes you pasted, so there are - no chart-specific changes I can summarize from source data. - features: - - '**v2.9.0** introduced a large set of new capabilities across Argo CD and - ApplicationSet, including PKCE auth flow for web logins, dynamic cluster sharding/rebalancing - (must be explicitly enabled), improved UI features (e.g., recursive Helm values - file detection), and multiple new/expanded health checks for additional CRDs.' - - Operational/observability additions in **v2.9.0** include more reconciliation - timing metrics/log fields, additional OpenTelemetry attributes support, and - new knobs like `ARGOCD_CLUSTER_CACHE_LIST_PAGE_BUFFER_SIZE` and GRPC keepalive - configuration. - breaking_changes: - - '**v2.9.4 includes a security fix (GHSA-92mw-q256-5vwg) that introduces a - breaking API change**; you must read the advisory and validate any custom - clients/integrations against the new API behavior before upgrading.' - - '**v2.9.4 has a known issue causing major UI breakage** (many UI actions fail). - The upstream note says a fix will be available in 2.9.5, so consider skipping - 2.9.4 if the UI is critical.' + kube: ['1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['No Helm chart changelog was provided in the notes you pasted, + so there are no chart-specific changes I can summarize from source data.'] + features: ['**v2.9.0** introduced a large set of new capabilities across Argo + CD and ApplicationSet, including PKCE auth flow for web logins, dynamic + cluster sharding/rebalancing (must be explicitly enabled), improved UI features + (e.g., recursive Helm values file detection), and multiple new/expanded + health checks for additional CRDs.', 'Operational/observability additions + in **v2.9.0** include more reconciliation timing metrics/log fields, additional + OpenTelemetry attributes support, and new knobs like `ARGOCD_CLUSTER_CACHE_LIST_PAGE_BUFFER_SIZE` + and GRPC keepalive configuration.'] + breaking_changes: ['**v2.9.4 includes a security fix (GHSA-92mw-q256-5vwg) that + introduces a breaking API change**; you must read the advisory and validate + any custom clients/integrations against the new API behavior before upgrading.', + '**v2.9.4 has a known issue causing major UI breakage** (many UI actions fail). + The upstream note says a fix will be available in 2.9.5, so consider skipping + 2.9.4 if the UI is critical.'] chart_version: 5.53.1 - images: - - ghcr.io/dexidp/dex:v2.37.0 - - public.ecr.aws/docker/library/redis:7.0.13-alpine - - quay.io/argoproj/argocd:v2.9.4 + images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', + 'quay.io/argoproj/argocd:v2.9.4'] eolAt: '2024-08-05' - version: 2.9.0 - kube: - - '1.28' - - '1.27' - - '1.26' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Upgrade Argo CD components from v2.8.4 to v2.9.0 (new container images/manifests). - - Redis image bumped to 7.0.14; various dependency bumps (k8s/client-go, kustomize, - helm, Go 1.21) that may change runtime behavior and manifest generation edge - cases. - - Notifications engine upgraded (may affect notification templates/triggers - behavior). - - 'Extensions: extension configs can now be applied without restarting the API - server (operational behavior change).' - - ApplicationSet controller and generators received multiple functional updates - and bug fixes (behavior changes noted below). - features: - - PKCE authentication flow for web logins (OIDC) to improve security and compatibility - with providers requiring PKCE. - - 'ApplicationSet enhancements: new template functions (fromYaml/fromYamlArray/toYaml), - ignoreApplicationDifferences support, label preservation options, and expanded - SCM/webhook support (Azure DevOps, GitLab improvements).' - - 'Git and repo behavior improvements: configurable git requests and a grace - period for repo errors to reduce flapping to Unknown sync state.' - - Dynamic cluster sharding/rebalancing support to distribute clusters across - controller shards more evenly (must be explicitly enabled). - - 'UI/CLI improvements: Helm values files detected recursively; tree-view output - for several CLI commands; better log viewer (line wrap toggle).' - - 'Observability improvements: new reconciliation timing fields in logs; extra - OpenTelemetry attributes support; new/extended metrics (e.g., autosync_enabled - gauge).' + kube: ['1.28', '1.27', '1.26'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Upgrade Argo CD components from v2.8.4 to v2.9.0 (new container + images/manifests)., 'Redis image bumped to 7.0.14; various dependency bumps + (k8s/client-go, kustomize, helm, Go 1.21) that may change runtime behavior + and manifest generation edge cases.', Notifications engine upgraded (may + affect notification templates/triggers behavior)., 'Extensions: extension + configs can now be applied without restarting the API server (operational + behavior change).', ApplicationSet controller and generators received multiple + functional updates and bug fixes (behavior changes noted below).] + features: [PKCE authentication flow for web logins (OIDC) to improve security + and compatibility with providers requiring PKCE., 'ApplicationSet enhancements: + new template functions (fromYaml/fromYamlArray/toYaml), ignoreApplicationDifferences + support, label preservation options, and expanded SCM/webhook support (Azure + DevOps, GitLab improvements).', 'Git and repo behavior improvements: configurable + git requests and a grace period for repo errors to reduce flapping to Unknown + sync state.', Dynamic cluster sharding/rebalancing support to distribute + clusters across controller shards more evenly (must be explicitly enabled)., + 'UI/CLI improvements: Helm values files detected recursively; tree-view output + for several CLI commands; better log viewer (line wrap toggle).', 'Observability + improvements: new reconciliation timing fields in logs; extra OpenTelemetry + attributes support; new/extended metrics (e.g., autosync_enabled gauge).'] breaking_changes: [] chart_version: 5.51.1 - images: - - ghcr.io/dexidp/dex:v2.37.0 - - public.ecr.aws/docker/library/redis:7.0.13-alpine - - quay.io/argoproj/argocd:v2.9.0 + images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', + 'quay.io/argoproj/argocd:v2.9.0'] eolAt: '2024-08-05' - version: 2.8.4 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Includes several bugfixes in Argo CD 2.8.4: reverts ApplicationSet application-name - labels behavior; fixes handling of annotations for resources with '':'' in - the name; prevents ApplicationSet GoTemplate nil dereference panics; stops - appending '':443'' to server address when using grpc-web; allows retrieving - UI badges across namespaces; fixes GitLab SCM provider transport creation; - makes managed namespaces more resistant to being pruned; expands the controller - ClusterRole to permit cronjob and Argo Workflows triggers.' - - Argo CD 2.8.3 (current) was a security patch release addressing CVE-2023-40029 - and CVE-2023-40584. + features: ['Includes several bugfixes in Argo CD 2.8.4: reverts ApplicationSet + application-name labels behavior; fixes handling of annotations for resources + with '':'' in the name; prevents ApplicationSet GoTemplate nil dereference + panics; stops appending '':443'' to server address when using grpc-web; + allows retrieving UI badges across namespaces; fixes GitLab SCM provider + transport creation; makes managed namespaces more resistant to being pruned; + expands the controller ClusterRole to permit cronjob and Argo Workflows + triggers.', Argo CD 2.8.3 (current) was a security patch release addressing + CVE-2023-40029 and CVE-2023-40584.] breaking_changes: [] chart_version: 5.47.0 - images: - - ghcr.io/dexidp/dex:v2.37.0 - - public.ecr.aws/docker/library/redis:7.0.13-alpine - - quay.io/argoproj/argocd:v2.8.4 + images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.13-alpine', + 'quay.io/argoproj/argocd:v2.8.4'] eolAt: '2024-05-07' - version: 2.8.3 - kube: - - '1.28' - - '1.27' - - '1.24' + kube: ['1.28', '1.27', '1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 5.46.2 - images: - - ghcr.io/dexidp/dex:v2.37.0 - - public.ecr.aws/docker/library/redis:7.0.11-alpine - - quay.io/argoproj/argocd:v2.8.3 + images: ['ghcr.io/dexidp/dex:v2.37.0', 'public.ecr.aws/docker/library/redis:7.0.11-alpine', + 'quay.io/argoproj/argocd:v2.8.3'] eolAt: '2024-05-07' name: argo-cd - icon: https://avatars.githubusercontent.com/u/30269780?s=200&v=4 @@ -35163,1411 +25985,1018 @@ addons: chart_name: argo-workflows versions: - version: 4.1.2 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - MySQL persistence config now correctly applies driver-level options, fixing - previously ignored settings. - - Several dependency bumps address security fixes (fasthttp, cel-go, moby/go-archive). - - 'Controller and sync-lock behavior improved: better handling of UID changes, - transient lock errors, and shutdown/termination cases.' - - Server SSO session tokens now use symmetric encryption. - - Artifact staging behavior corrected to re-enter workingDir after init-less - input staging. - - OpenTelemetry process owner detection is skipped to avoid issues in some environments. + features: ['MySQL persistence config now correctly applies driver-level options, + fixing previously ignored settings.', 'Several dependency bumps address + security fixes (fasthttp, cel-go, moby/go-archive).', 'Controller and sync-lock + behavior improved: better handling of UID changes, transient lock errors, + and shutdown/termination cases.', Server SSO session tokens now use symmetric + encryption., Artifact staging behavior corrected to re-enter workingDir + after init-less input staging., OpenTelemetry process owner detection is + skipped to avoid issues in some environments.] breaking_changes: [] chart_version: 2.0.4 - images: - - quay.io/argoproj/argo-workflows-crdinstaller:v4.1.2 - - quay.io/argoproj/argocli:v4.1.2 - - quay.io/argoproj/workflow-controller:v4.1.2 + images: ['quay.io/argoproj/argo-workflows-crdinstaller:v4.1.2', 'quay.io/argoproj/argocli:v4.1.2', + 'quay.io/argoproj/workflow-controller:v4.1.2'] - version: 4.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided are generic \u201CQuick Start\u201D pages and do not\ - \ enumerate new features between v4.0.2 and v4.1.0." - - 'v4.1.0 adds a new quick-start manifest asset: `quick-start-telemetry.yaml` - (indicates telemetry quickstart support/docs were added).' - breaking_changes: - - No breaking changes are listed in the provided notes; they refer readers to - the upstream upgrading guide and changelog for breaking changes/known issues. + features: ["Release notes provided are generic \u201CQuick Start\u201D pages\ + \ and do not enumerate new features between v4.0.2 and v4.1.0.", 'v4.1.0 + adds a new quick-start manifest asset: `quick-start-telemetry.yaml` (indicates + telemetry quickstart support/docs were added).'] + breaking_changes: [No breaking changes are listed in the provided notes; they + refer readers to the upstream upgrading guide and changelog for breaking + changes/known issues.] chart_version: 2.0.0 - images: - - quay.io/argoproj/argo-workflows-crdinstaller:v4.1.0 - - quay.io/argoproj/argocli:v4.1.0 - - quay.io/argoproj/workflow-controller:v4.1.0 + images: ['quay.io/argoproj/argo-workflows-crdinstaller:v4.1.0', 'quay.io/argoproj/argocli:v4.1.0', + 'quay.io/argoproj/workflow-controller:v4.1.0'] - version: 4.0.2 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v4.0.2 release notes provided here are a generic template (install instructions/assets) - and do not list specific new features; consult the upstream changelog/blog - for actual feature highlights between v3.7.0 and v4.0.x. - breaking_changes: - - Breaking changes for the v4 major upgrade are not enumerated in the provided - notes; you must review the Argo Workflows upgrading guide and CHANGELOG for - v4.0.0+ before upgrading from v3.7.0. + features: [v4.0.2 release notes provided here are a generic template (install + instructions/assets) and do not list specific new features; consult the + upstream changelog/blog for actual feature highlights between v3.7.0 and + v4.0.x.] + breaking_changes: [Breaking changes for the v4 major upgrade are not enumerated + in the provided notes; you must review the Argo Workflows upgrading guide + and CHANGELOG for v4.0.0+ before upgrading from v3.7.0.] chart_version: 1.0.4 - images: - - quay.io/argoproj/argocli:v4.0.2 - - quay.io/argoproj/workflow-controller:v4.0.2 - - registry.k8s.io/kubectl:v1.35.3 + images: ['quay.io/argoproj/argocli:v4.0.2', 'quay.io/argoproj/workflow-controller:v4.0.2', + 'registry.k8s.io/kubectl:v1.35.3'] - version: 3.7.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are generic and mostly cover installation/asset links; - no explicit new features listed for v3.7.0 vs v3.6.5 in the provided text. - - CLI and controller/server install artifacts are updated to v3.7.0 (new binaries, - install.yaml). - breaking_changes: - - No breaking changes are listed in the provided release notes; you must consult - the upstream changelog and the official upgrading guide for v3.7.0 to identify - any required manifest/CRD/API changes. + features: [Release notes provided are generic and mostly cover installation/asset + links; no explicit new features listed for v3.7.0 vs v3.6.5 in the provided + text., 'CLI and controller/server install artifacts are updated to v3.7.0 + (new binaries, install.yaml).'] + breaking_changes: [No breaking changes are listed in the provided release notes; + you must consult the upstream changelog and the official upgrading guide + for v3.7.0 to identify any required manifest/CRD/API changes.] chart_version: 0.45.21 - images: - - quay.io/argoproj/argocli:v3.7.0 - - quay.io/argoproj/workflow-controller:v3.7.0 + images: ['quay.io/argoproj/argocli:v3.7.0', 'quay.io/argoproj/workflow-controller:v3.7.0'] - version: 3.6.5 - kube: - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.31', '1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v3.6.5 is the recommended patch level versus v3.6.3 (which is explicitly flagged - as 'Do not use'; prefer v3.6.4 or later). - breaking_changes: - - v3.6.3 is marked as a known-bad release; treat upgrading away from it as urgent - and avoid deploying/rolling back to it. + features: [v3.6.5 is the recommended patch level versus v3.6.3 (which is explicitly + flagged as 'Do not use'; prefer v3.6.4 or later).] + breaking_changes: [v3.6.3 is marked as a known-bad release; treat upgrading + away from it as urgent and avoid deploying/rolling back to it.] chart_version: 0.45.12 - images: - - quay.io/argoproj/argocli:v3.6.5 - - quay.io/argoproj/workflow-controller:v3.6.5 + images: ['quay.io/argoproj/argocli:v3.6.5', 'quay.io/argoproj/workflow-controller:v3.6.5'] - version: 3.6.3 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "No Helm chart changelog was provided in the notes you shared (only upstream\ - \ application GitHub release stubs for v3.6.0 and v3.6.3). Treat this as an\ - \ app version bump only; verify the chart version mapping and read the chart\u2019\ - s own CHANGELOG/values schema before upgrading." - - "Upstream release v3.6.3 is explicitly flagged: \u201CDo not use this version,\ - \ use v3.6.4 instead.\u201D Plan to skip 3.6.3 and target 3.6.4 (or later\ - \ 3.6.x) to avoid whatever issue prompted the warning." - - Install manifests (install.yaml) exist for both versions and are similar in - size; no concrete functional deltas are listed in the provided notes. Expect - mostly patch-level fixes between 3.6.0 and 3.6.3, but you must consult the - detailed changelog/upgrading guide for specifics. - features: - - No specific new features were listed in the provided release notes excerpts - for v3.6.0 or v3.6.3 (they point to the blog/changelog instead). - breaking_changes: - - No breaking changes were enumerated in the provided excerpts; however, v3.6.3 - has a known issue severe enough that upstream recommends not using it (use - v3.6.4 instead). + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["No Helm chart changelog was provided in the notes you shared\ + \ (only upstream application GitHub release stubs for v3.6.0 and v3.6.3).\ + \ Treat this as an app version bump only; verify the chart version mapping\ + \ and read the chart\u2019s own CHANGELOG/values schema before upgrading.", + "Upstream release v3.6.3 is explicitly flagged: \u201CDo not use this version,\ + \ use v3.6.4 instead.\u201D Plan to skip 3.6.3 and target 3.6.4 (or later\ + \ 3.6.x) to avoid whatever issue prompted the warning.", 'Install manifests + (install.yaml) exist for both versions and are similar in size; no concrete + functional deltas are listed in the provided notes. Expect mostly patch-level + fixes between 3.6.0 and 3.6.3, but you must consult the detailed changelog/upgrading + guide for specifics.'] + features: [No specific new features were listed in the provided release notes + excerpts for v3.6.0 or v3.6.3 (they point to the blog/changelog instead).] + breaking_changes: ['No breaking changes were enumerated in the provided excerpts; + however, v3.6.3 has a known issue severe enough that upstream recommends + not using it (use v3.6.4 instead).'] chart_version: 0.45.5 - images: - - quay.io/argoproj/argocli:v3.6.3 - - quay.io/argoproj/workflow-controller:v3.6.3 + images: ['quay.io/argoproj/argocli:v3.6.3', 'quay.io/argoproj/workflow-controller:v3.6.3'] - version: 3.6.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - The provided release notes for v3.6.0 vs v3.5.11 do not include a detailed - changelog; they mainly cover installation and assets, so no concrete feature - list can be derived from this text alone. - breaking_changes: - - No explicit breaking changes are listed in the provided notes; the release - notes only point to the upgrading guide and main changelog for details. + features: ['The provided release notes for v3.6.0 vs v3.5.11 do not include + a detailed changelog; they mainly cover installation and assets, so no concrete + feature list can be derived from this text alone.'] + breaking_changes: [No explicit breaking changes are listed in the provided notes; + the release notes only point to the upgrading guide and main changelog for + details.] chart_version: 0.45.0 - images: - - quay.io/argoproj/argocli:v3.6.0 - - quay.io/argoproj/workflow-controller:v3.6.0 + images: ['quay.io/argoproj/argocli:v3.6.0', 'quay.io/argoproj/workflow-controller:v3.6.0'] - version: 3.5.11 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes are listed in the provided release note excerpts; both - pages primarily contain installation instructions and links to the full changelog/upgrading - guide. - breaking_changes: - - No breaking changes are listed in the provided release note excerpts; you - must consult the Argo Workflows 3.5 upgrading guide and the project CHANGELOG - for any breaking changes between v3.5.6 and v3.5.11. + features: [No functional changes are listed in the provided release note excerpts; + both pages primarily contain installation instructions and links to the + full changelog/upgrading guide.] + breaking_changes: [No breaking changes are listed in the provided release note + excerpts; you must consult the Argo Workflows 3.5 upgrading guide and the + project CHANGELOG for any breaking changes between v3.5.6 and v3.5.11.] chart_version: 0.42.5 - images: - - quay.io/argoproj/argocli:v3.5.11 - - quay.io/argoproj/workflow-controller:v3.5.11 + images: ['quay.io/argoproj/argocli:v3.5.11', 'quay.io/argoproj/workflow-controller:v3.5.11'] - version: 3.5.6 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided are generic (installation instructions, links) and\ - \ do not enumerate specific v3.5.4\u2013v3.5.6 features/fixes; treat this\ - \ as a patch-level upgrade within 3.5.x with expected bugfixes/security updates." - - Newer CLI/server/controller artifacts are available at v3.5.6; ensure any - pinned CLI downloads and image tags are updated accordingly. - breaking_changes: - - "No breaking changes are called out in the provided release notes; however,\ - \ you should still review the Argo Workflows 3.5 upgrading guide and the upstream\ - \ CHANGELOG for 3.5.4\u20133.5.6 to confirm there are no behavior changes\ - \ affecting your workflows." + features: ["Release notes provided are generic (installation instructions, links)\ + \ and do not enumerate specific v3.5.4\u2013v3.5.6 features/fixes; treat\ + \ this as a patch-level upgrade within 3.5.x with expected bugfixes/security\ + \ updates.", Newer CLI/server/controller artifacts are available at v3.5.6; + ensure any pinned CLI downloads and image tags are updated accordingly.] + breaking_changes: ["No breaking changes are called out in the provided release\ + \ notes; however, you should still review the Argo Workflows 3.5 upgrading\ + \ guide and the upstream CHANGELOG for 3.5.4\u20133.5.6 to confirm there\ + \ are no behavior changes affecting your workflows."] chart_version: 0.41.6 - images: - - quay.io/argoproj/argocli:v3.5.6 - - quay.io/argoproj/workflow-controller:v3.5.6 + images: ['quay.io/argoproj/argocli:v3.5.6', 'quay.io/argoproj/workflow-controller:v3.5.6'] - version: 3.5.3 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No clear feature list provided in the pasted notes; v3.5.3 notes shown are - generic pointers to blog/changelog/upgrading guide and install instructions. - - "Upgrade primarily appears to be a patch release (3.5.0 \u2192 3.5.3) with\ - \ unspecified fixes; consult upstream CHANGELOG for concrete items." - breaking_changes: - - None called out in the provided v3.5.3 release snippet; treat as low-risk - but still verify against the 3.5 upgrading guide and CHANGELOG for any late-breaking - notes. + features: [No clear feature list provided in the pasted notes; v3.5.3 notes + shown are generic pointers to blog/changelog/upgrading guide and install + instructions., "Upgrade primarily appears to be a patch release (3.5.0 \u2192\ + \ 3.5.3) with unspecified fixes; consult upstream CHANGELOG for concrete\ + \ items."] + breaking_changes: [None called out in the provided v3.5.3 release snippet; treat + as low-risk but still verify against the 3.5 upgrading guide and CHANGELOG + for any late-breaking notes.] chart_version: 0.40.5 - images: - - quay.io/argoproj/argocli:v3.5.3 - - quay.io/argoproj/workflow-controller:v3.5.3 + images: ['quay.io/argoproj/argocli:v3.5.3', 'quay.io/argoproj/workflow-controller:v3.5.3'] - version: 3.5.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v3.5.0 release notes provided here mostly link out to a 'What's New' blog - and changelog; no concrete feature list is included in the snippet you provided. - breaking_changes: - - No breaking changes are listed in the provided release-note snippets; they - point to the upgrading guide/installation guide for details, so you must review - that guide for 3.5.0-specific breaking changes before upgrading. + features: [v3.5.0 release notes provided here mostly link out to a 'What's New' + blog and changelog; no concrete feature list is included in the snippet + you provided.] + breaking_changes: ['No breaking changes are listed in the provided release-note + snippets; they point to the upgrading guide/installation guide for details, + so you must review that guide for 3.5.0-specific breaking changes before + upgrading.'] chart_version: 0.37.1 - images: - - quay.io/argoproj/argocli:v3.5.0 - - quay.io/argoproj/workflow-controller:v3.5.0 + images: ['quay.io/argoproj/argocli:v3.5.0', 'quay.io/argoproj/workflow-controller:v3.5.0'] - version: 3.4.11 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Patch-level update within the v3.4.x line; release notes provided here do - not enumerate specific feature changes between v3.4.0 and v3.4.11. - - Update includes newer controller/server images and a newer CLI binary matching - v3.4.11. - breaking_changes: - - No breaking changes are listed in the provided notes; you should still review - the official Argo Workflows upgrading guide for any v3.4.x-specific caveats. + features: [Patch-level update within the v3.4.x line; release notes provided + here do not enumerate specific feature changes between v3.4.0 and v3.4.11., + Update includes newer controller/server images and a newer CLI binary matching + v3.4.11.] + breaking_changes: [No breaking changes are listed in the provided notes; you + should still review the official Argo Workflows upgrading guide for any + v3.4.x-specific caveats.] chart_version: 0.34.0 - images: - - quay.io/argoproj/argocli:v3.4.11 - - quay.io/argoproj/workflow-controller:v3.4.11 + images: ['quay.io/argoproj/argocli:v3.4.11', 'quay.io/argoproj/workflow-controller:v3.4.11'] - version: 3.4.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v3.4.0 is a minor version bump over v3.3.2; the provided release notes do - not include a detailed feature list beyond pointing to the upstream changelog/blog. - - New platform binaries/assets are published for v3.4.0 (including darwin arm64), - but this is primarily operational packaging info rather than a runtime feature. - breaking_changes: - - No breaking changes are enumerated in the provided notes; they are referenced - as being documented in the installation guide/upgrading docs, so you should - review those before upgrading. + features: [v3.4.0 is a minor version bump over v3.3.2; the provided release + notes do not include a detailed feature list beyond pointing to the upstream + changelog/blog., 'New platform binaries/assets are published for v3.4.0 + (including darwin arm64), but this is primarily operational packaging info + rather than a runtime feature.'] + breaking_changes: ['No breaking changes are enumerated in the provided notes; + they are referenced as being documented in the installation guide/upgrading + docs, so you should review those before upgrading.'] chart_version: 0.20.0 - images: - - quay.io/argoproj/argocli:v3.4.0 - - quay.io/argoproj/workflow-controller:v3.4.0 + images: ['quay.io/argoproj/argocli:v3.4.0', 'quay.io/argoproj/workflow-controller:v3.4.0'] - version: 3.3.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are primarily quick-start/installation instructions - for v3.2.0 and v3.3.2; no concrete feature list is included in the pasted - notes. Consult the Argo Workflows CHANGELOG.md between v3.2.0 and v3.3.2 for - actual feature additions. - - v3.3.2 adds an SBOM asset (sbom.tar.gz) to release artifacts, which may help - with supply-chain/security auditing. - breaking_changes: - - No breaking changes are listed in the pasted release notes. You must review - docs/upgrading.md and the CHANGELOG.md between v3.2.0 and v3.3.2 for any behavioral - or API changes before upgrading. + features: [Release notes provided are primarily quick-start/installation instructions + for v3.2.0 and v3.3.2; no concrete feature list is included in the pasted + notes. Consult the Argo Workflows CHANGELOG.md between v3.2.0 and v3.3.2 + for actual feature additions., 'v3.3.2 adds an SBOM asset (sbom.tar.gz) + to release artifacts, which may help with supply-chain/security auditing.'] + breaking_changes: [No breaking changes are listed in the pasted release notes. + You must review docs/upgrading.md and the CHANGELOG.md between v3.2.0 and + v3.3.2 for any behavioral or API changes before upgrading.] chart_version: 0.15.1 - images: - - quay.io/argoproj/argocli:v3.3.2 - - quay.io/argoproj/workflow-controller:v3.3.2 + images: ['quay.io/argoproj/argocli:v3.3.2', 'quay.io/argoproj/workflow-controller:v3.3.2'] - version: 3.2.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details are included in the provided v3.2.0 release notes excerpt - beyond links to the blog/CHANGELOG; treat this as a routine minor upgrade - pending review of the full CHANGELOG. - breaking_changes: - - "No breaking changes are listed in the provided notes; however, v3.2.0 points\ - \ to the upstream upgrading guide\u2014review it for any required manifest/CRD\ - \ changes before applying the new install.yaml/Helm chart." + features: [No feature details are included in the provided v3.2.0 release notes + excerpt beyond links to the blog/CHANGELOG; treat this as a routine minor + upgrade pending review of the full CHANGELOG.] + breaking_changes: ["No breaking changes are listed in the provided notes; however,\ + \ v3.2.0 points to the upstream upgrading guide\u2014review it for any required\ + \ manifest/CRD changes before applying the new install.yaml/Helm chart."] chart_version: 0.8.2 - images: - - quay.io/argoproj/argocli:v3.2.0 - - quay.io/argoproj/workflow-controller:v3.2.0 + images: ['quay.io/argoproj/argocli:v3.2.0', 'quay.io/argoproj/workflow-controller:v3.2.0'] - version: 3.1.5 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "v3.1.5 release notes provided don\u2019t list specific new features beyond\ - \ standard installation/CLI download instructions." - - v3.0.7 introduced controller probes/health improvements (liveness probe; readiness - timeout increased to 30s; metrics/debug listen on :6060) and several UI/controller - bug fixes. - breaking_changes: - - 'v3.0.7: Argo Server enables TLS by default when a key is available; can be - disabled with `--secure=false`. Ingress may need backend-protocol annotations - set to HTTPS.' - - 'Known issues noted in v3.0.7: UI may try to list workflows across namespaces; - OpenShift may not support coordination API needed for leader election; log - archiving reported broken.' + features: ["v3.1.5 release notes provided don\u2019t list specific new features\ + \ beyond standard installation/CLI download instructions.", 'v3.0.7 introduced + controller probes/health improvements (liveness probe; readiness timeout + increased to 30s; metrics/debug listen on :6060) and several UI/controller + bug fixes.'] + breaking_changes: ['v3.0.7: Argo Server enables TLS by default when a key is + available; can be disabled with `--secure=false`. Ingress may need backend-protocol + annotations set to HTTPS.', 'Known issues noted in v3.0.7: UI may try to + list workflows across namespaces; OpenShift may not support coordination + API needed for leader election; log archiving reported broken.'] chart_version: 0.4.1 - images: - - quay.io/argoproj/argocli:v3.1.5 - - quay.io/argoproj/workflow-controller:v3.1.5 + images: ['quay.io/argoproj/argocli:v3.1.5', 'quay.io/argoproj/workflow-controller:v3.1.5'] - version: 3.0.7 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 0.3.0 - images: - - quay.io/argoproj/argocli:v3.0.7 - - quay.io/argoproj/workflow-controller:v3.0.7 - name: argo-workflows + images: ['quay.io/argoproj/argocli:v3.0.7', 'quay.io/argoproj/workflow-controller:v3.0.7'] - icon: https://avatars.githubusercontent.com/u/16866914 git_url: https://github.com/vectordotdev/vector/ release_url: https://github.com/vectordotdev/vector/releases/tag/v{vsn} helm_repository_url: https://helm.vector.dev/ versions: - version: 0.58.0 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector 0.58.0 is a new upstream release (published 2026-08-26) following 0.57.0 - (published 2026-07-14). - - No concrete feature details are present in the provided notes beyond links - to full release notes. - breaking_changes: - - 0.57.0 is described as a security-focused release that includes breaking changes, - with options to restore previous behavior (details not included in the excerpt). - - No breaking-change details for 0.58.0 are included in the provided excerpt; - verify via the linked 0.58.0 release notes before upgrading. + features: [Vector 0.58.0 is a new upstream release (published 2026-08-26) following + 0.57.0 (published 2026-07-14)., No concrete feature details are present + in the provided notes beyond links to full release notes.] + breaking_changes: ['0.57.0 is described as a security-focused release that includes + breaking changes, with options to restore previous behavior (details not + included in the excerpt).', No breaking-change details for 0.58.0 are included + in the provided excerpt; verify via the linked 0.58.0 release notes before + upgrading.] chart_version: 0.58.0 - images: - - docker.io/timberio/vector:0.58.0-distroless-libc + images: ['docker.io/timberio/vector:0.58.0-distroless-libc'] - version: 0.57.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v0.57.0 is described as a security-focused release with changes intended to - improve security posture. - - The release notes indicate there are opt-in/compatibility mechanisms to restore - previous behavior after the security changes. - breaking_changes: - - v0.57.0 includes breaking changes related to the security-focused updates; - users may need to adjust configuration to preserve prior behavior (exact items - not provided in the excerpt). + features: [v0.57.0 is described as a security-focused release with changes intended + to improve security posture., The release notes indicate there are opt-in/compatibility + mechanisms to restore previous behavior after the security changes.] + breaking_changes: [v0.57.0 includes breaking changes related to the security-focused + updates; users may need to adjust configuration to preserve prior behavior + (exact items not provided in the excerpt).] chart_version: 0.57.0 - images: - - docker.io/timberio/vector:0.57.0-distroless-libc + images: ['docker.io/timberio/vector:0.57.0-distroless-libc'] - version: 0.56.0 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - New `databricks_zerobus` sink for streaming logs into Databricks Unity Catalog - via Zerobus, including OAuth2 auth, schema fetching, and protobuf batching. - - New `delay` transform to hold events for a fixed duration or conditionally - (including VRL-based conditions). - - HTTP-based sinks using shared retry helpers now support a `retry_strategy` - option to choose which HTTP status codes should be retried (with an updated - `http` sink example). - - '`vector` sink adds `zstd` compression alongside `gzip` for improved Vector-to-Vector - throughput and efficiency.' - - 'Major enhancements to `tag_cardinality_limit`: per-tag limits, per-metric - tracking isolation, global tracked-key cap, and ability to opt metrics out - of tracking.' - - '`aws_s3` sink Parquet encoding now ships enabled in official binaries by - default (no special build required).' - - Fixes a CPU regression affecting sinks that use metric normalization (e.g., - `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`). - - Restores install support for RHEL/Rocky/Alma/CentOS Stream 8 that was broken - in 0.55.0 due to a glibc requirement bump. - - Unit tests gain optional `expected_event_count` on outputs to assert how many - events a transform emits. - breaking_changes: - - '`greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x; - GreptimeDB v0.x users must upgrade GreptimeDB before upgrading Vector.' + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['New `databricks_zerobus` sink for streaming logs into Databricks + Unity Catalog via Zerobus, including OAuth2 auth, schema fetching, and protobuf + batching.', New `delay` transform to hold events for a fixed duration or + conditionally (including VRL-based conditions)., HTTP-based sinks using + shared retry helpers now support a `retry_strategy` option to choose which + HTTP status codes should be retried (with an updated `http` sink example)., + '`vector` sink adds `zstd` compression alongside `gzip` for improved Vector-to-Vector + throughput and efficiency.', 'Major enhancements to `tag_cardinality_limit`: + per-tag limits, per-metric tracking isolation, global tracked-key cap, and + ability to opt metrics out of tracking.', '`aws_s3` sink Parquet encoding + now ships enabled in official binaries by default (no special build required).', + 'Fixes a CPU regression affecting sinks that use metric normalization (e.g., + `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`).', Restores + install support for RHEL/Rocky/Alma/CentOS Stream 8 that was broken in 0.55.0 + due to a glibc requirement bump., Unit tests gain optional `expected_event_count` + on outputs to assert how many events a transform emits.] + breaking_changes: ['`greptimedb_metrics` and `greptimedb_logs` sinks now require + GreptimeDB v1.x; GreptimeDB v0.x users must upgrade GreptimeDB before upgrading + Vector.'] chart_version: 0.56.0 - images: - - docker.io/timberio/vector:0.56.0-distroless-libc + images: ['docker.io/timberio/vector:0.56.0-distroless-libc'] - version: 0.55.0 - kube: - - '1.36' - - '1.35' - - '1.34' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - New `windows_event_log` source for collecting Windows Event Log channels via - the native Windows Event Log API, including pull-mode subscriptions, bookmark-based - checkpointing, and configurable field filtering. - - '`aws_s3` sink supports Apache Parquet batch encoding, with auto-generated - or supplied schema and configurable compression (Snappy/ZSTD/GZIP/LZ4/none).' - - '`azure_blob` sink restores first-class Azure authentication support (Azure - CLI, Managed Identity, Workload Identity, and Managed Identity-based Client - Assertion).' - - '`datadog_metrics` sink defaults to Series v2 endpoint (`/api/v2/series`) - and uses `zstd` compression for Series v2 and Sketches; includes `series_api_version` - option to switch back to v1.' - - '`vector top` output accounting is corrected for multi-output components and - it now reports Memory Used as disabled when allocation tracing is not enabled.' - - 'Improved internal metrics: new source-send latency distributions, more accurate - transform utilization (excludes downstream waiting), and fixes to buffer utilization - tracking; also fixes CPU regression in `file` and `kubernetes_logs` sources - introduced in 0.50.0.' - breaking_changes: - - Observability API has moved from GraphQL to gRPC; clients and tooling that - used `/graphql` or `/playground` (including `vector top`/`vector tap` integrations) - must be updated. `GET /health` is unchanged for Kubernetes probes. - - Top-level `headers` option on `http` and `opentelemetry` sinks has been removed; - configurations must be adjusted accordingly. - - '`azure_logs_ingestion` sink using Client Secret credentials now requires - explicitly setting `azure_credential_kind`.' + kube: ['1.36', '1.35', '1.34'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['New `windows_event_log` source for collecting Windows Event Log + channels via the native Windows Event Log API, including pull-mode subscriptions, + bookmark-based checkpointing, and configurable field filtering.', '`aws_s3` + sink supports Apache Parquet batch encoding, with auto-generated or supplied + schema and configurable compression (Snappy/ZSTD/GZIP/LZ4/none).', '`azure_blob` + sink restores first-class Azure authentication support (Azure CLI, Managed + Identity, Workload Identity, and Managed Identity-based Client Assertion).', + '`datadog_metrics` sink defaults to Series v2 endpoint (`/api/v2/series`) + and uses `zstd` compression for Series v2 and Sketches; includes `series_api_version` + option to switch back to v1.', '`vector top` output accounting is corrected + for multi-output components and it now reports Memory Used as disabled when + allocation tracing is not enabled.', 'Improved internal metrics: new source-send + latency distributions, more accurate transform utilization (excludes downstream + waiting), and fixes to buffer utilization tracking; also fixes CPU regression + in `file` and `kubernetes_logs` sources introduced in 0.50.0.'] + breaking_changes: [Observability API has moved from GraphQL to gRPC; clients + and tooling that used `/graphql` or `/playground` (including `vector top`/`vector + tap` integrations) must be updated. `GET /health` is unchanged for Kubernetes + probes., Top-level `headers` option on `http` and `opentelemetry` sinks + has been removed; configurations must be adjusted accordingly., '`azure_logs_ingestion` + sink using Client Secret credentials now requires explicitly setting `azure_credential_kind`.'] chart_version: 0.52.0 - images: - - docker.io/timberio/vector:0.55.0-distroless-libc + images: ['docker.io/timberio/vector:0.55.0-distroless-libc'] - version: 0.54.0 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Enhanced `vector top` TUI with keybinds for scrolling, sorting, and filtering - (press `?` for help). - - '`datadog_logs` sink now uses `zstd` compression by default, improving network - efficiency and throughput.' - - 'New internal metrics: `component_latency_seconds` histogram and `component_latency_mean_seconds` - gauge to measure time events spend inside each component.' - - Syslog encoding transform got RFC-compliance and safety improvements, including - better handling of structured data (scalars/nested objects/arrays) and UTF-8 - safety. - - New `azure_logs_ingestion` sink for Azure Monitor Logs Ingestion API; legacy - `azure_monitor_logs` sink is deprecated ahead of the Data Collector API retirement - (currently Sept 2026). - breaking_changes: - - '`datadog_logs` sink default compression changed from none to `zstd`; set - `compression` explicitly if you need the previous behavior (e.g., `none`).' + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Enhanced `vector top` TUI with keybinds for scrolling, sorting, + and filtering (press `?` for help).', '`datadog_logs` sink now uses `zstd` + compression by default, improving network efficiency and throughput.', 'New + internal metrics: `component_latency_seconds` histogram and `component_latency_mean_seconds` + gauge to measure time events spend inside each component.', 'Syslog encoding + transform got RFC-compliance and safety improvements, including better handling + of structured data (scalars/nested objects/arrays) and UTF-8 safety.', New + `azure_logs_ingestion` sink for Azure Monitor Logs Ingestion API; legacy + `azure_monitor_logs` sink is deprecated ahead of the Data Collector API + retirement (currently Sept 2026).] + breaking_changes: ['`datadog_logs` sink default compression changed from none + to `zstd`; set `compression` explicitly if you need the previous behavior + (e.g., `none`).'] chart_version: 0.51.0 - images: - - docker.io/timberio/vector:0.54.0-distroless-libc + images: ['docker.io/timberio/vector:0.54.0-distroless-libc'] - version: 0.53.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - VRL gained functions to read internal Vector metrics (`get_vector_metric`, - `find_vector_metrics`, `aggregate_vector_metrics`), backed by snapshots refreshed - every `metrics_storage_refresh_period`. - - '`clickhouse` sink added an `arrow_stream` format option using Apache Arrow - IPC for higher throughput and smaller payloads than JSON.' - - New `doris` sink added to ship log data to Apache Doris via the Stream Load - API. - - New `syslog` codec added for encoding events as Syslog; supports RFC5424 and - RFC3164. - - 'New moving-mean (EWMA) gauges for buffer utilization added: `source_buffer_utilization_mean` - and `transform_buffer_utilization_mean`, complementing the existing instant - utilization metrics.' + features: ['VRL gained functions to read internal Vector metrics (`get_vector_metric`, + `find_vector_metrics`, `aggregate_vector_metrics`), backed by snapshots + refreshed every `metrics_storage_refresh_period`.', '`clickhouse` sink added + an `arrow_stream` format option using Apache Arrow IPC for higher throughput + and smaller payloads than JSON.', New `doris` sink added to ship log data + to Apache Doris via the Stream Load API., New `syslog` codec added for encoding + events as Syslog; supports RFC5424 and RFC3164., 'New moving-mean (EWMA) + gauges for buffer utilization added: `source_buffer_utilization_mean` and + `transform_buffer_utilization_mean`, complementing the existing instant + utilization metrics.'] breaking_changes: [] chart_version: 0.50.0 - images: - - timberio/vector:0.53.0-distroless-libc + images: ['timberio/vector:0.53.0-distroless-libc'] - version: 0.52.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Added new internal metrics for source/transform buffer utilization (capacity, - usage, and historical levels) to improve observability during backpressure/buffering - scenarios. - - Introduced a new `trace_to_log` transform to convert traces into log events. - - Blackhole sink now supports end-to-end acknowledgements, enabling ack-based - delivery semantics even when discarding output. - - GELF decoder gained a `validation` mode (`strict` default, `relaxed` to accept - non-compliant GELF senders). - - '`docker_logs` source now retries Docker daemon communication failures using - exponential backoff, improving resilience.' + features: ['Added new internal metrics for source/transform buffer utilization + (capacity, usage, and historical levels) to improve observability during + backpressure/buffering scenarios.', Introduced a new `trace_to_log` transform + to convert traces into log events., 'Blackhole sink now supports end-to-end + acknowledgements, enabling ack-based delivery semantics even when discarding + output.', 'GELF decoder gained a `validation` mode (`strict` default, `relaxed` + to accept non-compliant GELF senders).', '`docker_logs` source now retries + Docker daemon communication failures using exponential backoff, improving + resilience.'] breaking_changes: [] chart_version: 0.49.0 - images: - - timberio/vector:0.52.0-distroless-libc + images: ['timberio/vector:0.52.0-distroless-libc'] - version: 0.51.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - New `otlp` codec for bidirectional conversion between Vector events and OTLP, - improving interoperability with OpenTelemetry collectors/instrumentation. - - 'Improved internal telemetry/metrics correctness: fixes negative utilization - metrics and buffer counter underflows.' - - Memory enrichment tables now support an `expired` output to export expired - cache items; enrichment table outputs are also visible via `vector tap`. - - "(From 0.50.0 context) The `opentelemetry` source can decode standard OTLP\ - \ for logs/metrics/traces, simplifying OTEL\u2192Vector\u2192OTEL pipelines." - breaking_changes: - - Upstream release notes for 0.51.0 mention breaking changes exist, but the - provided excerpt does not list them; review the full changelog before upgrading. - - "Note from 0.50.0: `azure_blob` sink now requires `connection_string` authentication\ - \ (relevant if you\u2019re coming from <0.50.0)." - - 0.51.0 was superseded and maintainers recommend upgrading to 0.51.1 instead - of 0.51.0. + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['New `otlp` codec for bidirectional conversion between Vector events + and OTLP, improving interoperability with OpenTelemetry collectors/instrumentation.', + 'Improved internal telemetry/metrics correctness: fixes negative utilization + metrics and buffer counter underflows.', Memory enrichment tables now support + an `expired` output to export expired cache items; enrichment table outputs + are also visible via `vector tap`., "(From 0.50.0 context) The `opentelemetry`\ + \ source can decode standard OTLP for logs/metrics/traces, simplifying OTEL\u2192\ + Vector\u2192OTEL pipelines."] + breaking_changes: ['Upstream release notes for 0.51.0 mention breaking changes + exist, but the provided excerpt does not list them; review the full changelog + before upgrading.', "Note from 0.50.0: `azure_blob` sink now requires `connection_string`\ + \ authentication (relevant if you\u2019re coming from <0.50.0).", 0.51.0 + was superseded and maintainers recommend upgrading to 0.51.1 instead of + 0.51.0.] chart_version: 0.47.0 - images: - - timberio/vector:0.51.0-distroless-libc + images: ['timberio/vector:0.51.0-distroless-libc'] - version: 0.50.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - "OpenTelemetry source can now decode standard OTLP for logs, metrics, and\ - \ traces, reducing the need for remap transforms in OTEL\u2192Vector\u2192\ - OTEL or forwarding pipelines." - - Added `varint_length_delimited` framing for compatibility with protobuf streaming - tools/implementations such as ClickHouse. - - New `incremental_to_absolute` transform to convert incremental metrics into - absolute values, helpful when data loss is possible or for historical recording. - - New `okta` source to ingest Okta System Log events via the Okta Management - API. - - Exec secrets option now supports protocol version v1.1 (compatible with Datadog - Secret Backend). - breaking_changes: - - '`azure_blob` sink authentication changed: it now requires `connection_string` - and this is currently the only supported auth method; existing configs using - other auth options must be updated.' + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ["OpenTelemetry source can now decode standard OTLP for logs, metrics,\ + \ and traces, reducing the need for remap transforms in OTEL\u2192Vector\u2192\ + OTEL or forwarding pipelines.", Added `varint_length_delimited` framing + for compatibility with protobuf streaming tools/implementations such as + ClickHouse., 'New `incremental_to_absolute` transform to convert incremental + metrics into absolute values, helpful when data loss is possible or for + historical recording.', New `okta` source to ingest Okta System Log events + via the Okta Management API., Exec secrets option now supports protocol + version v1.1 (compatible with Datadog Secret Backend).] + breaking_changes: ['`azure_blob` sink authentication changed: it now requires + `connection_string` and this is currently the only supported auth method; + existing configs using other auth options must be updated.'] chart_version: 0.46.0 - images: - - timberio/vector:0.50.0-distroless-libc + images: ['timberio/vector:0.50.0-distroless-libc'] - version: 0.49.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Introduced a new `websocket` source to ingest real-time data from services - exposing WebSocket APIs. - - HTTP sink now supports templating in `uri` and `request.headers`, enabling - dynamic request construction based on event data. - - '`--watch-config` now also watches enrichment table files for changes and - reload triggers.' - - '`prometheus_remote_write` sink adds a TTL-based cache for metrics sets plus - an `expire_metrics_secs` option to prevent unbounded memory growth.' - - Fixed a race condition that could cause negative values in `vector_buffer_byte_size` - and `vector_buffer_events` gauges. - breaking_changes: - - Some VRL functions have breaking changes in v0.49.0; review and test VRL transforms/conditions - against the 0.49.0 upgrade guide before deploying. + features: [Introduced a new `websocket` source to ingest real-time data from + services exposing WebSocket APIs., 'HTTP sink now supports templating in + `uri` and `request.headers`, enabling dynamic request construction based + on event data.', '`--watch-config` now also watches enrichment table files + for changes and reload triggers.', '`prometheus_remote_write` sink adds + a TTL-based cache for metrics sets plus an `expire_metrics_secs` option + to prevent unbounded memory growth.', Fixed a race condition that could + cause negative values in `vector_buffer_byte_size` and `vector_buffer_events` + gauges.] + breaking_changes: [Some VRL functions have breaking changes in v0.49.0; review + and test VRL transforms/conditions against the 0.49.0 upgrade guide before + deploying.] chart_version: 0.45.0 - images: - - timberio/vector:0.49.0-distroless-libc + images: ['timberio/vector:0.49.0-distroless-libc'] - version: 0.48.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Release notes provided only include metadata and asset lists; no feature\ - \ list was included for v0.48.0 beyond what\u2019s on the linked page." - - Based on the provided text, there are no described new features between v0.47.0 - and v0.48.0 (features likely exist in the linked release notes). - breaking_changes: - - No breaking changes are mentioned in the provided release-note excerpts; check - the full v0.48.0 release notes link for any config/behavior changes before - upgrading. + features: ["Release notes provided only include metadata and asset lists; no\ + \ feature list was included for v0.48.0 beyond what\u2019s on the linked\ + \ page.", 'Based on the provided text, there are no described new features + between v0.47.0 and v0.48.0 (features likely exist in the linked release + notes).'] + breaking_changes: [No breaking changes are mentioned in the provided release-note + excerpts; check the full v0.48.0 release notes link for any config/behavior + changes before upgrading.] chart_version: 0.44.0 - images: - - timberio/vector:0.48.0-distroless-libc + images: ['timberio/vector:0.48.0-distroless-libc'] - version: 0.47.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided 0.47.0 notes beyond the existence - of new build artifacts. - - Release primarily indicates a version bump from 0.46.0 to 0.47.0 with updated - binaries/packages for multiple platforms. - breaking_changes: - - No breaking-change information was included in the provided release notes - excerpt (only metadata and asset lists). + features: [No feature details were included in the provided 0.47.0 notes beyond + the existence of new build artifacts., Release primarily indicates a version + bump from 0.46.0 to 0.47.0 with updated binaries/packages for multiple platforms.] + breaking_changes: [No breaking-change information was included in the provided + release notes excerpt (only metadata and asset lists).] chart_version: 0.43.0 - images: - - timberio/vector:0.47.0-distroless-libc + images: ['timberio/vector:0.47.0-distroless-libc'] - version: 0.46.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided release notes excerpt beyond - the fact this is v0.46.0 (the excerpt only lists assets/metadata). - breaking_changes: - - No breaking changes were listed in the provided release notes excerpt; must - review the actual v0.46.0 and v0.45.0 release pages/changelog for breaking/config - changes before upgrading. + features: [No feature details were included in the provided release notes excerpt + beyond the fact this is v0.46.0 (the excerpt only lists assets/metadata).] + breaking_changes: [No breaking changes were listed in the provided release notes + excerpt; must review the actual v0.46.0 and v0.45.0 release pages/changelog + for breaking/config changes before upgrading.] chart_version: 0.42.0 - images: - - timberio/vector:0.46.0-distroless-libc + images: ['timberio/vector:0.46.0-distroless-libc'] - version: 0.45.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are metadata-only (assets list, dates, download counts) - for Vector 0.44.0 and 0.45.0; no functional changes, new features, fixes, - or config changes are included in the text you shared. - breaking_changes: - - 'Unknown from provided notes: the actual 0.45.0 release notes content (features/fixes/breaking - changes) is not included, so breaking changes cannot be assessed.' + features: ['Release notes provided are metadata-only (assets list, dates, download + counts) for Vector 0.44.0 and 0.45.0; no functional changes, new features, + fixes, or config changes are included in the text you shared.'] + breaking_changes: ['Unknown from provided notes: the actual 0.45.0 release notes + content (features/fixes/breaking changes) is not included, so breaking changes + cannot be assessed.'] chart_version: 0.41.0 - images: - - timberio/vector:0.45.0-distroless-libc + images: ['timberio/vector:0.45.0-distroless-libc'] - version: 0.44.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes were highlighted in the provided v0.44.0 notes (the - excerpt is essentially an assets list). - - macOS x86_64 tarball is present again in v0.44.0 assets; v0.43.0 explicitly - removed that artifact. - breaking_changes: - - If your upgrade process/download scripts relied on `vector-0.43.0-x86_64-apple-darwin.tar.gz`, - it did not exist in 0.43.0 (removed); verify artifact selection logic when - moving to 0.44.0 where it is available again. + features: [No functional changes were highlighted in the provided v0.44.0 notes + (the excerpt is essentially an assets list)., macOS x86_64 tarball is present + again in v0.44.0 assets; v0.43.0 explicitly removed that artifact.] + breaking_changes: ['If your upgrade process/download scripts relied on `vector-0.43.0-x86_64-apple-darwin.tar.gz`, + it did not exist in 0.43.0 (removed); verify artifact selection logic when + moving to 0.44.0 where it is available again.'] chart_version: 0.40.0 - images: - - timberio/vector:0.44.0-distroless-libc + images: ['timberio/vector:0.44.0-distroless-libc'] - version: 0.43.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector v0.43.0 release notes not included in the provided text beyond a packaging/asset - change; no concrete new runtime features can be extracted from what was pasted. - breaking_changes: - - 'The `vector-0.43.0-x86_64-apple-darwin.tar.gz` release asset was removed - (per #22129). If you rely on that specific macOS Intel tarball for installs - or CI artifacts, you must switch to another supported artifact (e.g., a different - archive format/target, Homebrew, or container image).' + features: [Vector v0.43.0 release notes not included in the provided text beyond + a packaging/asset change; no concrete new runtime features can be extracted + from what was pasted.] + breaking_changes: ['The `vector-0.43.0-x86_64-apple-darwin.tar.gz` release asset + was removed (per #22129). If you rely on that specific macOS Intel tarball + for installs or CI artifacts, you must switch to another supported artifact + (e.g., a different archive format/target, Homebrew, or container image).'] chart_version: 0.38.0 - images: - - timberio/vector:0.43.0-distroless-libc + images: ['timberio/vector:0.43.0-distroless-libc'] - version: 0.42.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided are limited to metadata and build artifacts; no feature - list was included, so no new features can be reliably summarized from the - supplied text. - breaking_changes: - - No breaking changes were listed in the provided notes; cannot confirm whether - any exist without the full 0.42.0 release notes content (changelog section). + features: ['Release notes provided are limited to metadata and build artifacts; + no feature list was included, so no new features can be reliably summarized + from the supplied text.'] + breaking_changes: [No breaking changes were listed in the provided notes; cannot + confirm whether any exist without the full 0.42.0 release notes content + (changelog section).] chart_version: 0.37.0 - images: - - timberio/vector:0.42.0-distroless-libc + images: ['timberio/vector:0.42.0-distroless-libc'] - version: 0.41.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes were included in the notes you provided; the v0.41.0 - entry only lists build artifacts/packaging outputs. - - The release primarily appears to be a version bump from 0.40.1 to 0.41.0 with - updated binaries for multiple platforms. - breaking_changes: - - No breaking changes were documented in the notes you provided; treat as 'unknown' - until you review the full v0.41.0 changelog on vector.dev (link included). + features: [No functional changes were included in the notes you provided; the + v0.41.0 entry only lists build artifacts/packaging outputs., The release + primarily appears to be a version bump from 0.40.1 to 0.41.0 with updated + binaries for multiple platforms.] + breaking_changes: [No breaking changes were documented in the notes you provided; + treat as 'unknown' until you review the full v0.41.0 changelog on vector.dev + (link included).] chart_version: 0.36.0 - images: - - timberio/vector:0.41.0-distroless-libc + images: ['timberio/vector:0.41.0-distroless-libc'] - version: 0.40.1 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional features are described in the provided notes for v0.40.1; the - content shown is primarily release metadata and build artifacts. - breaking_changes: - - No breaking changes are mentioned in the provided notes for v0.40.1 (or v0.40.0) - within the text supplied. + features: [No functional features are described in the provided notes for v0.40.1; + the content shown is primarily release metadata and build artifacts.] + breaking_changes: [No breaking changes are mentioned in the provided notes for + v0.40.1 (or v0.40.0) within the text supplied.] chart_version: 0.35.2 - images: - - timberio/vector:0.40.1-distroless-libc + images: ['timberio/vector:0.40.1-distroless-libc'] - version: 0.40.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided contain only metadata and build artifacts for v0.40.0 - vs v0.39.0; no functional changes are listed, so features cannot be derived - from the pasted content. - breaking_changes: - - No breaking changes are mentioned in the provided notes; verify the full v0.40.0 - release page/changelog for config schema or component changes before upgrading. + features: ['Release notes provided contain only metadata and build artifacts + for v0.40.0 vs v0.39.0; no functional changes are listed, so features cannot + be derived from the pasted content.'] + breaking_changes: [No breaking changes are mentioned in the provided notes; + verify the full v0.40.0 release page/changelog for config schema or component + changes before upgrading.] chart_version: 0.35.0 - images: - - timberio/vector:0.40.0-distroless-libc + images: ['timberio/vector:0.40.0-distroless-libc'] - version: 0.39.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were provided in the pasted release notes beyond the fact - that v0.39.0 is a newer release with updated build artifacts. - breaking_changes: - - No breaking-change details were provided in the pasted release notes; only - asset lists and metadata were included. + features: [No feature details were provided in the pasted release notes beyond + the fact that v0.39.0 is a newer release with updated build artifacts.] + breaking_changes: [No breaking-change details were provided in the pasted release + notes; only asset lists and metadata were included.] chart_version: 0.34.0 - images: - - timberio/vector:0.39.0-distroless-libc + images: ['timberio/vector:0.39.0-distroless-libc'] - version: 0.38.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - The provided notes are metadata and asset lists for v0.37.0 and v0.38.0; they - do not include the actual v0.38.0 change details, so no concrete feature summary - can be derived from this content alone. - breaking_changes: - - No breaking changes are listed in the provided text; actual breaking changes - (if any) would be in the linked Vector 0.38.0 release notes page. + features: ['The provided notes are metadata and asset lists for v0.37.0 and + v0.38.0; they do not include the actual v0.38.0 change details, so no concrete + feature summary can be derived from this content alone.'] + breaking_changes: [No breaking changes are listed in the provided text; actual + breaking changes (if any) would be in the linked Vector 0.38.0 release notes + page.] chart_version: 0.33.0 - images: - - timberio/vector:0.38.0-distroless-libc + images: ['timberio/vector:0.38.0-distroless-libc'] - version: 0.37.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector upgraded from v0.36.0 to v0.37.0 (new upstream release artifacts published - March 26, 2024). - breaking_changes: - - No breaking changes were provided in the supplied release notes; verify on - the official v0.37.0 release page/changelog before upgrading. + features: ['Vector upgraded from v0.36.0 to v0.37.0 (new upstream release artifacts + published March 26, 2024).'] + breaking_changes: [No breaking changes were provided in the supplied release + notes; verify on the official v0.37.0 release page/changelog before upgrading.] chart_version: 0.32.0 - images: - - timberio/vector:0.37.0-distroless-libc + images: ['timberio/vector:0.37.0-distroless-libc'] - version: 0.36.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were provided in the pasted notes; only metadata and build - artifacts for 0.35.0 and 0.36.0. - - The 0.36.0 release appears to include updated binaries across platforms (rpm/deb/tar/msi) - compared to 0.35.0. - breaking_changes: - - No breaking-change information was included in the provided release notes - excerpt. + features: [No feature details were provided in the pasted notes; only metadata + and build artifacts for 0.35.0 and 0.36.0., The 0.36.0 release appears to + include updated binaries across platforms (rpm/deb/tar/msi) compared to + 0.35.0.] + breaking_changes: [No breaking-change information was included in the provided + release notes excerpt.] chart_version: 0.31.0 - images: - - timberio/vector:0.36.0-distroless-libc + images: ['timberio/vector:0.36.0-distroless-libc'] - version: 0.35.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details provided in the notes you shared; only release metadata - and downloadable artifacts are listed. - breaking_changes: - - No breaking-change details provided in the notes you shared; only release - metadata and downloadable artifacts are listed. + features: [No feature details provided in the notes you shared; only release + metadata and downloadable artifacts are listed.] + breaking_changes: [No breaking-change details provided in the notes you shared; + only release metadata and downloadable artifacts are listed.] chart_version: 0.30.0 - images: - - timberio/vector:0.35.0-distroless-libc + images: ['timberio/vector:0.35.0-distroless-libc'] - version: 0.34.2 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided notes; only release metadata - and build artifacts for 0.34.0 and 0.34.2 were shown. - breaking_changes: - - No breaking-change details were included in the provided notes; only release - metadata and build artifacts were shown. + features: [No feature details were included in the provided notes; only release + metadata and build artifacts for 0.34.0 and 0.34.2 were shown.] + breaking_changes: [No breaking-change details were included in the provided + notes; only release metadata and build artifacts were shown.] chart_version: 0.29.1 - images: - - timberio/vector:0.34.2-distroless-libc + images: ['timberio/vector:0.34.2-distroless-libc'] - version: 0.34.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No specific features were included in the notes you provided (only release - metadata and asset lists). Please share the 0.34.0 release page details (highlights/changes) - to extract new features. - breaking_changes: - - No breaking changes were listed in the notes you provided. Confirm by reviewing - the 0.34.0 release notes 'Breaking changes' or 'Upgrade notes' section on - vector.dev. + features: [No specific features were included in the notes you provided (only + release metadata and asset lists). Please share the 0.34.0 release page + details (highlights/changes) to extract new features.] + breaking_changes: [No breaking changes were listed in the notes you provided. + Confirm by reviewing the 0.34.0 release notes 'Breaking changes' or 'Upgrade + notes' section on vector.dev.] chart_version: 0.28.0 - images: - - timberio/vector:0.34.0-distroless-libc + images: ['timberio/vector:0.34.0-distroless-libc'] - version: 0.33.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided release notes text beyond - links to the full 0.32.0 and 0.33.0 release pages. Based on what you pasted, - the only observable change is the bump from Vector 0.32.0 to 0.33.0 and updated - build artifacts for multiple platforms. - breaking_changes: - - "No breaking changes were listed in the provided text; you\u2019ll need to\ - \ review the full 0.33.0 release notes link for any config/component deprecations\ - \ or behavior changes before upgrading." + features: ['No feature details were included in the provided release notes text + beyond links to the full 0.32.0 and 0.33.0 release pages. Based on what + you pasted, the only observable change is the bump from Vector 0.32.0 to + 0.33.0 and updated build artifacts for multiple platforms.'] + breaking_changes: ["No breaking changes were listed in the provided text; you\u2019\ + ll need to review the full 0.33.0 release notes link for any config/component\ + \ deprecations or behavior changes before upgrading."] chart_version: 0.26.0 - images: - - timberio/vector:0.33.0-distroless-libc + images: ['timberio/vector:0.33.0-distroless-libc'] - version: 0.32.2 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes were included in the provided notes beyond the version - bump to v0.32.2; only artifact listings are shown. - breaking_changes: - - No breaking changes are indicated in the provided notes; the notes shown contain - only release metadata and asset lists. + features: [No functional changes were included in the provided notes beyond + the version bump to v0.32.2; only artifact listings are shown.] + breaking_changes: [No breaking changes are indicated in the provided notes; + the notes shown contain only release metadata and asset lists.] chart_version: 0.25.0 - images: - - timberio/vector:0.32.2-distroless-libc + images: ['timberio/vector:0.32.2-distroless-libc'] - version: 0.32.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector v0.32.0 release notes link provided, but no detailed changelog items - included in the text you pasted (only metadata and build assets). - breaking_changes: - - No breaking changes can be identified from the pasted notes; the actual 0.32.0 - release notes content is referenced by link but not included here. + features: ['Vector v0.32.0 release notes link provided, but no detailed changelog + items included in the text you pasted (only metadata and build assets).'] + breaking_changes: [No breaking changes can be identified from the pasted notes; + the actual 0.32.0 release notes content is referenced by link but not included + here.] chart_version: 0.24.0 - images: - - timberio/vector:0.32.0-distroless-libc + images: ['timberio/vector:0.32.0-distroless-libc'] - version: 0.31.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided v0.30.0/v0.31.0 notes beyond - links and build artifacts; review https://vector.dev/releases/0.31.0 for the - actual change list before upgrading. - breaking_changes: - - No breaking-change information was included in the provided notes; validate - by reading the v0.31.0 release notes and checking deprecations/removals that - could affect your current sources/sinks/transforms. + features: ['No feature details were included in the provided v0.30.0/v0.31.0 + notes beyond links and build artifacts; review https://vector.dev/releases/0.31.0 + for the actual change list before upgrading.'] + breaking_changes: [No breaking-change information was included in the provided + notes; validate by reading the v0.31.0 release notes and checking deprecations/removals + that could affect your current sources/sinks/transforms.] chart_version: 0.23.0 - images: - - timberio/vector:0.31.0-distroless-libc + images: ['timberio/vector:0.31.0-distroless-libc'] - version: 0.30.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes were provided in the notes shared (only metadata and - asset lists). Please share the v0.30.0 release highlights/changes from https://vector.dev/releases/0.30.0 - (or paste the changelog sections) so we can extract new features, fixes, and - any deprecations/breaking changes. - breaking_changes: - - Unknown from the provided excerpt; the pasted content contains only release - metadata and build artifacts, not the change log details. + features: ['No functional changes were provided in the notes shared (only metadata + and asset lists). Please share the v0.30.0 release highlights/changes from + https://vector.dev/releases/0.30.0 (or paste the changelog sections) so + we can extract new features, fixes, and any deprecations/breaking changes.'] + breaking_changes: ['Unknown from the provided excerpt; the pasted content contains + only release metadata and build artifacts, not the change log details.'] chart_version: 0.22.1 - images: - - timberio/vector:0.30.0-distroless-libc + images: ['timberio/vector:0.30.0-distroless-libc'] - version: 0.29.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Application bumped from Vector 0.28.0 to 0.29.0 (per release headers). + features: [Application bumped from Vector 0.28.0 to 0.29.0 (per release headers).] breaking_changes: [] chart_version: 0.21.0 - images: - - timberio/vector:0.29.0-distroless-libc + images: ['timberio/vector:0.29.0-distroless-libc'] - version: 0.28.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector updated from v0.27.0 to v0.28.0 (new release available with updated - build artifacts across Linux/macOS/Windows and package formats). - breaking_changes: - - No breaking changes were provided in the supplied release notes excerpt; review - the full v0.28.0 release notes link for any config/behavior changes before - upgrading. + features: [Vector updated from v0.27.0 to v0.28.0 (new release available with + updated build artifacts across Linux/macOS/Windows and package formats).] + breaking_changes: [No breaking changes were provided in the supplied release + notes excerpt; review the full v0.28.0 release notes link for any config/behavior + changes before upgrading.] chart_version: 0.20.0 - images: - - timberio/vector:0.28.0-distroless-libc + images: ['timberio/vector:0.28.0-distroless-libc'] - version: 0.27.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Bumped Vector application version from v0.26.0 to v0.27.0. - breaking_changes: - - "Release note content for v0.27.0 (features/breaking changes) was not included\ - \ here\u2014only metadata and asset lists\u2014so potential breaking changes\ - \ need to be reviewed at https://vector.dev/releases/0.27.0/." + features: [Bumped Vector application version from v0.26.0 to v0.27.0.] + breaking_changes: ["Release note content for v0.27.0 (features/breaking changes)\ + \ was not included here\u2014only metadata and asset lists\u2014so potential\ + \ breaking changes need to be reviewed at https://vector.dev/releases/0.27.0/."] chart_version: 0.19.0 - images: - - timberio/vector:0.27.0-distroless-libc + images: ['timberio/vector:0.27.0-distroless-libc'] - version: 0.26.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional changes identified from the provided notes; the pasted release - entries only list metadata and build artifacts for v0.25.1 and v0.26.0. - - Expect general bug fixes/performance improvements may exist in the full 0.26.0 - release notes at vector.dev, but they are not included in the text provided. - breaking_changes: - - No breaking changes are shown in the provided content; verify in the full - v0.26.0 release notes before upgrading (config, transforms/sinks/sources, - deprecated options). + features: [No functional changes identified from the provided notes; the pasted + release entries only list metadata and build artifacts for v0.25.1 and v0.26.0., + 'Expect general bug fixes/performance improvements may exist in the full 0.26.0 + release notes at vector.dev, but they are not included in the text provided.'] + breaking_changes: ['No breaking changes are shown in the provided content; verify + in the full v0.26.0 release notes before upgrading (config, transforms/sinks/sources, + deprecated options).'] chart_version: 0.18.0 - images: - - timberio/vector:0.26.0-distroless-libc + images: ['timberio/vector:0.26.0-distroless-libc'] - version: 0.25.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included beyond\ - \ metadata/assets, so no feature-level deltas can be extracted from what was\ - \ provided." - breaking_changes: - - "Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included beyond\ - \ metadata/assets, so no breaking changes can be identified from what was\ - \ provided." + features: ["Release notes content for v0.24.0 and v0.25.1 wasn\u2019t included\ + \ beyond metadata/assets, so no feature-level deltas can be extracted from\ + \ what was provided."] + breaking_changes: ["Release notes content for v0.24.0 and v0.25.1 wasn\u2019\ + t included beyond metadata/assets, so no breaking changes can be identified\ + \ from what was provided."] chart_version: 0.17.0 - images: - - timberio/vector:0.25.1-distroless-libc + images: ['timberio/vector:0.25.1-distroless-libc'] - version: 0.24.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No application feature details were provided in the pasted notes (only links - to full release notes and build artifacts). Review the Vector 0.24.0 release - page for actual feature list before upgrading. - breaking_changes: - - No breaking-change details were provided in the pasted notes. Check the Vector - 0.24.0 release page and any upgrade/breaking-changes section, and scan for - config/schema changes that could affect existing Vector configs. + features: [No application feature details were provided in the pasted notes + (only links to full release notes and build artifacts). Review the Vector + 0.24.0 release page for actual feature list before upgrading.] + breaking_changes: ['No breaking-change details were provided in the pasted notes. + Check the Vector 0.24.0 release page and any upgrade/breaking-changes section, + and scan for config/schema changes that could affect existing Vector configs.'] chart_version: 0.16.0 - images: - - timberio/vector:0.24.0-distroless-libc + images: ['timberio/vector:0.24.0-distroless-libc'] - version: 0.23.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - "The provided notes don\u2019t include the actual v0.23.0 changelog items\ - \ (features/fixes/breaking changes); only metadata and build artifacts are\ - \ shown. No feature changes can be extracted from the text you shared." - breaking_changes: - - "The provided notes don\u2019t list any breaking changes between v0.22.0 and\ - \ v0.23.0; none can be confirmed from the text shared. Review the linked Vector\ - \ 0.23.0 release page for any config schema changes, component deprecations/removals,\ - \ or default-behavior changes before upgrading." + features: ["The provided notes don\u2019t include the actual v0.23.0 changelog\ + \ items (features/fixes/breaking changes); only metadata and build artifacts\ + \ are shown. No feature changes can be extracted from the text you shared."] + breaking_changes: ["The provided notes don\u2019t list any breaking changes\ + \ between v0.22.0 and v0.23.0; none can be confirmed from the text shared.\ + \ Review the linked Vector 0.23.0 release page for any config schema changes,\ + \ component deprecations/removals, or default-behavior changes before upgrading."] chart_version: 0.15.0 - images: - - timberio/vector:0.23.0-distroless-libc + images: ['timberio/vector:0.23.0-distroless-libc'] - version: 0.22.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Vector upgraded from v0.21.0 to v0.22.0 (new Vector binary/images available - for the same set of target platforms). + features: [Vector upgraded from v0.21.0 to v0.22.0 (new Vector binary/images + available for the same set of target platforms).] breaking_changes: [] chart_version: 0.13.0 - images: - - timberio/vector:0.22.0-distroless-libc + images: ['timberio/vector:0.22.0-distroless-libc'] - version: 0.21.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were included in the provided v0.20.0/v0.21.0 notes beyond - asset/package listings, so features for 0.21.0 vs 0.20.0 cannot be summarized - from this input. - breaking_changes: - - No breaking-change information was included in the provided notes (only asset - lists), so breaking changes between 0.20.0 and 0.21.0 cannot be determined - from this input. + features: ['No feature details were included in the provided v0.20.0/v0.21.0 + notes beyond asset/package listings, so features for 0.21.0 vs 0.20.0 cannot + be summarized from this input.'] + breaking_changes: ['No breaking-change information was included in the provided + notes (only asset lists), so breaking changes between 0.20.0 and 0.21.0 + cannot be determined from this input.'] chart_version: 0.10.0 - images: - - timberio/vector:0.21.0-distroless-libc + images: ['timberio/vector:0.21.0-distroless-libc'] - version: 0.20.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No functional feature details were provided in the supplied release notes - excerpt (only metadata and asset lists). - breaking_changes: - - No breaking-change information was provided in the supplied release notes - excerpt (only metadata and asset lists). + features: [No functional feature details were provided in the supplied release + notes excerpt (only metadata and asset lists).] + breaking_changes: [No breaking-change information was provided in the supplied + release notes excerpt (only metadata and asset lists).] chart_version: 0.7.0 - images: - - timberio/vector:0.20.0-distroless-libc + images: ['timberio/vector:0.20.0-distroless-libc'] - version: 0.19.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release notes provided here only include asset lists; no feature details were - included in the pasted notes. - - Vector v0.19.0 is a minor-version bump over v0.18.0; expect incremental improvements, - but consult the full v0.19.0 release notes link for specifics (new sources/sinks/transforms, - performance, and bug fixes). - breaking_changes: - - No breaking changes were listed in the provided excerpt; you must review the - full v0.19.0 release notes for any config or behavior changes that could affect - pipelines. + features: [Release notes provided here only include asset lists; no feature + details were included in the pasted notes., 'Vector v0.19.0 is a minor-version + bump over v0.18.0; expect incremental improvements, but consult the full + v0.19.0 release notes link for specifics (new sources/sinks/transforms, + performance, and bug fixes).'] + breaking_changes: [No breaking changes were listed in the provided excerpt; + you must review the full v0.19.0 release notes for any config or behavior + changes that could affect pipelines.] chart_version: 0.4.0 - images: - - timberio/vector:0.19.0-distroless-libc + images: ['timberio/vector:0.19.0-distroless-libc'] - version: 0.18.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Application updated from Vector v0.17.3 to v0.18.0 (new release published - 2021-11-18). - breaking_changes: - - No breaking changes were included in the provided release notes excerpt (only - assets/metadata). Review the full 0.18.0 release notes page for config/component - deprecations or behavioral changes before upgrading. + features: [Application updated from Vector v0.17.3 to v0.18.0 (new release published + 2021-11-18).] + breaking_changes: [No breaking changes were included in the provided release + notes excerpt (only assets/metadata). Review the full 0.18.0 release notes + page for config/component deprecations or behavioral changes before upgrading.] chart_version: 0.2.1 - images: - - timberio/vector:0.18.0-distroless-libc + images: ['timberio/vector:0.18.0-distroless-libc'] - version: 0.17.3 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No feature details were provided in the supplied notes; only links to the - full release pages and build artifacts. - - "Upgrade spans multiple Vector versions (0.16.1 \u2192 0.17.3); review intermediate\ - \ release notes on vector.dev for component-specific changes (sources, transforms,\ - \ sinks)." - breaking_changes: - - No breaking-change information was included in the provided notes; you must - review the 0.17.x release notes (and any 0.17.0/0.17.1/0.17.2 notes) for config/behavior - changes before upgrading. + features: [No feature details were provided in the supplied notes; only links + to the full release pages and build artifacts., "Upgrade spans multiple\ + \ Vector versions (0.16.1 \u2192 0.17.3); review intermediate release notes\ + \ on vector.dev for component-specific changes (sources, transforms, sinks)."] + breaking_changes: [No breaking-change information was included in the provided + notes; you must review the 0.17.x release notes (and any 0.17.0/0.17.1/0.17.2 + notes) for config/behavior changes before upgrading.] chart_version: 0.1.1 - images: - - timberio/vector:0.17.3-distroless-libc + images: ['timberio/vector:0.17.3-distroless-libc'] - version: 0.16.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.0-alpha.4 - images: - - timberio/vector:0.16.1-distroless-libc - name: vector + images: ['timberio/vector:0.16.1-distroless-libc'] - git_url: https://github.com/VictoriaMetrics/operator release_url: https://github.com/VictoriaMetrics/operator/releases/tag/v{vsn} helm_repository_url: https://victoriametrics.github.io/helm-charts @@ -36575,97 +27004,68 @@ addons: icon: https://dashboard.snapcraft.io/site_media/appmedia/2020/11/output-onlinepngtools.png versions: - version: 0.66.1 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - v0.66.0 adds `spec.managedMetadata` support for VMUser (including Secrets), - an `incident.io` receiver in VMAlertmanagerConfig, HTTPRoute support for VMAuthorization, - an IPv6 mode toggle via `VM_ENABLETCP6`, and config-reloader now defaults - its image tag to the operator version. - - v0.66.0 updates default bundled VictoriaMetrics app versions to v1.131.0 and - VictoriaTraces defaults to v0.5.0. - - 'v0.66.1 is primarily a patch/security release: Go builder updated to 1.25.5 - plus bugfixes for RBAC cleanup and VMAnomaly config parsing/robustness.' - breaking_changes: - - v0.66.0 removes deprecated labels/annotations inheritance; you must move required - metadata to `spec.managedMetadata` fields. - - 'v0.66.0 removes deprecated status fields: `VMCluster.status.clusterStatus` - and `VMSingle.status.singleStatus` (may break dashboards/scripts that read - them).' + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['v0.66.0 adds `spec.managedMetadata` support for VMUser (including + Secrets), an `incident.io` receiver in VMAlertmanagerConfig, HTTPRoute support + for VMAuthorization, an IPv6 mode toggle via `VM_ENABLETCP6`, and config-reloader + now defaults its image tag to the operator version.', v0.66.0 updates default + bundled VictoriaMetrics app versions to v1.131.0 and VictoriaTraces defaults + to v0.5.0., 'v0.66.1 is primarily a patch/security release: Go builder updated + to 1.25.5 plus bugfixes for RBAC cleanup and VMAnomaly config parsing/robustness.'] + breaking_changes: [v0.66.0 removes deprecated labels/annotations inheritance; + you must move required metadata to `spec.managedMetadata` fields., 'v0.66.0 + removes deprecated status fields: `VMCluster.status.clusterStatus` and `VMSingle.status.singleStatus` + (may break dashboards/scripts that read them).'] chart_version: 0.57.1 - images: - - victoriametrics/operator:config-reloader-v0.66.1 - - victoriametrics/operator:v0.66.1 + images: ['victoriametrics/operator:config-reloader-v0.66.1', 'victoriametrics/operator:v0.66.1'] - version: 0.66.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Config reloader now defaults its image tag to the operator version, reducing - drift between operator and reloader images. - - VMAuth gains HTTPRoute (Gateway API) support and can override the default - path for its embedded ingress. - - VMAlertmanagerConfig adds an incident.io receiver integration. - - VMOperator can run all managed CR workloads in IPv6 mode via the VM_ENABLETCP6 - environment variable. - - VMUser introduces spec.managedMetadata for adding labels/annotations to the - generated Secret and adds query_args for appending query parameters to backend - URL generation. - - VMAgent in ingestOnly mode no longer sets promscrape.cluster.membersCount - and promscrape.cluster.memberNum flags. - breaking_changes: - - Removed labels/annotations inheritance (deprecated since v0.51.0). You must - move any relied-upon labels/annotations into the spec.managedMetadata fields - on the relevant CRs. - - Removed VMCluster status.clusterStatus and VMSingle status.singleStatus fields - (deprecated since v0.51.0). Any tooling that reads these status fields must - be updated to use the current status structure. + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Config reloader now defaults its image tag to the operator version, + reducing drift between operator and reloader images.', VMAuth gains HTTPRoute + (Gateway API) support and can override the default path for its embedded + ingress., VMAlertmanagerConfig adds an incident.io receiver integration., + VMOperator can run all managed CR workloads in IPv6 mode via the VM_ENABLETCP6 + environment variable., VMUser introduces spec.managedMetadata for adding + labels/annotations to the generated Secret and adds query_args for appending + query parameters to backend URL generation., VMAgent in ingestOnly mode + no longer sets promscrape.cluster.membersCount and promscrape.cluster.memberNum + flags.] + breaking_changes: [Removed labels/annotations inheritance (deprecated since + v0.51.0). You must move any relied-upon labels/annotations into the spec.managedMetadata + fields on the relevant CRs., Removed VMCluster status.clusterStatus and + VMSingle status.singleStatus fields (deprecated since v0.51.0). Any tooling + that reads these status fields must be updated to use the current status + structure.] chart_version: 0.57.0 - images: - - victoriametrics/operator:config-reloader-v0.66.0 - - victoriametrics/operator:v0.66.0 + images: ['victoriametrics/operator:config-reloader-v0.66.0', 'victoriametrics/operator:v0.66.0'] - version: 0.65.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'VMAuth: adds HorizontalPodAutoscaler support via new `spec.hpa` field on - the VMAuth CRD.' - - 'Converter: now supports Prometheus Operator `ServiceMonitor.spec.role` / - ServiceDiscoveryRole during object conversion.' - breaking_changes: - - Scrape CRDs now use `int` (instead of `uint64`) for `seriesLimit` and `sampleLimit` - on VMPodScrape, VMNodeScrape, VMServiceScrape, VMScrapeConfig, VMProbe (and - related). This is a schema/type change that may require updating manifests/clients - or re-applying CRDs if validation fails. + features: ['VMAuth: adds HorizontalPodAutoscaler support via new `spec.hpa` + field on the VMAuth CRD.', 'Converter: now supports Prometheus Operator + `ServiceMonitor.spec.role` / ServiceDiscoveryRole during object conversion.'] + breaking_changes: ['Scrape CRDs now use `int` (instead of `uint64`) for `seriesLimit` + and `sampleLimit` on VMPodScrape, VMNodeScrape, VMServiceScrape, VMScrapeConfig, + VMProbe (and related). This is a schema/type change that may require updating + manifests/clients or re-applying CRDs if validation fails.'] chart_version: 0.56.4 - images: - - victoriametrics/operator:config-reloader-v0.65.0 - - victoriametrics/operator:v0.65.0 + images: ['victoriametrics/operator:config-reloader-v0.65.0', 'victoriametrics/operator:v0.65.0'] - version: 0.64.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -36681,96 +27081,73 @@ addons: \ knobs**: new `rollingUpdate` / `updateStrategy` fields for `VMAuth.spec`\ \ and `*.spec.requestsLoadBalancer.spec` across VM/VL/VT clusters; again optional\ \ unless you want to tune rollouts.\n" - chart_updates: - - Operator now prefers its bundled config-reloader implementation; this can - change the sidecar image and how reloads are performed across managed resources. - - "Controller reconcile behavior changed to **preserve third\u2011party labels**\ - \ on objects (previously it tended to drop non-managed labels unless in `managedMetadata.labels`)." - - Service reconciliation improvements around `Service.spec.loadBalancerClass` - tracking to prevent errors/loops. - features: - - Operator-bundled config reloader is now the default (can be disabled via `VM_USECUSTOMCONFIGRELOADER=false`). - - New `podDisruptionBudget.unhealthyPodEvictionPolicy` support for finer control - of eviction behavior. - - New rollout tuning fields (`updateStrategy`/`rollingUpdate`) added to `VMAuth` - and requests load balancer specs for VM/VL/VT clusters. - - "Label preservation during reconcile: operator keeps third\u2011party labels\ - \ rather than pruning them to only managed labels." - - '`VLCluster.spec.vlselect.extraStorageNodes` and `VTCluster.spec.vtselect.extraStorageNodes` - allow select components to read from additional storage nodes.' - - vmagent scraping can now use `scrapeClass` / `scrapeClassName` across multiple - scrape CRDs. - - vmanomaly adds UI preset mode and supports `vlogs` reader type. - breaking_changes: - - '**Default config reloader changed** from 3rd-party images to `victoriametrics/operator:config-reloader`. - If you relied on the old reloader behavior/image (e.g., policies, allowlists, - image pinning, compliance scanning), you must either accept the new image - or set `VM_USECUSTOMCONFIGRELOADER=false` to keep prior behavior.' + chart_updates: [Operator now prefers its bundled config-reloader implementation; + this can change the sidecar image and how reloads are performed across managed + resources., "Controller reconcile behavior changed to **preserve third\u2011\ + party labels** on objects (previously it tended to drop non-managed labels\ + \ unless in `managedMetadata.labels`).", Service reconciliation improvements + around `Service.spec.loadBalancerClass` tracking to prevent errors/loops.] + features: [Operator-bundled config reloader is now the default (can be disabled + via `VM_USECUSTOMCONFIGRELOADER=false`)., New `podDisruptionBudget.unhealthyPodEvictionPolicy` + support for finer control of eviction behavior., New rollout tuning fields + (`updateStrategy`/`rollingUpdate`) added to `VMAuth` and requests load balancer + specs for VM/VL/VT clusters., "Label preservation during reconcile: operator\ + \ keeps third\u2011party labels rather than pruning them to only managed\ + \ labels.", '`VLCluster.spec.vlselect.extraStorageNodes` and `VTCluster.spec.vtselect.extraStorageNodes` + allow select components to read from additional storage nodes.', vmagent + scraping can now use `scrapeClass` / `scrapeClassName` across multiple scrape + CRDs., vmanomaly adds UI preset mode and supports `vlogs` reader type.] + breaking_changes: ['**Default config reloader changed** from 3rd-party images + to `victoriametrics/operator:config-reloader`. If you relied on the old + reloader behavior/image (e.g., policies, allowlists, image pinning, compliance + scanning), you must either accept the new image or set `VM_USECUSTOMCONFIGRELOADER=false` + to keep prior behavior.'] chart_version: 0.55.2 - images: - - victoriametrics/operator:v0.64.0 + images: ['victoriametrics/operator:v0.64.0'] - version: 0.63.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Bumped bundled default VictoriaMetrics app versions from **v1.123.0 \u2192\ - \ v1.125.0**." - - "Bumped bundled default VictoriaLogs app versions from **v1.28.0 \u2192 v1.33.0**." - - 'Operator behavior fixes: VMAlert finalizer is now reliably released on delete; - Service reconciliation now handles `loadBalancerClass` changes without hitting - the immutable-field error.' - - VMUser routing logic was simplified for `src_paths` when targeting `VMCluster/vminsert` - or `VMCluster/vmselect`. - features: - - VMUser `targetRef.crd.kind` now supports VictoriaLogs (VLSingle, VLAgent, - VLCluster components) and VictoriaTraces (VTSingle, VTCluster components) - resources, enabling VMUser to reference these CRDs directly. - - 'New CRDs/resources are introduced: `VLSingle` and `VTCluster` for managing - VictoriaLogs single-node and VictoriaTraces cluster deployments via the operator.' - - VMAgent stream aggregation gains `ignore_first_sample_interval` support, improving - aggregation behavior right after restarts/rollouts. - - VMAlert admission webhook adds validation to ensure notifier configuration - options are mutually exclusive, catching misconfigurations earlier. - - VMAlertmanager adds `enforcedNamespaceLabel` to customize the label key used - in the top-route namespace matcher for VMAlertmanagerConfig. + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Bumped bundled default VictoriaMetrics app versions from **v1.123.0\ + \ \u2192 v1.125.0**.", "Bumped bundled default VictoriaLogs app versions\ + \ from **v1.28.0 \u2192 v1.33.0**.", 'Operator behavior fixes: VMAlert finalizer + is now reliably released on delete; Service reconciliation now handles `loadBalancerClass` + changes without hitting the immutable-field error.', VMUser routing logic + was simplified for `src_paths` when targeting `VMCluster/vminsert` or `VMCluster/vmselect`.] + features: ['VMUser `targetRef.crd.kind` now supports VictoriaLogs (VLSingle, + VLAgent, VLCluster components) and VictoriaTraces (VTSingle, VTCluster components) + resources, enabling VMUser to reference these CRDs directly.', 'New CRDs/resources + are introduced: `VLSingle` and `VTCluster` for managing VictoriaLogs single-node + and VictoriaTraces cluster deployments via the operator.', 'VMAgent stream + aggregation gains `ignore_first_sample_interval` support, improving aggregation + behavior right after restarts/rollouts.', 'VMAlert admission webhook adds + validation to ensure notifier configuration options are mutually exclusive, + catching misconfigurations earlier.', VMAlertmanager adds `enforcedNamespaceLabel` + to customize the label key used in the top-route namespace matcher for VMAlertmanagerConfig.] breaking_changes: [] chart_version: 0.54.1 - images: - - victoriametrics/operator:v0.63.0 + images: ['victoriametrics/operator:v0.63.0'] - version: 0.62.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Default component versions were bumped: VictoriaMetrics apps to v1.123.0, - VictoriaLogs apps to v1.28.0, and VMAnomaly to v1.25.2.' - - "PrometheusRule\u2192VMRule converter now supports converting `spec.limit`,\ - \ `spec.labels`, `spec.query_offset`, and `spec.group[*].keep_firing_for`." - - Operator reconcile latency was reduced, improving responsiveness during sync/redeploy - cycles. - - Operator now exposes its configuration as Prometheus metrics (`flag` and `config_parameter` - with `name`, `is_set`, `value` labels). + features: ['Default component versions were bumped: VictoriaMetrics apps to + v1.123.0, VictoriaLogs apps to v1.28.0, and VMAnomaly to v1.25.2.', "PrometheusRule\u2192\ + VMRule converter now supports converting `spec.limit`, `spec.labels`, `spec.query_offset`,\ + \ and `spec.group[*].keep_firing_for`.", 'Operator reconcile latency was + reduced, improving responsiveness during sync/redeploy cycles.', 'Operator + now exposes its configuration as Prometheus metrics (`flag` and `config_parameter` + with `name`, `is_set`, `value` labels).'] breaking_changes: [] chart_version: 0.52.1 - images: - - victoriametrics/operator:v0.62.0 + images: ['victoriametrics/operator:v0.62.0'] - version: 0.61.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -36787,1074 +27164,812 @@ addons: re explicitly pinning `spec.image.tag` where required.\n\n## Version bumps\ \ (defaults managed by operator)\n- Default VictoriaMetrics apps: **v1.120.0\ \ \u2192 v1.121.0**.\n- Default VictoriaLogs apps: **v1.24.0 \u2192 v1.25.1**." - chart_updates: - - Introduces new CRD/resource **VLAgent** (apply new CRDs). - - Transitions **VLogs** CR to read-only; operator ignores create/update for - it; migration path is to **VLSingle**. - - Operator now requires **pods/eviction** RBAC to respect PDB during StatefulSet - updates. - - Fixes/changes rolling update behavior controls by adding `maxUnavailable` - fields for VMCluster/VLCluster storage/select components. - - Adds `persistentVolumeClaimRetentionPolicy` support for StatefulSet-mode CRs - (VMAnomaly, VMCluster, VMAlertmanager, VMAgent). - features: - - VLogs is now treated as read-only by the operator; migration support guidance - is provided to move to VLSingle. - - 'New CustomResource/CRD: VLAgent for VictoriaLogs agent functionality.' - - VMCluster and VLCluster now support `maxUnavailable` on key components to - tune rolling update disruption. - - VLSingle adds `spec.syslogSpec` to configure syslog ingestion. - - VMAgent adds a global scrape config and an AWS section for remoteWrite; also - adjusts default `remoteWrite.maxDiskUsagePerURL` when using stateful storage. - - StatefulSet-mode CRs gain `persistentVolumeClaimRetentionPolicy` for PVC retention - behavior control. - - If a license is configured on a CR, the operator can default image tags with - an `-enterprise` suffix. - breaking_changes: - - '**VLogs CR becomes read-only** in v0.61.0; create/update requests are ignored, - so existing GitOps flows managing VLogs will effectively stop applying changes - until migrated to VLSingle.' - - '**CRD update required** due to new `VLAgent` resource; upgrading the operator - without CRDs may break reconciliation or fail validation.' - - '**Additional RBAC needed** (`pods/eviction`); without it, operator actions - involving evictions/PDB-respecting StatefulSet updates may fail.' + chart_updates: [Introduces new CRD/resource **VLAgent** (apply new CRDs)., Transitions + **VLogs** CR to read-only; operator ignores create/update for it; migration + path is to **VLSingle**., Operator now requires **pods/eviction** RBAC to + respect PDB during StatefulSet updates., Fixes/changes rolling update behavior + controls by adding `maxUnavailable` fields for VMCluster/VLCluster storage/select + components., 'Adds `persistentVolumeClaimRetentionPolicy` support for StatefulSet-mode + CRs (VMAnomaly, VMCluster, VMAlertmanager, VMAgent).'] + features: [VLogs is now treated as read-only by the operator; migration support + guidance is provided to move to VLSingle., 'New CustomResource/CRD: VLAgent + for VictoriaLogs agent functionality.', VMCluster and VLCluster now support + `maxUnavailable` on key components to tune rolling update disruption., VLSingle + adds `spec.syslogSpec` to configure syslog ingestion., VMAgent adds a global + scrape config and an AWS section for remoteWrite; also adjusts default `remoteWrite.maxDiskUsagePerURL` + when using stateful storage., StatefulSet-mode CRs gain `persistentVolumeClaimRetentionPolicy` + for PVC retention behavior control., 'If a license is configured on a CR, + the operator can default image tags with an `-enterprise` suffix.'] + breaking_changes: ['**VLogs CR becomes read-only** in v0.61.0; create/update + requests are ignored, so existing GitOps flows managing VLogs will effectively + stop applying changes until migrated to VLSingle.', '**CRD update required** + due to new `VLAgent` resource; upgrading the operator without CRDs may break + reconciliation or fail validation.', '**Additional RBAC needed** (`pods/eviction`); + without it, operator actions involving evictions/PDB-respecting StatefulSet + updates may fail.'] chart_version: 0.51.2 - images: - - victoriametrics/operator:v0.61.0 + images: ['victoriametrics/operator:v0.61.0'] - version: 0.60.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - '(v0.59.0) New CRDs: `VLSingle` (replacement for deprecated `VLogs`) and `VLCluster` - for VictoriaLogs deployments.' - - (v0.59.0) `VMagent.remoteWriteSpec` gains `proxyURL` support; leader-election - config gains new flags for lease duration and renew deadline. - - '(v0.59.0) GitHub release manifests add `app.kubernetes.io/instance: default` - and rename `app.kubernetes.io/name` to `victoria-metrics-operator`.' - - '(v0.60.0) New CRD: `VMAnomaly` plus vmanomaly feature: online models now - support the `decay` field.' - - '(v0.60.0) Default bundled app versions bumped: VM apps to v1.120.0; VictoriaLogs - apps to v1.24.0 (victorialogs).' - breaking_changes: - - '`VLogs` is deprecated as of v0.59.0 and will become read-only after v0.61.0; - migrate to `VLSingle` before then.' - - 'Metric rename in v0.60.0: `operator_vmagent_config_fetch_secret_errors_total` - -> `operator_fetch_errors_total` (and semantics broaden to all secret/configmap - fetch failures), which can break dashboards/alerts.' + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['(v0.59.0) New CRDs: `VLSingle` (replacement for deprecated `VLogs`) + and `VLCluster` for VictoriaLogs deployments.', (v0.59.0) `VMagent.remoteWriteSpec` + gains `proxyURL` support; leader-election config gains new flags for lease + duration and renew deadline., '(v0.59.0) GitHub release manifests add `app.kubernetes.io/instance: + default` and rename `app.kubernetes.io/name` to `victoria-metrics-operator`.', + '(v0.60.0) New CRD: `VMAnomaly` plus vmanomaly feature: online models now + support the `decay` field.', '(v0.60.0) Default bundled app versions bumped: + VM apps to v1.120.0; VictoriaLogs apps to v1.24.0 (victorialogs).'] + breaking_changes: ['`VLogs` is deprecated as of v0.59.0 and will become read-only + after v0.61.0; migrate to `VLSingle` before then.', 'Metric rename in v0.60.0: + `operator_vmagent_config_fetch_secret_errors_total` -> `operator_fetch_errors_total` + (and semantics broaden to all secret/configmap fetch failures), which can + break dashboards/alerts.'] chart_version: 0.52.0 - images: - - victoriametrics/operator:v0.60.0 + images: ['victoriametrics/operator:v0.60.0'] - version: 0.59.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Default VM app versions bumped from v1.117.0 (operator v0.58.0) to v1.118.0 - (operator v0.59.0). - - 'Manifests distributed via GitHub release artifacts now include label `app.kubernetes.io/instance: - default`, and `app.kubernetes.io/name` value changed to `victoria-metrics-operator`.' - - Operator adds new leader election flags `leader-elect-lease-duration` and - `leader-elect-renew-deadline` (in addition to the v0.58.0 flags `leader-elect-namespace` - and `leader-elect-id`). - - Config-reloader now excludes hidden directories from watch to avoid errors - with hidden symlinks. - - '`spec.configMaps` are now mounted as `volumeMounts` and watched by config-reloader - for VMAgent and VMAlert.' - - 'New API fields/resources: `proxyURL` for VMagent `remoteWriteSpec`; new CRDs/resources - `VLSingle` and `VLCluster`; `VLogs` deprecated with migration guidance to - VLSingle.' - - Removed alerting rule `BadObjects` because metric `operator_controller_bad_objects_count` - is no longer exposed. - - 'HPA validation fixed: `metrics` and `behaviour` are optional fields.' - - "VMCluster defaulting typo fixed to avoid panic when VMInsert isn\u2019t configured." - features: - - 'New log storage CRDs: `VLSingle` (replacement for `VLogs`) and `VLCluster` - for clustered logs deployments.' - - VMagent `remoteWriteSpec` gains `proxyURL` to route remote write traffic via - an HTTP proxy. - - Additional leader election tuning flags (`leader-elect-lease-duration`, `leader-elect-renew-deadline`) - for better HA behavior. - - 'Config-reloader improvements: ignores hidden directories and can watch ConfigMaps - mounted via `spec.configMaps` for VMAgent/VMAlert.' - breaking_changes: - - '`VLogs` is deprecated in v0.59.0 and will become read-only after v0.61.0; - plan migration to `VLSingle` before that cutoff.' - - "If you rely on the `BadObjects` alert or the `operator_controller_bad_objects_count`\ - \ metric, they\u2019re no longer available and any dashboards/alerts must\ - \ be updated." - - GitHub release artifact manifests change standard labels (`app.kubernetes.io/name` - and add `app.kubernetes.io/instance`); if you select resources by these labels - in tooling/policies, update selectors accordingly. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Default VM app versions bumped from v1.117.0 (operator v0.58.0) + to v1.118.0 (operator v0.59.0)., 'Manifests distributed via GitHub release + artifacts now include label `app.kubernetes.io/instance: default`, and `app.kubernetes.io/name` + value changed to `victoria-metrics-operator`.', Operator adds new leader + election flags `leader-elect-lease-duration` and `leader-elect-renew-deadline` + (in addition to the v0.58.0 flags `leader-elect-namespace` and `leader-elect-id`)., + Config-reloader now excludes hidden directories from watch to avoid errors + with hidden symlinks., '`spec.configMaps` are now mounted as `volumeMounts` + and watched by config-reloader for VMAgent and VMAlert.', 'New API fields/resources: + `proxyURL` for VMagent `remoteWriteSpec`; new CRDs/resources `VLSingle` + and `VLCluster`; `VLogs` deprecated with migration guidance to VLSingle.', + Removed alerting rule `BadObjects` because metric `operator_controller_bad_objects_count` + is no longer exposed., 'HPA validation fixed: `metrics` and `behaviour` + are optional fields.', "VMCluster defaulting typo fixed to avoid panic when\ + \ VMInsert isn\u2019t configured."] + features: ['New log storage CRDs: `VLSingle` (replacement for `VLogs`) and `VLCluster` + for clustered logs deployments.', VMagent `remoteWriteSpec` gains `proxyURL` + to route remote write traffic via an HTTP proxy., 'Additional leader election + tuning flags (`leader-elect-lease-duration`, `leader-elect-renew-deadline`) + for better HA behavior.', 'Config-reloader improvements: ignores hidden + directories and can watch ConfigMaps mounted via `spec.configMaps` for VMAgent/VMAlert.'] + breaking_changes: ['`VLogs` is deprecated in v0.59.0 and will become read-only + after v0.61.0; plan migration to `VLSingle` before that cutoff.', "If you\ + \ rely on the `BadObjects` alert or the `operator_controller_bad_objects_count`\ + \ metric, they\u2019re no longer available and any dashboards/alerts must\ + \ be updated.", 'GitHub release artifact manifests change standard labels + (`app.kubernetes.io/name` and add `app.kubernetes.io/instance`); if you + select resources by these labels in tooling/policies, update selectors accordingly.'] chart_version: 0.49.0-rc1 - images: - - victoriametrics/operator:v0.59.0 + images: ['victoriametrics/operator:v0.59.0'] - version: 0.58.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Leader election configuration: new operator flags `leader-elect-namespace` - and `leader-elect-id` allow controlling where the leader election Lease lives - and how it is identified.' - - Prometheus config reloader image was bumped from 0.68.0 to 0.82.1, which may - change reloader behavior and should be validated in your environment. - breaking_changes: - - 'Operational risk: v0.58.0 defaults to deploying a vmagent version with a - known bug (VictoriaMetrics#8941). Recommended to skip this release; if you - must upgrade, override vmagent to `v1.117.1` via `VM_VMAGENTDEFAULT_VERSION=v1.117.1`.' + features: ['Leader election configuration: new operator flags `leader-elect-namespace` + and `leader-elect-id` allow controlling where the leader election Lease + lives and how it is identified.', 'Prometheus config reloader image was + bumped from 0.68.0 to 0.82.1, which may change reloader behavior and should + be validated in your environment.'] + breaking_changes: ['Operational risk: v0.58.0 defaults to deploying a vmagent + version with a known bug (VictoriaMetrics#8941). Recommended to skip this + release; if you must upgrade, override vmagent to `v1.117.1` via `VM_VMAGENTDEFAULT_VERSION=v1.117.1`.'] chart_version: 0.47.0 - images: - - victoriametrics/operator:v0.58.0 + images: ['victoriametrics/operator:v0.58.0'] - version: 0.57.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Introduced FIPS-compliant builds for the operator and config-reloader images - (use images tagged with the -fips prefix when required). - - Added spec.configReloadAuthKeySecret to VMAgent/VMAlert/VMAuth to supply a - secret value used as the -configReload auth key. - - Converter now supports msteamsv2_configs conversion from Prometheus AlertmanagerConfig. - - VMAlertmanagerConfig webhook_configs gained a timeout field (requires Alertmanager - v0.28.0+). - - VMSingle Service now exposes an additional named port/alias for 8428. - - VMSingle and VMCluster retentionPeriod is now optional and defaults to 1 month; - retentionPeriod is validated against ^[0-9]+(h|d|y)?$. - - 'Operator default component versions updated: VictoriaMetrics apps to v1.116.0, - VictoriaLogs to v1.21.0, Alertmanager to v0.28.1.' - - 'Build tooling updated: Go builder upgraded from Go 1.24.0 to Go 1.24.4.' - breaking_changes: - - retentionPeriod in VMSingle/VMCluster now has strict validation and defaults - to 1 month when omitted; previously accepted values may now be rejected by - the webhook/CRD validation. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Introduced FIPS-compliant builds for the operator and config-reloader + images (use images tagged with the -fips prefix when required)., Added spec.configReloadAuthKeySecret + to VMAgent/VMAlert/VMAuth to supply a secret value used as the -configReload + auth key., Converter now supports msteamsv2_configs conversion from Prometheus + AlertmanagerConfig., VMAlertmanagerConfig webhook_configs gained a timeout + field (requires Alertmanager v0.28.0+)., VMSingle Service now exposes an + additional named port/alias for 8428., 'VMSingle and VMCluster retentionPeriod + is now optional and defaults to 1 month; retentionPeriod is validated against + ^[0-9]+(h|d|y)?$.', 'Operator default component versions updated: VictoriaMetrics + apps to v1.116.0, VictoriaLogs to v1.21.0, Alertmanager to v0.28.1.', 'Build + tooling updated: Go builder upgraded from Go 1.24.0 to Go 1.24.4.'] + breaking_changes: [retentionPeriod in VMSingle/VMCluster now has strict validation + and defaults to 1 month when omitted; previously accepted values may now + be rejected by the webhook/CRD validation.] chart_version: 0.46.0 - images: - - victoriametrics/operator:v0.57.0 + images: ['victoriametrics/operator:v0.57.0'] - version: 0.56.0 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Default VM component images bumped: VictoriaMetrics -> v1.115.0; VLogs -> - v1.18.0 (from prior v1.114.0/v1.17.0).' - - New support for env vars `VM_METRICS_VERSION` and `VM_LOGS_VERSION` to control - images for all VM/VL-related CRs. - - 'Config-reloader behavior change: it no longer uses proxy-protocol for its - internal web-server even when `reload-use-proxy-protocol` is set (plus a bugfix - around that flag).' - - 'Added additional validations: vmalertmanager runtime config validation; StatefulSet - volumeMount name validation; stricter vmalertmanagerconfig validation for - unknown fields; shard count bounds fix.' - features: - - Can set all VM and VLogs image versions via `VM_METRICS_VERSION` and `VM_LOGS_VERSION` - environment variables, reducing per-CR version pinning. - - vmauth can now serve internal routes on a separate port (`internalListenPort`) - for improved security/isolation. - - vmauth can optionally enable HAProxy PROXY protocol support via `useProxyProtocol`. - - vmalertmanager now validates runtime configuration, catching invalid configs - earlier. - breaking_changes: - - Config-reloader no longer uses proxy-protocol for its internal web server - even if `reload-use-proxy-protocol` is enabled; if you relied on proxy-protocol - on that internal endpoint, adjust your setup or remove the expectation. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Default VM component images bumped: VictoriaMetrics -> v1.115.0; + VLogs -> v1.18.0 (from prior v1.114.0/v1.17.0).', New support for env vars + `VM_METRICS_VERSION` and `VM_LOGS_VERSION` to control images for all VM/VL-related + CRs., 'Config-reloader behavior change: it no longer uses proxy-protocol + for its internal web-server even when `reload-use-proxy-protocol` is set + (plus a bugfix around that flag).', 'Added additional validations: vmalertmanager + runtime config validation; StatefulSet volumeMount name validation; stricter + vmalertmanagerconfig validation for unknown fields; shard count bounds fix.'] + features: ['Can set all VM and VLogs image versions via `VM_METRICS_VERSION` + and `VM_LOGS_VERSION` environment variables, reducing per-CR version pinning.', + vmauth can now serve internal routes on a separate port (`internalListenPort`) + for improved security/isolation., vmauth can optionally enable HAProxy PROXY + protocol support via `useProxyProtocol`., 'vmalertmanager now validates + runtime configuration, catching invalid configs earlier.'] + breaking_changes: ['Config-reloader no longer uses proxy-protocol for its internal + web server even if `reload-use-proxy-protocol` is enabled; if you relied + on proxy-protocol on that internal endpoint, adjust your setup or remove + the expectation.'] chart_version: 0.45.0 - images: - - victoriametrics/operator:v0.56.0 + images: ['victoriametrics/operator:v0.56.0'] - version: 0.55.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Default VictoriaMetrics app versions updated to VM v1.114.0 (from v1.113.0) - and VictoriaLogs (VLogs) to v1.17.0 (from v1.15.0). - - Scrape target OAuth2 configs now support `tls_config` and `proxy_url` fields. - - All VM apps now support `extraEnvsFrom` to source env vars from a Secret or - ConfigMap. - - 'Services for vmstorage/vmselect/vmalertmanager now set `publishNotReadyAddresses: - true` to improve discovery/cluster formation during rollouts.' - - Operator now logs a diff of field changes for key objects (Deployment/StatefulSet/Service/PDB/HPA/VMServiceScrape) - during reconcile for easier debugging. - - 'New global env vars control config-reloader resources: `VM_CONFIG_RELOADER_LIMIT_CPU/MEMORY` - (default `unlimited`) and `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` (default - empty); per-resource request env vars are deprecated.' - - VMAgent adds beta `daemonSetMode` for running as a DaemonSet. - - VMAgent reduces Kubernetes API load by removing selectors from VMPodScrape - kubernetes_sd_configs; original behavior can be restored with `VMAgent.spec.enableKubernetesAPISelectors`. - - 'VMAgent remote write disk usage fields improved: `remoteWrite.MaxDiskUsage` - can be integer with validation; `remoteWriteSettings.maxDiskUsagePerURL` supports - byte-suffix strings with validation.' - - 'Alertmanager config CRD gains new/updated receivers: Discord adds `content`, - `username`, `avatar_url`; new `jira_configs`, `rocketchat_configs`, `msteamsv2_configs` - (Alertmanager v0.28.0+).' - breaking_changes: - - VMPodScrape-generated kubernetes_sd_configs no longer include `selectors` - by default, which can change scrape target selection; set `VMAgent.spec.enableKubernetesAPISelectors=true` - to restore the prior behavior. - - Per-resource config-reloader request env vars are now deprecated in favor - of the new global `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` controls (not an - immediate break, but update values/automation accordingly). + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Default VictoriaMetrics app versions updated to VM v1.114.0 (from + v1.113.0) and VictoriaLogs (VLogs) to v1.17.0 (from v1.15.0)., Scrape target + OAuth2 configs now support `tls_config` and `proxy_url` fields., All VM + apps now support `extraEnvsFrom` to source env vars from a Secret or ConfigMap., + 'Services for vmstorage/vmselect/vmalertmanager now set `publishNotReadyAddresses: + true` to improve discovery/cluster formation during rollouts.', Operator + now logs a diff of field changes for key objects (Deployment/StatefulSet/Service/PDB/HPA/VMServiceScrape) + during reconcile for easier debugging., 'New global env vars control config-reloader + resources: `VM_CONFIG_RELOADER_LIMIT_CPU/MEMORY` (default `unlimited`) and + `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` (default empty); per-resource request + env vars are deprecated.', VMAgent adds beta `daemonSetMode` for running + as a DaemonSet., VMAgent reduces Kubernetes API load by removing selectors + from VMPodScrape kubernetes_sd_configs; original behavior can be restored + with `VMAgent.spec.enableKubernetesAPISelectors`., 'VMAgent remote write + disk usage fields improved: `remoteWrite.MaxDiskUsage` can be integer with + validation; `remoteWriteSettings.maxDiskUsagePerURL` supports byte-suffix + strings with validation.', 'Alertmanager config CRD gains new/updated receivers: + Discord adds `content`, `username`, `avatar_url`; new `jira_configs`, `rocketchat_configs`, + `msteamsv2_configs` (Alertmanager v0.28.0+).'] + breaking_changes: ['VMPodScrape-generated kubernetes_sd_configs no longer include + `selectors` by default, which can change scrape target selection; set `VMAgent.spec.enableKubernetesAPISelectors=true` + to restore the prior behavior.', 'Per-resource config-reloader request env + vars are now deprecated in favor of the new global `VM_CONFIG_RELOADER_REQUEST_CPU/MEMORY` + controls (not an immediate break, but update values/automation accordingly).'] chart_version: 0.44.0 - images: - - victoriametrics/operator:v0.55.0 + images: ['victoriametrics/operator:v0.55.0'] - version: 0.54.1 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'vmalertmanagerconfig: added `thread_message_id` to `telegram_configs` (requires - Alertmanager v0.28.0+).' - - VMUser `targetRefs` can now reference VLogs resources (VLogs support in VMUser). + features: ['vmalertmanagerconfig: added `thread_message_id` to `telegram_configs` + (requires Alertmanager v0.28.0+).', VMUser `targetRefs` can now reference + VLogs resources (VLogs support in VMUser).] breaking_changes: [] chart_version: 0.43.1 - images: - - victoriametrics/operator:v0.54.1 + images: ['victoriametrics/operator:v0.54.1'] - version: 0.53.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds `thread_message_id` to `telegram_configs` in `VMAlertmanagerConfig` (requires - Alertmanager v0.28.0+). - - Adds support for VLogs as a targetRef in `VMUser` (VLogs can now be referenced - in VMUser targetRefs). - - "Updates the operator\u2019s default VictoriaMetrics application versions\ - \ to v1.110.0 (from v1.109.1)." - - Rebuilds operator with Go 1.23.5 (security patch upgrade). + features: [Adds `thread_message_id` to `telegram_configs` in `VMAlertmanagerConfig` + (requires Alertmanager v0.28.0+)., Adds support for VLogs as a targetRef + in `VMUser` (VLogs can now be referenced in VMUser targetRefs)., "Updates\ + \ the operator\u2019s default VictoriaMetrics application versions to v1.110.0\ + \ (from v1.109.1).", Rebuilds operator with Go 1.23.5 (security patch upgrade).] breaking_changes: [] chart_version: 0.42.5 - images: - - victoriametrics/operator:v0.53.0 + images: ['victoriametrics/operator:v0.53.0'] - version: 0.52.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Default component versions bumped: VictoriaMetrics apps to v1.109.1 and VictoriaLogs - to v1.6.1 (if you rely on chart/operator defaults, workloads may roll to these - images).' - - 'VMScrapeConfig: GCE SD `zone` now supports multiple values (may broaden discovery - if you previously had to workaround).' - - 'Operator performance/scale improvements: faster config regeneration (decoupled - from child status updates), reduced prometheus-converter API load, and higher - default Kubernetes client limits (`client.qps=50`, `client.burst=100`).' - - New operator flag `controller.statusLastUpdateTimeTTL` (default 1h) to control - staleness detection for `status.conditions`; increase for very large fleets - (>>5k objects). - - 'Richer failure diagnostics: `failed` status now includes reason and crashed - container logs.' - - 'VMServiceScrape generation: now exposes only the well-known `http` port; - job name for vmbackupmanager gets `-vmbackupmanager` suffix.' - breaking_changes: - - 'Metadata inheritance removal: `labels`/`annotations` inheritance from CRD - metadata is removed in v0.52.0. Move required labels/annotations to `spec.managedMetadata`; - after upgrade, inherited labels will be dropped and annotation changes may - be ignored (except preserved).' - - 'Potential scrape/job changes: VMServiceScrape port exposure and job naming - changes may affect dashboards/alerts that match on port names or job names - (especially vmbackupmanager).' - - 'Behavioral change for large installs: new staleness detection may mark conditions - stale if `controller.statusLastUpdateTimeTTL` too low for your object count; - tune accordingly.' + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Default component versions bumped: VictoriaMetrics apps to v1.109.1 + and VictoriaLogs to v1.6.1 (if you rely on chart/operator defaults, workloads + may roll to these images).', 'VMScrapeConfig: GCE SD `zone` now supports + multiple values (may broaden discovery if you previously had to workaround).', + 'Operator performance/scale improvements: faster config regeneration (decoupled + from child status updates), reduced prometheus-converter API load, and higher + default Kubernetes client limits (`client.qps=50`, `client.burst=100`).', + New operator flag `controller.statusLastUpdateTimeTTL` (default 1h) to control + staleness detection for `status.conditions`; increase for very large fleets + (>>5k objects)., 'Richer failure diagnostics: `failed` status now includes + reason and crashed container logs.', 'VMServiceScrape generation: now exposes + only the well-known `http` port; job name for vmbackupmanager gets `-vmbackupmanager` + suffix.'] + breaking_changes: ['Metadata inheritance removal: `labels`/`annotations` inheritance + from CRD metadata is removed in v0.52.0. Move required labels/annotations + to `spec.managedMetadata`; after upgrade, inherited labels will be dropped + and annotation changes may be ignored (except preserved).', 'Potential scrape/job + changes: VMServiceScrape port exposure and job naming changes may affect + dashboards/alerts that match on port names or job names (especially vmbackupmanager).', + 'Behavioral change for large installs: new staleness detection may mark conditions + stale if `controller.statusLastUpdateTimeTTL` too low for your object count; + tune accordingly.'] chart_version: 0.41.2 - images: - - victoriametrics/operator:v0.52.0 + images: ['victoriametrics/operator:v0.52.0'] - version: 0.51.1 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Default VictoriaMetrics component versions bumped (v0.50.0 -> VM 1.106.1; - v0.51.1 -> VM apps 1.108.1, and VL default 1.3.2 as shown in release notes). - - Operator now supports generating manifests without the admission webhook (useful - for restricted clusters / simpler installs). - - 'Operator logging changed: structured logging fields moved into msg; logger - field adjusted to show controller.CRD name; new loggerJSONFields option (introduced - in v0.50.0) lets you customize JSON encoder field names.' - - 'Security context handling adjusted: when useStrictSecurity=false, securityContext - is now properly applied; when useStrictSecurity=true, default privileged:false - is set for containers.' - - 'Generated object metadata improvements: VMCluster-generated objects get label - app.kubernetes.io/part-of=vmcluster; PodDisruptionBudget and HorizontalPodAutoscaler - generated by operator now include annotations.' - - Scrape config generation/selection bugfixes for VMAgent selectors and namespaceSelectors, - especially around selectAllByDefault true/false and VMScrapeConfig inclusion - rules. - - 'License options support added: license.forceOffile and license.reloadInterval.' - - 'VMServiceScrape endpointSlice discovery enhancements: missing container labels - added to discovered metrics; new env var VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES - to default to endpointslices discovery role instead of endpoints.' - - 'API/CRDs updated: new managedMetadata field added to several specs to control - labels/annotations on generated objects; status subresource reworked for multiple - CRDs adding conditions; new observedGeneration status field; updateStatus - field unified for some CRDs (replacing status/clusterStatus/singleStatus in - VLogs/VMCluster/VMSingle).' - - VMAuth/VMUser config generation improvements and new fields (unauthorizedUserAccessSpec; - dump_request_on_errors; fixed missing src_headers/src_query_args/discover_backend_ips - when using targetRefs). - features: - - Option to enforce EndpointSlice-based discovery for VMServiceScrape via VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES, - plus added container labels in discovered metrics. - - New operator logger configuration flag loggerJSONFields and updated structured - logging output. - - managedMetadata field in multiple CRDs to explicitly manage labels/annotations - applied to operator-generated resources. - - VMAuth gains unauthorizedUserAccessSpec (new structured way to define unauthorized - access behavior) and VMUser adds dump_request_on_errors; VMUser targetRefs - config generation fixes. - - Support for enterprise license options license.forceOffile and license.reloadInterval. - - Ability to deploy operator manifests without webhook. - - 'Security hardening defaults: privileged:false when useStrictSecurity=true, - plus corrected securityContext application when not strict.' - breaking_changes: - - 'CRD/API surface changes: new status/conditions/observedGeneration and updateStatus - unification may require updating any automation that reads/writes status fields - or relies on old status field names.' - - 'Deprecations introduced (not removed yet): labels/annotations inheritance - from CRD metadata is deprecated in favor of spec.managedMetadata and will - be removed in v0.52.0; VMAuth.spec.unauthorizedAccessConfig and several inlined - VMAuth.spec fields are deprecated in favor of unauthorizedUserAccessSpec (supported - until v1.0).' + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Default VictoriaMetrics component versions bumped (v0.50.0 + -> VM 1.106.1; v0.51.1 -> VM apps 1.108.1, and VL default 1.3.2 as shown + in release notes).', Operator now supports generating manifests without + the admission webhook (useful for restricted clusters / simpler installs)., + 'Operator logging changed: structured logging fields moved into msg; logger + field adjusted to show controller.CRD name; new loggerJSONFields option + (introduced in v0.50.0) lets you customize JSON encoder field names.', 'Security + context handling adjusted: when useStrictSecurity=false, securityContext + is now properly applied; when useStrictSecurity=true, default privileged:false + is set for containers.', 'Generated object metadata improvements: VMCluster-generated + objects get label app.kubernetes.io/part-of=vmcluster; PodDisruptionBudget + and HorizontalPodAutoscaler generated by operator now include annotations.', + 'Scrape config generation/selection bugfixes for VMAgent selectors and namespaceSelectors, + especially around selectAllByDefault true/false and VMScrapeConfig inclusion + rules.', 'License options support added: license.forceOffile and license.reloadInterval.', + 'VMServiceScrape endpointSlice discovery enhancements: missing container labels + added to discovered metrics; new env var VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES + to default to endpointslices discovery role instead of endpoints.', 'API/CRDs + updated: new managedMetadata field added to several specs to control labels/annotations + on generated objects; status subresource reworked for multiple CRDs adding + conditions; new observedGeneration status field; updateStatus field unified + for some CRDs (replacing status/clusterStatus/singleStatus in VLogs/VMCluster/VMSingle).', + VMAuth/VMUser config generation improvements and new fields (unauthorizedUserAccessSpec; + dump_request_on_errors; fixed missing src_headers/src_query_args/discover_backend_ips + when using targetRefs).] + features: ['Option to enforce EndpointSlice-based discovery for VMServiceScrape + via VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES, plus added container + labels in discovered metrics.', New operator logger configuration flag loggerJSONFields + and updated structured logging output., managedMetadata field in multiple + CRDs to explicitly manage labels/annotations applied to operator-generated + resources., VMAuth gains unauthorizedUserAccessSpec (new structured way + to define unauthorized access behavior) and VMUser adds dump_request_on_errors; + VMUser targetRefs config generation fixes., Support for enterprise license + options license.forceOffile and license.reloadInterval., Ability to deploy + operator manifests without webhook., 'Security hardening defaults: privileged:false + when useStrictSecurity=true, plus corrected securityContext application + when not strict.'] + breaking_changes: ['CRD/API surface changes: new status/conditions/observedGeneration + and updateStatus unification may require updating any automation that reads/writes + status fields or relies on old status field names.', 'Deprecations introduced + (not removed yet): labels/annotations inheritance from CRD metadata is deprecated + in favor of spec.managedMetadata and will be removed in v0.52.0; VMAuth.spec.unauthorizedAccessConfig + and several inlined VMAuth.spec fields are deprecated in favor of unauthorizedUserAccessSpec + (supported until v1.0).'] chart_version: 0.40.1 - images: - - victoriametrics/operator:v0.51.1 + images: ['victoriametrics/operator:v0.51.1'] - version: 0.50.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Added missing `container` labels for metrics discovered via `VMServiceScrape` - when using `endpointslices` discovery, improving metric labeling consistency. - - Operator now defaults VictoriaMetrics component images/versions to v1.106.1 - (from v1.106.0). - - New env var `VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES` to force `endpointslices` - (instead of `endpoints`) as the discovery role for `VMServiceScrape` when - generating VMAgent scrape config. - - New operator logger option/flag `loggerJSONFields` to customize JSON encoder - field names in logs. - - CRDs now expose `status.observedGeneration` to help clients understand whether - status reflects the latest spec generation. - - 'CRD status fields were unified: `status` / `clusterStatus` / `singleStatus` - for `VLogs`, `VMCluster`, `VMSingle` replaced by a generic `updateStatus` - field.' - breaking_changes: - - 'CRD status schema change: `VLogs`, `VMCluster`, and `VMSingle` status fields - (`status`, `clusterStatus`, `singleStatus`) are replaced by `updateStatus`. - Anything reading these old fields (dashboards, scripts, controllers) must - be updated accordingly.' - - "`VMAuth` spec change (already in v0.49.0 but relevant if you\u2019re upgrading\ - \ across it): `spec.configSecret` moved to `spec.externalConfig.secretRef.name`,\ - \ and `spec.externalConfig.localPath` was added. Existing manifests must be\ - \ updated or they will fail validation/behavior will change." + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Added missing `container` labels for metrics discovered via `VMServiceScrape` + when using `endpointslices` discovery, improving metric labeling consistency.', + Operator now defaults VictoriaMetrics component images/versions to v1.106.1 + (from v1.106.0)., New env var `VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES` + to force `endpointslices` (instead of `endpoints`) as the discovery role + for `VMServiceScrape` when generating VMAgent scrape config., New operator + logger option/flag `loggerJSONFields` to customize JSON encoder field names + in logs., CRDs now expose `status.observedGeneration` to help clients understand + whether status reflects the latest spec generation., 'CRD status fields + were unified: `status` / `clusterStatus` / `singleStatus` for `VLogs`, `VMCluster`, + `VMSingle` replaced by a generic `updateStatus` field.'] + breaking_changes: ['CRD status schema change: `VLogs`, `VMCluster`, and `VMSingle` + status fields (`status`, `clusterStatus`, `singleStatus`) are replaced by + `updateStatus`. Anything reading these old fields (dashboards, scripts, + controllers) must be updated accordingly.', "`VMAuth` spec change (already\ + \ in v0.49.0 but relevant if you\u2019re upgrading across it): `spec.configSecret`\ + \ moved to `spec.externalConfig.secretRef.name`, and `spec.externalConfig.localPath`\ + \ was added. Existing manifests must be updated or they will fail validation/behavior\ + \ will change."] chart_version: 0.39.1 - images: - - victoriametrics/operator:v0.50.0 + images: ['victoriametrics/operator:v0.50.0'] - version: 0.49.0 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Operator behavior/security fix: `useStrictSecurity: true` is now properly - applied to initContainers for VMAuth, VMAgent, and VMAlertmanager (may cause - previously-working permissive initContainers to become restricted).' - - 'VMAuth CRD schema change: `spec.configSecret` moved to `spec.externalConfig.secretRef.name`; - new `spec.externalConfig.localPath` added for providing custom configs via - sidecar.' - - 'VMCluster CRD enhancement: add `spec.requestsLoadBalancer` configuration.' - - 'VMCluster monitoring: fixes/adjustments when `backup` is enabled so monitoring - is configured correctly.' - - 'VMAlertmanager: config reload now triggers when a ConfigMap referenced via - `.spec.configMap` changes.' - - 'Operator reconciliation fixes: handles storage size changes correctly; fixes - conversion from AlertmanagerConfig to VMAlertmanagerConfig.' - - Default VictoriaMetrics component versions bumped to 1.106.0 (release tag - referenced 1.106.6). - features: - - InitContainers now honor strict security settings (`useStrictSecurity`) for - VMAuth/VMAgent/VMAlertmanager, improving hardening consistency. - - VMAuth can consume external config via `externalConfig` (secretRef + optional - localPath) enabling sidecar-driven config delivery. - - VMCluster can be configured with `requestsLoadBalancer` to influence service/load - balancer request behavior. - - Improved monitoring wiring for VMCluster deployments that enable backups. - - VMAlertmanager now reloads when the referenced ConfigMap changes, reducing - need for manual restarts. - breaking_changes: - - "VMAuth spec change: `spec.configSecret` is replaced by `spec.externalConfig.secretRef.name`\ - \ (you must migrate manifests/Helm values or VMAuth config won\u2019t be found)." - - 'Security behavior change: enabling `useStrictSecurity: true` now affects - initContainers too; clusters relying on more permissive initContainer security - settings may see pods fail to start until securityContext/permissions are - adjusted.' + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator behavior/security fix: `useStrictSecurity: true` is + now properly applied to initContainers for VMAuth, VMAgent, and VMAlertmanager + (may cause previously-working permissive initContainers to become restricted).', + 'VMAuth CRD schema change: `spec.configSecret` moved to `spec.externalConfig.secretRef.name`; + new `spec.externalConfig.localPath` added for providing custom configs via + sidecar.', 'VMCluster CRD enhancement: add `spec.requestsLoadBalancer` configuration.', + 'VMCluster monitoring: fixes/adjustments when `backup` is enabled so monitoring + is configured correctly.', 'VMAlertmanager: config reload now triggers when + a ConfigMap referenced via `.spec.configMap` changes.', 'Operator reconciliation + fixes: handles storage size changes correctly; fixes conversion from AlertmanagerConfig + to VMAlertmanagerConfig.', Default VictoriaMetrics component versions bumped + to 1.106.0 (release tag referenced 1.106.6).] + features: ['InitContainers now honor strict security settings (`useStrictSecurity`) + for VMAuth/VMAgent/VMAlertmanager, improving hardening consistency.', VMAuth + can consume external config via `externalConfig` (secretRef + optional localPath) + enabling sidecar-driven config delivery., VMCluster can be configured with + `requestsLoadBalancer` to influence service/load balancer request behavior., + Improved monitoring wiring for VMCluster deployments that enable backups., + 'VMAlertmanager now reloads when the referenced ConfigMap changes, reducing + need for manual restarts.'] + breaking_changes: ["VMAuth spec change: `spec.configSecret` is replaced by `spec.externalConfig.secretRef.name`\ + \ (you must migrate manifests/Helm values or VMAuth config won\u2019t be\ + \ found).", 'Security behavior change: enabling `useStrictSecurity: true` + now affects initContainers too; clusters relying on more permissive initContainer + security settings may see pods fail to start until securityContext/permissions + are adjusted.'] chart_version: 0.37.0 - images: - - victoriametrics/operator:v0.49.0 + images: ['victoriametrics/operator:v0.49.0'] - version: 0.48.0 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator now supports enabling/disabling use of VM config-reloader per resource - (VMAgent/VMAlert/VMAuth/VMAlertmanager) and configuring reloader image tag/resources - via CRD fields (`useVMConfigReloader`, `configReloaderImageTag`, `configReloaderResources`). - - Webhook port is now configurable (ensure your Helm values/Service/NetworkPolicy - match if you override defaults). - - Operator enables controller-runtime cache for Secrets/ConfigMaps again; can - be disabled via flag `-controller.disableCacheFor=seccret,configmap` (spelling - per release note). - - Operator now trims spaces from Secret/ConfigMap values by default; can be - disabled via flag `disableSecretKeySpaceTrim`. - - Default VictoriaMetrics app versions bumped to v1.103.0 (expect downstream - image tag changes if you rely on chart defaults). - - PVCs for VMSingle/VLogs gain ownerReferences to improve Argo CD compatibility - (may affect GitOps drift/garbage-collection behavior). - - PDB enabled status is now respected (behavior change if you previously relied - on operator creating PDBs even when disabled). - features: - - Per-resource control over using VM config-reloader and its image/resources - for VMAgent, VMAlert, VMAuth, and VMAlertmanager. - - VMAlertmanager can enforce top-level route matchers via `enforcedTopRouteMatchers` - applied to all VMAlertmanagerConfig objects. - - 'New/extended API knobs: `host_aliases` (underscore form prioritized), per-app - `useDefaultResources` and `disableSelfServiceScrape`, `clusterDomainName` - for VMCluster/VMAlertmanager, and expanded securityContext propagation to - containers.' - - 'Operational improvements: reduced reconcile latency and lower kube-apiserver - load; re-enabled caching for Secrets/ConfigMaps to improve performance.' - breaking_changes: - - Default behavior now trims whitespace in Secret/ConfigMap values used for - generated configs; this can change credentials/URLs if they relied on trailing/leading - spaces. - - If you deploy behind strict NetworkPolicies/firewalls, the webhook port being - configurable may require you to adjust any policies/services if you change - it from the default. - - PVC ownerReferences added for VMSingle/VLogs can change deletion/GC semantics - in GitOps setups (e.g., Argo CD pruning) if you previously managed PVCs separately. + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator now supports enabling/disabling use of VM config-reloader + per resource (VMAgent/VMAlert/VMAuth/VMAlertmanager) and configuring reloader + image tag/resources via CRD fields (`useVMConfigReloader`, `configReloaderImageTag`, + `configReloaderResources`).', Webhook port is now configurable (ensure your + Helm values/Service/NetworkPolicy match if you override defaults)., 'Operator + enables controller-runtime cache for Secrets/ConfigMaps again; can be disabled + via flag `-controller.disableCacheFor=seccret,configmap` (spelling per release + note).', Operator now trims spaces from Secret/ConfigMap values by default; + can be disabled via flag `disableSecretKeySpaceTrim`., Default VictoriaMetrics + app versions bumped to v1.103.0 (expect downstream image tag changes if + you rely on chart defaults)., PVCs for VMSingle/VLogs gain ownerReferences + to improve Argo CD compatibility (may affect GitOps drift/garbage-collection + behavior)., PDB enabled status is now respected (behavior change if you + previously relied on operator creating PDBs even when disabled).] + features: ['Per-resource control over using VM config-reloader and its image/resources + for VMAgent, VMAlert, VMAuth, and VMAlertmanager.', VMAlertmanager can enforce + top-level route matchers via `enforcedTopRouteMatchers` applied to all VMAlertmanagerConfig + objects., 'New/extended API knobs: `host_aliases` (underscore form prioritized), + per-app `useDefaultResources` and `disableSelfServiceScrape`, `clusterDomainName` + for VMCluster/VMAlertmanager, and expanded securityContext propagation to + containers.', 'Operational improvements: reduced reconcile latency and lower + kube-apiserver load; re-enabled caching for Secrets/ConfigMaps to improve + performance.'] + breaking_changes: [Default behavior now trims whitespace in Secret/ConfigMap + values used for generated configs; this can change credentials/URLs if they + relied on trailing/leading spaces., 'If you deploy behind strict NetworkPolicies/firewalls, + the webhook port being configurable may require you to adjust any policies/services + if you change it from the default.', 'PVC ownerReferences added for VMSingle/VLogs + can change deletion/GC semantics in GitOps setups (e.g., Argo CD pruning) + if you previously managed PVCs separately.'] chart_version: 0.35.0 - images: - - victoriametrics/operator:v0.48.0 + images: ['victoriametrics/operator:v0.48.0'] - version: 0.47.0 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Operator behavior changes for VMAlertmanagerConfig: forbids cross-resource - or global receiver references; config must only reference local receivers.' - - 'VMAlertmanagerConfig API change: removed deprecated `spec.mute_time_intervals`; - use `spec.time_intervals` instead.' - - 'VMAlertmanager default routing change: if root route receiver is empty, operator - now sets `blackhole` receiver instead of choosing the first VMAlertmanagerConfig - receiver.' - - 'New CRD/resource support: adds `VLogs` for managing VictoriaLogs via the - operator.' - - 'Config reloader: new TLS flags for securing the reload endpoint (`tlsCaFile`, - `tlsCertFile`, `tlsKeyFile`, `tlsServerName`, `tlsInsecureSkipVerify`).' - - 'VMUser: adds `status.lastSyncError`; adds validation for `spec.targetRefs.crd.kind`; - can skip generating VMAuth config for invalid VMUser refs (recommended to - enable validation webhook).' - - 'Scrape objects: adds `status` and `lastSyncError` to `VMServiceScrape`, `VMPodScrape`, - `VMNodeScrape`, `VMStaticScrape`, and `VMScrapeConfig` to track vmagent config - generation.' - - VMAgent config builder refactor; fixes incorrect skipping logic for scrape - objects with bad Secret/ConfigMap refs. - - 'Operator metrics endpoint: can secure `metrics-bind-address` with TLS/mTLS - via flags (`tls.*`, `mtls.*`).' - - 'TLS asset naming fix: adds `configmap` prefix to ConfigMap-referenced TLS - assets to avoid Secret/ConfigMap name clashes.' - - 'PodDisruptionBudget finalizer fix: properly releases PDB finalizer (previously - could stick due to typo); plus general finalizer refactor.' - - 'Auto-created VMServiceScrape for CRD objects from `extraArgs`: adds `tls_config` - and `authKey` settings.' - - 'VMAlertmanagerConfig: improved validation and adds `status`/`lastSyncError` - fields.' - - 'VMAlertmanager: adds `webConfig` for easier TLS configuration and correct - probe/URL generation; adds `gossipConfig` for client/server TLS on gossip.' - - 'VMAgent/VMSingle: stream aggregation options synced with upstream (`dropInputLabels`, - `ignoreFirstIntervals`, `ignoreOldSamples`) and supports configMap as aggregation - rules source.' - - 'Operator: adds `-client.qps` and `-client.burst` flags to tune Kubernetes - API client behavior.' - features: - - Adds a new `VLogs` custom resource to manage VictoriaLogs through the operator. - - Adds TLS configuration options to the config-reloader so reload endpoints - can be secured. - - Adds status and lastSyncError fields across scrape-related resources to help - troubleshoot vmagent config generation. - - Adds operator TLS/mTLS support for the metrics endpoint and improves TLS asset - handling to avoid naming clashes. - - Enhances VMAlertmanager with webConfig and gossipConfig for simpler TLS and - secure gossip communication. - - Adds additional stream aggregation options and supports configMap-based aggregation - rules for vmagent/vmsingle. - - Adds Kubernetes client tuning flags (`client.qps`, `client.burst`) for large - clusters or API rate limiting scenarios. - breaking_changes: - - VMAlertmanagerConfig can no longer reference receivers across other VMAlertmanagerConfig - objects or use global receiver references; receivers must be local to the - object. - - '`VMAlertmanagerConfig.spec.mute_time_intervals` has been removed; migrate - to `VMAlertmanagerConfig.spec.time_intervals`.' - - If a VMAlertmanager root route has an empty receiver, the operator now sets - it to `blackhole` (previously it picked the first VMAlertmanagerConfig receiver), - which can change alert delivery until you set an explicit receiver. + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator behavior changes for VMAlertmanagerConfig: forbids + cross-resource or global receiver references; config must only reference + local receivers.', 'VMAlertmanagerConfig API change: removed deprecated + `spec.mute_time_intervals`; use `spec.time_intervals` instead.', 'VMAlertmanager + default routing change: if root route receiver is empty, operator now sets + `blackhole` receiver instead of choosing the first VMAlertmanagerConfig + receiver.', 'New CRD/resource support: adds `VLogs` for managing VictoriaLogs + via the operator.', 'Config reloader: new TLS flags for securing the reload + endpoint (`tlsCaFile`, `tlsCertFile`, `tlsKeyFile`, `tlsServerName`, `tlsInsecureSkipVerify`).', + 'VMUser: adds `status.lastSyncError`; adds validation for `spec.targetRefs.crd.kind`; + can skip generating VMAuth config for invalid VMUser refs (recommended to + enable validation webhook).', 'Scrape objects: adds `status` and `lastSyncError` + to `VMServiceScrape`, `VMPodScrape`, `VMNodeScrape`, `VMStaticScrape`, and + `VMScrapeConfig` to track vmagent config generation.', VMAgent config builder + refactor; fixes incorrect skipping logic for scrape objects with bad Secret/ConfigMap + refs., 'Operator metrics endpoint: can secure `metrics-bind-address` with + TLS/mTLS via flags (`tls.*`, `mtls.*`).', 'TLS asset naming fix: adds `configmap` + prefix to ConfigMap-referenced TLS assets to avoid Secret/ConfigMap name + clashes.', 'PodDisruptionBudget finalizer fix: properly releases PDB finalizer + (previously could stick due to typo); plus general finalizer refactor.', + 'Auto-created VMServiceScrape for CRD objects from `extraArgs`: adds `tls_config` + and `authKey` settings.', 'VMAlertmanagerConfig: improved validation and + adds `status`/`lastSyncError` fields.', 'VMAlertmanager: adds `webConfig` + for easier TLS configuration and correct probe/URL generation; adds `gossipConfig` + for client/server TLS on gossip.', 'VMAgent/VMSingle: stream aggregation + options synced with upstream (`dropInputLabels`, `ignoreFirstIntervals`, + `ignoreOldSamples`) and supports configMap as aggregation rules source.', + 'Operator: adds `-client.qps` and `-client.burst` flags to tune Kubernetes + API client behavior.'] + features: [Adds a new `VLogs` custom resource to manage VictoriaLogs through + the operator., Adds TLS configuration options to the config-reloader so + reload endpoints can be secured., Adds status and lastSyncError fields across + scrape-related resources to help troubleshoot vmagent config generation., + Adds operator TLS/mTLS support for the metrics endpoint and improves TLS asset + handling to avoid naming clashes., Enhances VMAlertmanager with webConfig + and gossipConfig for simpler TLS and secure gossip communication., Adds + additional stream aggregation options and supports configMap-based aggregation + rules for vmagent/vmsingle., 'Adds Kubernetes client tuning flags (`client.qps`, + `client.burst`) for large clusters or API rate limiting scenarios.'] + breaking_changes: [VMAlertmanagerConfig can no longer reference receivers across + other VMAlertmanagerConfig objects or use global receiver references; receivers + must be local to the object., '`VMAlertmanagerConfig.spec.mute_time_intervals` + has been removed; migrate to `VMAlertmanagerConfig.spec.time_intervals`.', + 'If a VMAlertmanager root route has an empty receiver, the operator now sets + it to `blackhole` (previously it picked the first VMAlertmanagerConfig receiver), + which can change alert delivery until you set an explicit receiver.'] chart_version: 0.34.0 - images: - - victoriametrics/operator:v0.47.0 + images: ['victoriametrics/operator:v0.47.0'] - version: 0.46.4 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator base image switched from distroless to scratch (v0.46.4); this can - affect debugging/exec tooling and image scanning expectations. - - Operator manifests no longer set an explicit `runAsUser`; it must be defined - via image defaults or pod security context/profile (v0.46.4). - - Config-reloader container no longer specifies `command`; it is defined in - the image now (v0.46.4). - - 'OperatorHub bundle change: `VMAgent` deployment `ServiceAccount vmagent` - is no longer shipped; operator will recreate a new SA with required permissions - after removal (v0.46.4).' - - 'OperatorHub manifests: `webhook.enable` is properly wired for OperatorHub - deployments (v0.46.4).' - - "kubebuilder upgrade v2 \u2192 v4 (v0.46.0) and Kubernetes code-generator\ - \ upgrade v0.27.11 \u2192 v0.30.0 (v0.46.0) \u2014 implies regenerated CRDs/webhooks\ - \ and potential RBAC/manager flag changes." - - "cert-manager API upgrade `certificates.cert-manager.io/v1alpha2` \u2192 `certificates.cert-manager.io/v1`\ - \ (v0.46.0)." - - 'Selector behavior fix: `xxNamespaceSelector` and `xxSelector` were previously - inverted and are corrected (v0.46.0).' - - 'VMNodeScrape scrape_config generation fix: de-dup `series_limit` / `sample_limit` - fields (v0.46.0).' - features: - - VMUser service discovery can now be configured to use HTTPS via a TLS flag - check in `AsURL` (v0.46.0). - - VMRule supports syncing group attributes `eval_offset`, `eval_delay`, and - `eval_alignment` from upstream vmalert group settings (v0.46.0). - - VMAlertmanagerConfig reconcile loop now includes a `handleReconcileErr` callback - to better handle errors and deregister objects (v0.46.0). - breaking_changes: - - "Operator flag deprecations: `--metrics-addr` \u2192 `--metrics-bind-address`,\ - \ `--enable-leader-election` \u2192 `--leader-elect`, `--http.readyListenAddr`\ - \ \u2192 `--health-probe-bind-address` (v0.46.0)." - - 'Remote write multitenancy change: when using `remoteWriteSettings.useMultiTenantMode`, - `remoteWrite.url` must include `/insert/multitenant/` because upstream - vmagent deprecated `-remoteWrite.multitenantURL` (v0.46.0).' - - "OperatorHub VMAgent deployment change: remove the `vmagent` ServiceAccount\ - \ since it\u2019s no longer shipped; operator will create a new SA with needed\ - \ permissions (v0.46.4)." - - Manifests no longer pin `runAsUser`; you must set user at image or security - context/profile level if required by your policies (v0.46.4). - - 'Container entrypoints changed: operator base image is now `scratch` and config-reloader - no longer sets `command` explicitly; any assumptions about shell/tools/command - overrides may break (v0.46.4).' + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator base image switched from distroless to scratch (v0.46.4); + this can affect debugging/exec tooling and image scanning expectations., + Operator manifests no longer set an explicit `runAsUser`; it must be defined + via image defaults or pod security context/profile (v0.46.4)., Config-reloader + container no longer specifies `command`; it is defined in the image now + (v0.46.4)., 'OperatorHub bundle change: `VMAgent` deployment `ServiceAccount + vmagent` is no longer shipped; operator will recreate a new SA with required + permissions after removal (v0.46.4).', 'OperatorHub manifests: `webhook.enable` + is properly wired for OperatorHub deployments (v0.46.4).', "kubebuilder\ + \ upgrade v2 \u2192 v4 (v0.46.0) and Kubernetes code-generator upgrade v0.27.11\ + \ \u2192 v0.30.0 (v0.46.0) \u2014 implies regenerated CRDs/webhooks and\ + \ potential RBAC/manager flag changes.", "cert-manager API upgrade `certificates.cert-manager.io/v1alpha2`\ + \ \u2192 `certificates.cert-manager.io/v1` (v0.46.0).", 'Selector behavior + fix: `xxNamespaceSelector` and `xxSelector` were previously inverted and + are corrected (v0.46.0).', 'VMNodeScrape scrape_config generation fix: de-dup + `series_limit` / `sample_limit` fields (v0.46.0).'] + features: [VMUser service discovery can now be configured to use HTTPS via a + TLS flag check in `AsURL` (v0.46.0)., 'VMRule supports syncing group attributes + `eval_offset`, `eval_delay`, and `eval_alignment` from upstream vmalert + group settings (v0.46.0).', VMAlertmanagerConfig reconcile loop now includes + a `handleReconcileErr` callback to better handle errors and deregister objects + (v0.46.0).] + breaking_changes: ["Operator flag deprecations: `--metrics-addr` \u2192 `--metrics-bind-address`,\ + \ `--enable-leader-election` \u2192 `--leader-elect`, `--http.readyListenAddr`\ + \ \u2192 `--health-probe-bind-address` (v0.46.0).", 'Remote write multitenancy + change: when using `remoteWriteSettings.useMultiTenantMode`, `remoteWrite.url` + must include `/insert/multitenant/` because upstream vmagent deprecated + `-remoteWrite.multitenantURL` (v0.46.0).', "OperatorHub VMAgent deployment\ + \ change: remove the `vmagent` ServiceAccount since it\u2019s no longer\ + \ shipped; operator will create a new SA with needed permissions (v0.46.4).", + Manifests no longer pin `runAsUser`; you must set user at image or security + context/profile level if required by your policies (v0.46.4)., 'Container + entrypoints changed: operator base image is now `scratch` and config-reloader + no longer sets `command` explicitly; any assumptions about shell/tools/command + overrides may break (v0.46.4).'] chart_version: 0.33.6 - images: - - victoriametrics/operator:v0.46.4 + images: ['victoriametrics/operator:v0.46.4'] - version: 0.46.0 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "Operator CLI flags deprecated/renamed: `--metrics-addr`\u2192`--metrics-bind-address`,\ - \ `--enable-leader-election`\u2192`--leader-elect`, `--http.readyListenAddr`\u2192\ - `--health-probe-bind-address` (update your deployment/Helm chart args if you\ - \ set these)." - - 'vmagent multitenancy: when `remoteWriteSettings.useMultiTenantMode` is enabled, - `remoteWrite.url` must include the `/insert/multitenant/` path (upstream - vmagent deprecated `-remoteWrite.multitenantURL` since v1.102.0).' - - 'VMUser service discovery: operator now checks `tls` flag in `AsURL`, enabling - `https` config for VMUser SD.' - - "Kubebuilder upgraded v2\u2192v4 (operator scaffolding/tooling change; may\ - \ affect CRDs generation/behavior)." - - Operator images switched to distroless base (may impact debugging/exec into - container; ensure tooling expectations). - - "cert-manager API upgraded `certificates.cert-manager.io/v1alpha2`\u2192`certificates.cert-manager.io/v1`\ - \ (update CRDs/manifests if you use cert-manager resources)." - - "code-generator upgraded v0.27.11\u2192v0.30.0." - - "Fix selector logic: VM CRs\u2019 `xxNamespaceSelector` and `xxSelector` were\ - \ inverted previously; behavior changes after upgrade (may alter which targets/rules\ - \ are selected)." - - 'VMAlertmanagerConfig reconcile loop: adds missing `handleReconcileErr` to - properly handle errors/deregister objects.' - - 'VMRule: group attributes `eval_offset`, `eval_delay`, `eval_alignment` synced - with upstream vmalert.' - - 'VMNodeScrape: remove duplicated `series_limit` and `sample_limit` fields - in generated `scrape_config`.' - features: - - VMUser service discovery can now be configured for HTTPS via `tls` handling - in URL generation. - - VMRule supports additional group scheduling attributes (`eval_offset`, `eval_delay`, - `eval_alignment`) aligned with upstream vmalert. - - Improved reconciliation robustness for VMAlertmanagerConfig via proper error - handling and object deregistration. - breaking_changes: - - Operator flag names have changed (old flags are deprecated); Helm values/args - must be updated if you set metrics address, leader election, or readiness/health - probe listen address flags. - - 'vmagent multitenancy configuration changes: multitenant write URLs must include - `/insert/multitenant/` when `useMultiTenantMode` is enabled, otherwise - remote write may fail or write to wrong endpoint.' - - 'Selector inversion fix changes behavior: resources selected by `xxSelector`/`xxNamespaceSelector` - may differ after upgrade, potentially adding/removing scrape targets or rules.' + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["Operator CLI flags deprecated/renamed: `--metrics-addr`\u2192\ + `--metrics-bind-address`, `--enable-leader-election`\u2192`--leader-elect`,\ + \ `--http.readyListenAddr`\u2192`--health-probe-bind-address` (update your\ + \ deployment/Helm chart args if you set these).", 'vmagent multitenancy: + when `remoteWriteSettings.useMultiTenantMode` is enabled, `remoteWrite.url` + must include the `/insert/multitenant/` path (upstream vmagent deprecated + `-remoteWrite.multitenantURL` since v1.102.0).', 'VMUser service discovery: + operator now checks `tls` flag in `AsURL`, enabling `https` config for VMUser + SD.', "Kubebuilder upgraded v2\u2192v4 (operator scaffolding/tooling change;\ + \ may affect CRDs generation/behavior).", Operator images switched to distroless + base (may impact debugging/exec into container; ensure tooling expectations)., + "cert-manager API upgraded `certificates.cert-manager.io/v1alpha2`\u2192`certificates.cert-manager.io/v1`\ + \ (update CRDs/manifests if you use cert-manager resources).", "code-generator\ + \ upgraded v0.27.11\u2192v0.30.0.", "Fix selector logic: VM CRs\u2019 `xxNamespaceSelector`\ + \ and `xxSelector` were inverted previously; behavior changes after upgrade\ + \ (may alter which targets/rules are selected).", 'VMAlertmanagerConfig + reconcile loop: adds missing `handleReconcileErr` to properly handle errors/deregister + objects.', 'VMRule: group attributes `eval_offset`, `eval_delay`, `eval_alignment` + synced with upstream vmalert.', 'VMNodeScrape: remove duplicated `series_limit` + and `sample_limit` fields in generated `scrape_config`.'] + features: [VMUser service discovery can now be configured for HTTPS via `tls` + handling in URL generation., 'VMRule supports additional group scheduling + attributes (`eval_offset`, `eval_delay`, `eval_alignment`) aligned with + upstream vmalert.', Improved reconciliation robustness for VMAlertmanagerConfig + via proper error handling and object deregistration.] + breaking_changes: ['Operator flag names have changed (old flags are deprecated); + Helm values/args must be updated if you set metrics address, leader election, + or readiness/health probe listen address flags.', 'vmagent multitenancy + configuration changes: multitenant write URLs must include `/insert/multitenant/` + when `useMultiTenantMode` is enabled, otherwise remote write may fail or + write to wrong endpoint.', 'Selector inversion fix changes behavior: resources + selected by `xxSelector`/`xxNamespaceSelector` may differ after upgrade, + potentially adding/removing scrape targets or rules.'] chart_version: 0.33.1 - images: - - victoriametrics/operator:v0.46.0 + images: ['victoriametrics/operator:v0.46.0'] - version: 0.45.0 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Operator CLI surface changed: only operator-related flags are exposed; transitive - dependency flags removed (may affect Helm chart values that pass extra args).' - - 'Finalizer handling adjusted: uses Patch for finalizer set/unset (0.44.0) - and removes finalizers for child objects with non-empty DeletionTimestamp - (0.45.0) to avoid stuck deletions.' - - "PVC/storageClass reconciliation logic changed: storageClass checks are skipped\ - \ when PVC size doesn\u2019t change (0.45.0)." - - 'VMAgent status enhancements: status.selector is set to better support VPA; - new streamAggrConfig fields added (requires vmagent v1.100+ to use).' - - 'Pause support added: spec.pause field added across multiple CRDs to suspend - reconciliation.' - - "VMAlertmanager secret-name collision behavior changed: if cr.spec.configSecret\ - \ name clashes with operator-managed secret, the CR\u2019s secret content\ - \ is ignored to prevent overwriting." - - 'VMAuth fixes: targetRef URL building when default http port changes; deployment - fix when using custom reloader.' - - 'Converters improved: ScrapeConfig converter copies only spec and fixes ownerRef - type; AlertmanagerConfig converter fix for opsgenie_configs; reduced API discovery - scope to monitoring.coreos.com/* only.' - - 'VMScrapeConfig: authorization.type defaulting to Bearer works with empty - type.' - features: - - New `spec.pause` field on multiple VictoriaMetrics CRDs to suspend operator - reconciliation when needed. - - Additional `vmagent.streamAggrConfig` tuning fields (dedup interval, ignore - old samples, keep metric names, no-align flush) available when running vmagent - v1.100+. - - '`vmagent` now populates `status.selector`, improving compatibility with Vertical - Pod Autoscaler (VPA).' - - Improved and safer conversion tooling for Prometheus Operator resources and - AlertmanagerConfig (including opsgenie receiver configs). - - Reduced cluster API discovery footprint for prometheus-converter by querying - only required API groups. - breaking_changes: - - 'Operator command-line flags exposed by the container changed: transitive - dependency flags were removed. Helm charts that set extraArgs/flags may fail - to start if they pass now-unknown flags.' - - 'VMAlertmanager behavior change on configSecret name collision: if you previously - relied on using the same secret name as the operator-managed secret, your - provided config may now be ignored.' + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator CLI surface changed: only operator-related flags are + exposed; transitive dependency flags removed (may affect Helm chart values + that pass extra args).', 'Finalizer handling adjusted: uses Patch for finalizer + set/unset (0.44.0) and removes finalizers for child objects with non-empty + DeletionTimestamp (0.45.0) to avoid stuck deletions.', "PVC/storageClass\ + \ reconciliation logic changed: storageClass checks are skipped when PVC\ + \ size doesn\u2019t change (0.45.0).", 'VMAgent status enhancements: status.selector + is set to better support VPA; new streamAggrConfig fields added (requires + vmagent v1.100+ to use).', 'Pause support added: spec.pause field added + across multiple CRDs to suspend reconciliation.', "VMAlertmanager secret-name\ + \ collision behavior changed: if cr.spec.configSecret name clashes with\ + \ operator-managed secret, the CR\u2019s secret content is ignored to prevent\ + \ overwriting.", 'VMAuth fixes: targetRef URL building when default http + port changes; deployment fix when using custom reloader.', 'Converters improved: + ScrapeConfig converter copies only spec and fixes ownerRef type; AlertmanagerConfig + converter fix for opsgenie_configs; reduced API discovery scope to monitoring.coreos.com/* + only.', 'VMScrapeConfig: authorization.type defaulting to Bearer works with + empty type.'] + features: [New `spec.pause` field on multiple VictoriaMetrics CRDs to suspend + operator reconciliation when needed., 'Additional `vmagent.streamAggrConfig` + tuning fields (dedup interval, ignore old samples, keep metric names, no-align + flush) available when running vmagent v1.100+.', '`vmagent` now populates + `status.selector`, improving compatibility with Vertical Pod Autoscaler + (VPA).', Improved and safer conversion tooling for Prometheus Operator resources + and AlertmanagerConfig (including opsgenie receiver configs)., Reduced cluster + API discovery footprint for prometheus-converter by querying only required + API groups.] + breaking_changes: ['Operator command-line flags exposed by the container changed: + transitive dependency flags were removed. Helm charts that set extraArgs/flags + may fail to start if they pass now-unknown flags.', 'VMAlertmanager behavior + change on configSecret name collision: if you previously relied on using + the same secret name as the operator-managed secret, your provided config + may now be ignored.'] chart_version: 0.32.3 - images: - - victoriametrics/operator:v0.45.0 + images: ['victoriametrics/operator:v0.45.0'] - version: 0.44.0 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Adds `spec.pause` to multiple CRDs (VMAgent, VMAlert, VMAuth, VMCluster, VMAlertmanager, - VMSingle) to suspend reconciliation. - - Extends `VMAgent.spec.streamAggrConfig` with new options (`dedup_interval`, - `ignore_old_samples`, `keep_metric_names`, `no_align_flush_to_interval`); - requires vmagent v1.100+. - - Sets `VMAgent.status.selector` to support correct integration with Vertical - Pod Autoscaler (VPA). - - Syncs VMAuth/VMUser config fields with upstream vmauth (e.g., `src_query_args`, - `discover_backend_ips`). - - Fixes prometheus-operator ScrapeConfig converter behavior and corrects VMScrapeConfig - owner reference handling. - - Improves VMScrapeConfig SD `authorization` handling when `type` is empty (defaults - to Bearer). - breaking_changes: - - New `streamAggrConfig` fields are only usable with vmagent v1.100+; using - older vmagent versions will prevent using these options (upgrade vmagent first - or avoid setting them). - - If you relied on older operator behavior around finalizer updates, behavior - changes to Patch-based operations may affect custom automation that assumes - full-object updates (generally a fix, but verify). + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Adds `spec.pause` to multiple CRDs (VMAgent, VMAlert, VMAuth, VMCluster, + VMAlertmanager, VMSingle) to suspend reconciliation.', 'Extends `VMAgent.spec.streamAggrConfig` + with new options (`dedup_interval`, `ignore_old_samples`, `keep_metric_names`, + `no_align_flush_to_interval`); requires vmagent v1.100+.', Sets `VMAgent.status.selector` + to support correct integration with Vertical Pod Autoscaler (VPA)., 'Syncs + VMAuth/VMUser config fields with upstream vmauth (e.g., `src_query_args`, + `discover_backend_ips`).', Fixes prometheus-operator ScrapeConfig converter + behavior and corrects VMScrapeConfig owner reference handling., Improves + VMScrapeConfig SD `authorization` handling when `type` is empty (defaults + to Bearer).] + breaking_changes: [New `streamAggrConfig` fields are only usable with vmagent + v1.100+; using older vmagent versions will prevent using these options (upgrade + vmagent first or avoid setting them)., 'If you relied on older operator + behavior around finalizer updates, behavior changes to Patch-based operations + may affect custom automation that assumes full-object updates (generally + a fix, but verify).'] chart_version: 0.31.2 - images: - - victoriametrics/operator:v0.44.0 + images: ['victoriametrics/operator:v0.44.0'] - version: 0.43.0 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Removes deprecated `VMClusterSpec.VMInsert.Name`, `VMClusterSpec.VMStorage.Name`, - and `VMClusterSpec.VMSelect.Name` fields (deprecated since v0.21.0). - - PodSecurityPolicy (PSP) support removed; operator no longer creates PSP objects. - - PodDisruptionBudget API switched from `policy/v1beta1` to stable `policy/v1`. - - Alertmanager versions < v0.22.0 are no longer supported; default bumped to - v0.27.0. - - 'ServiceAccount reconcile behavior changed: operator only creates/updates - ServiceAccounts when SA field is omitted in CRD; avoids ownership race conditions.' - - Operator watches fewer owned resources (no longer watches Service/Secret/ConfigMap - changes), reducing log/CPU/memory usage. - - 'Config-reloader: exposes HTTP port 8435; new `configReloaderExtraArgs` field - for several CRDs; adds new config-reloader container for VMAlertmanagerConfig - and adds metrics.' - - 'Reconcile behavior improved: Kubernetes Events emitted on reconcile errors; - retries on conflict errors.' - - '`serviceSpec.useAsDefault=true` allows adjusting operator-generated Services.' - - 'VMAgent statefulMode service behavior changed: now headless; `serviceName` - customizable for custom Service.' - - 'Scrape CRDs updated: add `attach_metadata`; add `series_limit`; fix `disable_keep_alive` - field name; deprecate `relabel_debug` and `metric_relabel_debug`.' - - Adds new CRD `VMScrapeConfig` for arbitrary SD-based scrape configs. - - 'Other CRD additions: VMUser `targetRefBasicAuth`, VMProbe `proxy_url`, VMAgent - multiline regex relabeling; Sigv4Config tag fix.' - - Base images/dependencies updated for CVE fixes; VictoriaMetrics images bumped - to v1.100.1. - features: - - New `VMScrapeConfig` CRD enables defining scrape configs with any SD mechanism - supported by VictoriaMetrics. - - Scrape CRDs gained `attach_metadata` (Prometheus-like) and `series_limit` - to control label metadata attachment and cap per-target series. - - 'Config reloader improvements: dedicated reloader for VMAlertmanagerConfig, - new error/health metrics, exposed HTTP port 8435, and per-CRD extra args via - `configReloaderExtraArgs`.' - - VMUser can now configure basic auth for `target_url` via `targetRefBasicAuth`; - VMProbe supports `proxy_url`. - - VMAgent relabeling supports multi-line regex; stateful mode service can be - customized. - breaking_changes: - - Removed deprecated `Name` fields from VMCluster component specs; manifests - using them must be updated/removed. - - PodSecurityPolicy objects are no longer managed/created by the operator; clusters - relying on PSP must migrate to Pod Security Admission/other policy controls. - - PodDisruptionBudget `policy/v1beta1` is no longer supported; ensure your cluster - and any custom manifests use `policy/v1`. - - Alertmanager versions below v0.22.0 are unsupported; upgrade Alertmanager - (or use operator defaults) before/with this operator upgrade. - - VMAgent statefulMode Service changed to headless; any consumers assuming a - ClusterIP Service may need updates (DNS/discovery/load-balancing behavior - changes). + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Removes deprecated `VMClusterSpec.VMInsert.Name`, `VMClusterSpec.VMStorage.Name`, + and `VMClusterSpec.VMSelect.Name` fields (deprecated since v0.21.0).', PodSecurityPolicy + (PSP) support removed; operator no longer creates PSP objects., PodDisruptionBudget + API switched from `policy/v1beta1` to stable `policy/v1`., Alertmanager + versions < v0.22.0 are no longer supported; default bumped to v0.27.0., + 'ServiceAccount reconcile behavior changed: operator only creates/updates + ServiceAccounts when SA field is omitted in CRD; avoids ownership race conditions.', + 'Operator watches fewer owned resources (no longer watches Service/Secret/ConfigMap + changes), reducing log/CPU/memory usage.', 'Config-reloader: exposes HTTP + port 8435; new `configReloaderExtraArgs` field for several CRDs; adds new + config-reloader container for VMAlertmanagerConfig and adds metrics.', 'Reconcile + behavior improved: Kubernetes Events emitted on reconcile errors; retries + on conflict errors.', '`serviceSpec.useAsDefault=true` allows adjusting + operator-generated Services.', 'VMAgent statefulMode service behavior changed: + now headless; `serviceName` customizable for custom Service.', 'Scrape CRDs + updated: add `attach_metadata`; add `series_limit`; fix `disable_keep_alive` + field name; deprecate `relabel_debug` and `metric_relabel_debug`.', Adds + new CRD `VMScrapeConfig` for arbitrary SD-based scrape configs., 'Other + CRD additions: VMUser `targetRefBasicAuth`, VMProbe `proxy_url`, VMAgent + multiline regex relabeling; Sigv4Config tag fix.', Base images/dependencies + updated for CVE fixes; VictoriaMetrics images bumped to v1.100.1.] + features: [New `VMScrapeConfig` CRD enables defining scrape configs with any + SD mechanism supported by VictoriaMetrics., Scrape CRDs gained `attach_metadata` + (Prometheus-like) and `series_limit` to control label metadata attachment + and cap per-target series., 'Config reloader improvements: dedicated reloader + for VMAlertmanagerConfig, new error/health metrics, exposed HTTP port 8435, + and per-CRD extra args via `configReloaderExtraArgs`.', VMUser can now configure + basic auth for `target_url` via `targetRefBasicAuth`; VMProbe supports `proxy_url`., + VMAgent relabeling supports multi-line regex; stateful mode service can be + customized.] + breaking_changes: [Removed deprecated `Name` fields from VMCluster component + specs; manifests using them must be updated/removed., PodSecurityPolicy + objects are no longer managed/created by the operator; clusters relying + on PSP must migrate to Pod Security Admission/other policy controls., PodDisruptionBudget + `policy/v1beta1` is no longer supported; ensure your cluster and any custom + manifests use `policy/v1`., Alertmanager versions below v0.22.0 are unsupported; + upgrade Alertmanager (or use operator defaults) before/with this operator + upgrade., VMAgent statefulMode Service changed to headless; any consumers + assuming a ClusterIP Service may need updates (DNS/discovery/load-balancing + behavior changes).] chart_version: 0.30.0 - images: - - victoriametrics/operator:v0.43.0 + images: ['victoriametrics/operator:v0.43.0'] - version: 0.42.4 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: null chart_version: 0.29.6 - images: - - victoriametrics/operator:v0.42.4 + images: ['victoriametrics/operator:v0.42.4'] - version: 0.42.0 - kube: - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator now supports watching multiple namespaces via comma-separated `WATCH_NAMESPACE` - (enables multi-namespace mode without cluster-wide permissions); requires - appropriate namespace-scoped RBAC (see `config/examples/operator_rbac_for_single_namespace.yaml`). - - 'Logging: operator adds more context to log messages to improve debugging - and log quality.' - - Runtime dependencies updated (controller-runtime, controller-gen); may affect - build/runtime behavior if you vendor/pin these elsewhere. - - All pod-producing CRs now expose a `status.updateStatus` field to better track - rollouts. - - All pod-producing CRs now get annotation `operator.victoriametrics/last-applied-spec` - to track applied spec and enable proper resource cleanup later. - - VictoriaMetrics component image tags updated to v1.99.0 (from v1.97.1 in 0.41.1). - - 'vmalertmanager: default router changes to `blackhole` when no config is provided - (previously dummy webhook).' - - 'vmalertmanager: template path assignment fixed when templates are set both - in config file and via `spec.templates`.' - - 'vmauth: new `spec.configSecret` to load external config from a Secret key - `config.yaml`; changes can be watched with `extraArgs.configCheckInterval` - or a config-reloader sidecar.' - - 'vmagent: `streamAggrConfig.flush_on_shutdown` added.' - - 'vmagent: experimental `spec.ingestOnlyMode` added (runs without scrape config/config - reloaders; currently also disables TLS and auth for remoteWrites).' - - "vmcluster/vmstorage: PVC resize disabling annotation `operator.victoriametrics.com/pvc-allow-volume-expansion`\ - \ behavior changed\u2014now evaluated at StatefulSet storage spec level (not\ - \ per-PVC); enables adding a PVC autoscaler." - - 'APIs: missing static config relabeling added with tests.' - features: - - Multi-namespace watch support via comma-separated `WATCH_NAMESPACE` without - needing cluster-wide permissions (with namespace RBAC). - - Improved rollout observability via `status.updateStatus` on all resources - that create pods. - - Spec change tracking via `operator.victoriametrics/last-applied-spec` annotation - on pod-producing resources. - - 'New vmagent options: `flush_on_shutdown` for stream aggregation, and experimental - `ingestOnlyMode` to run without scrapes/config reloaders.' - - New vmauth `spec.configSecret` to source config from a Secret and optionally - reload/check periodically. - - vmstorage/vmcluster gains better control of PVC expansion policy at storage - spec level and supports PVC autoscaler workflows. - breaking_changes: - - "vmalertmanager default routing behavior changes: if no configuration is provided,\ - \ it now uses `blackhole` instead of a dummy webhook\u2014could change how\ - \ unconfigured alerts are handled (dropped vs previously sent somewhere)." - - PVC expansion disabling check moved from per-PVC to StatefulSet storage spec - level; clusters relying on the old per-PVC annotation behavior may see different - resize outcomes after upgrade. - - "`vmagent.spec.ingestOnlyMode` is experimental and currently disables TLS/auth\ - \ for remoteWrite endpoints when enabled\u2014treat as a behavioral change\ - \ if you plan to use it." + kube: ['1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator now supports watching multiple namespaces via comma-separated + `WATCH_NAMESPACE` (enables multi-namespace mode without cluster-wide permissions); + requires appropriate namespace-scoped RBAC (see `config/examples/operator_rbac_for_single_namespace.yaml`)., + 'Logging: operator adds more context to log messages to improve debugging + and log quality.', 'Runtime dependencies updated (controller-runtime, controller-gen); + may affect build/runtime behavior if you vendor/pin these elsewhere.', All + pod-producing CRs now expose a `status.updateStatus` field to better track + rollouts., All pod-producing CRs now get annotation `operator.victoriametrics/last-applied-spec` + to track applied spec and enable proper resource cleanup later., VictoriaMetrics + component image tags updated to v1.99.0 (from v1.97.1 in 0.41.1)., 'vmalertmanager: + default router changes to `blackhole` when no config is provided (previously + dummy webhook).', 'vmalertmanager: template path assignment fixed when templates + are set both in config file and via `spec.templates`.', 'vmauth: new `spec.configSecret` + to load external config from a Secret key `config.yaml`; changes can be + watched with `extraArgs.configCheckInterval` or a config-reloader sidecar.', + 'vmagent: `streamAggrConfig.flush_on_shutdown` added.', 'vmagent: experimental + `spec.ingestOnlyMode` added (runs without scrape config/config reloaders; + currently also disables TLS and auth for remoteWrites).', "vmcluster/vmstorage:\ + \ PVC resize disabling annotation `operator.victoriametrics.com/pvc-allow-volume-expansion`\ + \ behavior changed\u2014now evaluated at StatefulSet storage spec level\ + \ (not per-PVC); enables adding a PVC autoscaler.", 'APIs: missing static + config relabeling added with tests.'] + features: [Multi-namespace watch support via comma-separated `WATCH_NAMESPACE` + without needing cluster-wide permissions (with namespace RBAC)., Improved + rollout observability via `status.updateStatus` on all resources that create + pods., Spec change tracking via `operator.victoriametrics/last-applied-spec` + annotation on pod-producing resources., 'New vmagent options: `flush_on_shutdown` + for stream aggregation, and experimental `ingestOnlyMode` to run without + scrapes/config reloaders.', New vmauth `spec.configSecret` to source config + from a Secret and optionally reload/check periodically., vmstorage/vmcluster + gains better control of PVC expansion policy at storage spec level and supports + PVC autoscaler workflows.] + breaking_changes: ["vmalertmanager default routing behavior changes: if no configuration\ + \ is provided, it now uses `blackhole` instead of a dummy webhook\u2014\ + could change how unconfigured alerts are handled (dropped vs previously\ + \ sent somewhere).", PVC expansion disabling check moved from per-PVC to + StatefulSet storage spec level; clusters relying on the old per-PVC annotation + behavior may see different resize outcomes after upgrade., "`vmagent.spec.ingestOnlyMode`\ + \ is experimental and currently disables TLS/auth for remoteWrite endpoints\ + \ when enabled\u2014treat as a behavioral change if you plan to use it."] chart_version: 0.29.0 - images: - - victoriametrics/operator:v0.42.0 + images: ['victoriametrics/operator:v0.42.0'] - version: 0.41.1 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Operator-managed VictoriaMetrics component image tags are updated to VictoriaMetrics - v1.97.1 (via operator v0.41.1), which may pull in changes from the VictoriaMetrics - application release. - - '(From the starting version v0.40.0) VMUser gained new fields: drop_src_path_prefix_parts, - tls_insecure_skip_verify, metric_labels, and load_balancing_policy (note: - metric_labels requires VMAuth >= v1.97.0).' - - (From the starting version v0.40.0) Added revisionHistoryLimitCount and MinReadySeconds - parameters for VictoriaMetrics workload CRDs. - - '(From the starting version v0.40.0) VMAlertmanagerConfig gained additional - receiver type support: discord_configs, msteams_configs, sns_configs, webex_configs.' - - (From the starting version v0.40.0) Added alerting rules for the operator - itself. + features: ['Operator-managed VictoriaMetrics component image tags are updated + to VictoriaMetrics v1.97.1 (via operator v0.41.1), which may pull in changes + from the VictoriaMetrics application release.', '(From the starting version + v0.40.0) VMUser gained new fields: drop_src_path_prefix_parts, tls_insecure_skip_verify, + metric_labels, and load_balancing_policy (note: metric_labels requires VMAuth + >= v1.97.0).', (From the starting version v0.40.0) Added revisionHistoryLimitCount + and MinReadySeconds parameters for VictoriaMetrics workload CRDs., '(From + the starting version v0.40.0) VMAlertmanagerConfig gained additional receiver + type support: discord_configs, msteams_configs, sns_configs, webex_configs.', + (From the starting version v0.40.0) Added alerting rules for the operator + itself.] breaking_changes: [] chart_version: 0.28.0 - images: - - victoriametrics/operator:v0.41.1 + images: ['victoriametrics/operator:v0.41.1'] - version: 0.40.0 - kube: - - '1.29' - - '1.28' - - '1.27' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Fix VMAlertmanagerConfig discovery to match documented behavior. - - Add optional built-in alerting rules for vmoperator itself (operator self-monitoring). - - 'Add new CRD fields for workloads: `revisionHistoryLimitCount` and `minReadySeconds` - across Victoriametrics workload CRDs.' - - 'Extend VMAlertmanagerConfig CRD to support additional receiver types: `discord_configs`, - `msteams_configs`, `sns_configs`, `webex_configs`.' - - 'Extend VMUser CRD with new fields: `drop_src_path_prefix_parts`, `tls_insecure_skip_verify`, - `metric_labels`, `load_balancing_policy`.' - features: - - Operator can now ship alerting rules for itself, improving observability of - operator health and reconciliation issues. - - VMUser adds new auth/routing knobs (drop path prefix parts, TLS skip verify, - metric label injection, load balancing policy); note `metric_labels` requires - VMAuth >= v1.97.0. - - VMAlertmanagerConfig supports more receiver integrations (Discord, MS Teams, - AWS SNS, Webex) and has corrected discovery behavior. - - Workload CRDs gain `minReadySeconds` and `revisionHistoryLimitCount` to control - rollout readiness and ReplicaSet history retention. - breaking_changes: - - '`VMAlertmanagerConfig` discovery behavior is fixed to match docs; if you - relied on the previous (incorrect) discovery semantics, existing AlertmanagerConfig - objects selected/discovered by vmalertmanager may change and should be revalidated - after upgrade.' + kube: ['1.29', '1.28', '1.27'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Fix VMAlertmanagerConfig discovery to match documented behavior., + Add optional built-in alerting rules for vmoperator itself (operator self-monitoring)., + 'Add new CRD fields for workloads: `revisionHistoryLimitCount` and `minReadySeconds` + across Victoriametrics workload CRDs.', 'Extend VMAlertmanagerConfig CRD + to support additional receiver types: `discord_configs`, `msteams_configs`, + `sns_configs`, `webex_configs`.', 'Extend VMUser CRD with new fields: `drop_src_path_prefix_parts`, + `tls_insecure_skip_verify`, `metric_labels`, `load_balancing_policy`.'] + features: ['Operator can now ship alerting rules for itself, improving observability + of operator health and reconciliation issues.', 'VMUser adds new auth/routing + knobs (drop path prefix parts, TLS skip verify, metric label injection, + load balancing policy); note `metric_labels` requires VMAuth >= v1.97.0.', + 'VMAlertmanagerConfig supports more receiver integrations (Discord, MS Teams, + AWS SNS, Webex) and has corrected discovery behavior.', Workload CRDs gain + `minReadySeconds` and `revisionHistoryLimitCount` to control rollout readiness + and ReplicaSet history retention.] + breaking_changes: ['`VMAlertmanagerConfig` discovery behavior is fixed to match + docs; if you relied on the previous (incorrect) discovery semantics, existing + AlertmanagerConfig objects selected/discovered by vmalertmanager may change + and should be revalidated after upgrade.'] chart_version: 0.27.10 - images: - - victoriametrics/operator:v0.40.0 + images: ['victoriametrics/operator:v0.40.0'] - version: 0.39.4 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: null chart_version: 0.27.9 - images: - - victoriametrics/operator:v0.39.3 + images: ['victoriametrics/operator:v0.39.3'] - version: 0.39.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - vmagent/vmauth default config-reloader image was upgraded (impacts the sidecar/init - behavior and image pull). - - 'VMUser gained new vmauth options: `retry_status_codes`, `max_concurrent_requests`, - and `response_headers` (requires vmauth >= v1.94.0).' - - New per-component `useStrictSecurity` flag allows gradual migration from insecure - to strict security without breaking all components at once. - - Operator can now accept/provide an enterprise license key for VictoriaMetrics - enterprise components. + features: [vmagent/vmauth default config-reloader image was upgraded (impacts + the sidecar/init behavior and image pull)., 'VMUser gained new vmauth options: + `retry_status_codes`, `max_concurrent_requests`, and `response_headers` + (requires vmauth >= v1.94.0).', New per-component `useStrictSecurity` flag + allows gradual migration from insecure to strict security without breaking + all components at once., Operator can now accept/provide an enterprise license + key for VictoriaMetrics enterprise components.] breaking_changes: [] chart_version: 0.27.3 - images: - - victoriametrics/operator:v0.39.0 + images: ['victoriametrics/operator:v0.39.0'] - version: 0.38.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds the ability for vmoperator to print the default values for all operator - environment variables (useful for debugging/config discovery). + features: [Adds the ability for vmoperator to print the default values for all + operator environment variables (useful for debugging/config discovery).] breaking_changes: [] chart_version: 0.27.1 - images: - - victoriametrics/operator:v0.38.0 + images: ['victoriametrics/operator:v0.38.0'] - version: 0.37.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'VMAlert/VMRule/VMagent/VMSingle: streaming aggregation enhancements introduced - in v0.36.0 (dropInput, list support for match, staleness_interval).' - - 'VMRule: new rule fields update_entries_limit and keep_firing_for supported - (v0.36.0).' - - 'Operator: new VM_ENABLESTRICTSECURITY env var; strict security context enabled - by default (v0.36.0).' - - 'VMagent: multiple `if` conditions for relabeling supported (v0.37.0).' - breaking_changes: - - 'VMAlert CRD: field `OAuth2` renamed to `oauth2` in several VMAlert spec sections; - manifests must be updated and reapplied after upgrade (v0.36.0).' - - 'VMAlert CRD: field `bearerTokenFilePath` renamed to `bearerTokenFile` in - several VMAlert spec sections; manifests must be updated and reapplied after - upgrade (v0.36.0).' + features: ['VMAlert/VMRule/VMagent/VMSingle: streaming aggregation enhancements + introduced in v0.36.0 (dropInput, list support for match, staleness_interval).', + 'VMRule: new rule fields update_entries_limit and keep_firing_for supported + (v0.36.0).', 'Operator: new VM_ENABLESTRICTSECURITY env var; strict security + context enabled by default (v0.36.0).', 'VMagent: multiple `if` conditions + for relabeling supported (v0.37.0).'] + breaking_changes: ['VMAlert CRD: field `OAuth2` renamed to `oauth2` in several + VMAlert spec sections; manifests must be updated and reapplied after upgrade + (v0.36.0).', 'VMAlert CRD: field `bearerTokenFilePath` renamed to `bearerTokenFile` + in several VMAlert spec sections; manifests must be updated and reapplied + after upgrade (v0.36.0).'] chart_version: 0.26.0 - images: - - victoriametrics/operator:v0.37.0 + images: ['victoriametrics/operator:v0.37.0'] - version: 0.36.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -37866,752 +27981,549 @@ addons: \ by default**.\n - `VM_PSPAUTOCREATEENABLED`: default changed from `true`\ \ -> `false` (PSP is deprecated since k8s v1.25).\n" chart_updates: [] - features: - - 'Streaming aggregation support updates for vmagent/vmsingle: `streamAggr.dropInput`, - list support for `match`, and `staleness_interval`.' - - VMRule supports `update_entries_limit` and `keep_firing_for` fields (vmalert - rule features). - - 'New example manifests: vmagent stateful mode with sharding; vmcluster with - additional/custom storage claims.' - - Operator can run with strict security context by default via new `VM_ENABLESTRICTSECURITY` - parameter. - breaking_changes: - - 'VMAlert CRD field rename: `OAuth2` -> `oauth2` across datasource/notifier/notifiers/remoteRead/remoteWrite; - any existing configs must be reapplied with the new field name after upgrade.' - - 'VMAlert CRD field rename: `bearerTokenFilePath` -> `bearerTokenFile` across - datasource/notifier/notifiers/remoteRead/remoteWrite; any existing configs - must be reapplied with the new field name after upgrade.' + features: ['Streaming aggregation support updates for vmagent/vmsingle: `streamAggr.dropInput`, + list support for `match`, and `staleness_interval`.', VMRule supports `update_entries_limit` + and `keep_firing_for` fields (vmalert rule features)., 'New example manifests: + vmagent stateful mode with sharding; vmcluster with additional/custom storage + claims.', Operator can run with strict security context by default via new + `VM_ENABLESTRICTSECURITY` parameter.] + breaking_changes: ['VMAlert CRD field rename: `OAuth2` -> `oauth2` across datasource/notifier/notifiers/remoteRead/remoteWrite; + any existing configs must be reapplied with the new field name after upgrade.', + 'VMAlert CRD field rename: `bearerTokenFilePath` -> `bearerTokenFile` across + datasource/notifier/notifiers/remoteRead/remoteWrite; any existing configs + must be reapplied with the new field name after upgrade.'] chart_version: 0.25.0 - images: - - victoriametrics/operator:v0.36.0 + images: ['victoriametrics/operator:v0.36.0'] - version: 0.35.0 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'vmagent: adds validation when generating static scrape config (may reject - previously accepted invalid configs).' - - 'vmalertmanagerconfig: adds validation for Slack receiver URL.' - - 'vmauth/vmagent: implement config initiation flow for a custom config reloader - (changes how custom reloader is bootstrapped).' - - Adds more generators (additional supported config/resource generation options). - - 'vmsingle: adds a status field to the CR status (more observable state).' + features: ['vmagent: adds validation when generating static scrape config (may + reject previously accepted invalid configs).', 'vmalertmanagerconfig: adds + validation for Slack receiver URL.', 'vmauth/vmagent: implement config initiation + flow for a custom config reloader (changes how custom reloader is bootstrapped).', + Adds more generators (additional supported config/resource generation options)., + 'vmsingle: adds a status field to the CR status (more observable state).'] breaking_changes: [] chart_version: 0.24.0 - images: - - victoriametrics/operator:v0.35.0 + images: ['victoriametrics/operator:v0.35.0'] - version: 0.34.0 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - VMAlertmanager now defaults/bundles Alertmanager v0.25.0. - - VMCluster adds `clusterNativePort` on VMSelect/VMInsert to support multi-level - cluster topologies. - - VMRule gains `notifierHeader` to attach custom headers for notifications. - - VMPodScrape adds `FilterRunning` option (similar to Prometheus) to scrape - only running pods. - - VMAuth incorporates latest upstream VMAuth feature set (behavior depends on - VMAuth version used). - breaking_changes: - - 'If you run the operator in single-namespace mode via `WATCH_NAMESPACE`, behavior - changes: it will no longer access cluster-wide resources and will only create - single-namespace config for VMAgent. This may require revisiting RBAC/ClusterRole - assumptions and any setups relying on cluster-wide discovery.' + features: [VMAlertmanager now defaults/bundles Alertmanager v0.25.0., VMCluster + adds `clusterNativePort` on VMSelect/VMInsert to support multi-level cluster + topologies., VMRule gains `notifierHeader` to attach custom headers for + notifications., VMPodScrape adds `FilterRunning` option (similar to Prometheus) + to scrape only running pods., VMAuth incorporates latest upstream VMAuth + feature set (behavior depends on VMAuth version used).] + breaking_changes: ['If you run the operator in single-namespace mode via `WATCH_NAMESPACE`, + behavior changes: it will no longer access cluster-wide resources and will + only create single-namespace config for VMAgent. This may require revisiting + RBAC/ClusterRole assumptions and any setups relying on cluster-wide discovery.'] chart_version: 0.23.0 - images: - - victoriametrics/operator:v0.34.0 + images: ['victoriametrics/operator:v0.34.0'] - version: 0.33.0 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'VMAlertmanager: new option to disable route `continue` enforcement (lets - you keep Alertmanager-style routing semantics if you rely on `continue: true`).' - - 'VMAlertmanagerConfig: can now set `require_tls: false` for email receivers - and adds sanity checks to validate configs earlier.' - - 'VMAlertmanagerConfig: adds `sound` field support for Pushover notifications.' - - 'VMAgent/VMAuth: can download initial config via an initContainer, improving - first-start reliability when config is generated/served externally.' - - 'Build: Alpine base image bumped to v3.17.3 (security/patch updates).' + features: ['VMAlertmanager: new option to disable route `continue` enforcement + (lets you keep Alertmanager-style routing semantics if you rely on `continue: + true`).', 'VMAlertmanagerConfig: can now set `require_tls: false` for email + receivers and adds sanity checks to validate configs earlier.', 'VMAlertmanagerConfig: + adds `sound` field support for Pushover notifications.', 'VMAgent/VMAuth: + can download initial config via an initContainer, improving first-start + reliability when config is generated/served externally.', 'Build: Alpine + base image bumped to v3.17.3 (security/patch updates).'] breaking_changes: [] chart_version: 0.21.0 - images: - - victoriametrics/operator:v0.33.0 + images: ['victoriametrics/operator:v0.33.0'] - version: 0.32.1 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - No new features in v0.32.1; it is a patch release focused on fixes. - - "v0.32.1 makes vmsingle\u2019s stream aggregation config conditional, preventing\ - \ it from being injected when not configured/needed." + features: [No new features in v0.32.1; it is a patch release focused on fixes., + "v0.32.1 makes vmsingle\u2019s stream aggregation config conditional, preventing\ + \ it from being injected when not configured/needed."] breaking_changes: [] chart_version: 0.20.1 - images: - - victoriametrics/operator:v0.32.1 + images: ['victoriametrics/operator:v0.32.1'] - version: 0.32.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - '**vmauth**: `config-reloader` is now auto-configured with `proxy-protocol` - client support and `reloadAuthKey` handling, reducing manual config for auth - reload behavior.' - - '**vmagent**: new global `scrapeTimeout` setting can be set via the VMAgent - CR to control scrape timeouts consistently.' - - '**vmagent remoteWrite**: adds support for streaming aggregation configuration - for remoteWrite targets (see VictoriaMetrics stream aggregation docs).' - - '**vmsingle**: adds global streaming aggregation configuration for the database, - enabling server-side aggregation pipelines.' + features: ['**vmauth**: `config-reloader` is now auto-configured with `proxy-protocol` + client support and `reloadAuthKey` handling, reducing manual config for + auth reload behavior.', '**vmagent**: new global `scrapeTimeout` setting + can be set via the VMAgent CR to control scrape timeouts consistently.', + '**vmagent remoteWrite**: adds support for streaming aggregation configuration + for remoteWrite targets (see VictoriaMetrics stream aggregation docs).', + '**vmsingle**: adds global streaming aggregation configuration for the database, + enabling server-side aggregation pipelines.'] breaking_changes: [] chart_version: 0.20.0 - images: - - victoriametrics/operator:v0.32.0 + images: ['victoriametrics/operator:v0.32.0'] - version: 0.31.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'vmalertmanager: adds support for `vmalertmanager.spec.templates`, including - auto-reload directories for templates and configmaps.' - - 'vmagent: adds support for the `%SHARD_NUM%` placeholder when generating/templating - vmagent StatefulSet/Deployment (useful for sharded setups).' - breaking_changes: - - HPA API handling changed to avoid deprecated autoscaling v2beta on Kubernetes - 1.26+; if you have custom manifests/overrides expecting v2beta, they may need - adjustment. + features: ['vmalertmanager: adds support for `vmalertmanager.spec.templates`, + including auto-reload directories for templates and configmaps.', 'vmagent: + adds support for the `%SHARD_NUM%` placeholder when generating/templating + vmagent StatefulSet/Deployment (useful for sharded setups).'] + breaking_changes: ['HPA API handling changed to avoid deprecated autoscaling + v2beta on Kubernetes 1.26+; if you have custom manifests/overrides expecting + v2beta, they may need adjustment.'] chart_version: 0.19.0 - images: - - victoriametrics/operator:v0.31.0 + images: ['victoriametrics/operator:v0.31.0'] - version: 0.30.3 - kube: - - '1.26' - - '1.25' - - '1.24' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - v0.30.0 added the Scaling subresource for `VMAgent`, enabling use of the Kubernetes - scale API (e.g., `kubectl scale`) against the CRD. - - v0.30.0 introduced optional namespace label matching for inhibit rules, improving - alert inhibition scoping. - - v0.30.0 started publishing CRDs YAML as a release asset, making CRD management - outside Helm easier. - - v0.30.0 added child labels filtering to control which labels propagate to - generated child resources. - - v0.30.0 added OAuth2 and bearer auth support for vmalert remote DB connections. - breaking_changes: - - Kubernetes 1.26+ deprecates `autoscaling/v2beta2`; v0.30.3 adds an API-availability - check, which may change HPA behavior if your cluster only supports certain - autoscaling API versions. - - PVC resize logic in v0.30.3 now uses corrected selector labels; if you relied - on the previous (incorrect) labels for automation/monitoring, behavior/metrics - selection may differ. + kube: ['1.26', '1.25', '1.24'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['v0.30.0 added the Scaling subresource for `VMAgent`, enabling use + of the Kubernetes scale API (e.g., `kubectl scale`) against the CRD.', 'v0.30.0 + introduced optional namespace label matching for inhibit rules, improving + alert inhibition scoping.', 'v0.30.0 started publishing CRDs YAML as a release + asset, making CRD management outside Helm easier.', v0.30.0 added child + labels filtering to control which labels propagate to generated child resources., + v0.30.0 added OAuth2 and bearer auth support for vmalert remote DB connections.] + breaking_changes: ['Kubernetes 1.26+ deprecates `autoscaling/v2beta2`; v0.30.3 + adds an API-availability check, which may change HPA behavior if your cluster + only supports certain autoscaling API versions.', 'PVC resize logic in v0.30.3 + now uses corrected selector labels; if you relied on the previous (incorrect) + labels for automation/monitoring, behavior/metrics selection may differ.'] chart_version: 0.17.2 - images: - - victoriametrics/operator:v0.30.3 + images: ['victoriametrics/operator:v0.30.3'] - version: 0.30.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds a Scaling subresource for `VMAgent`, enabling kubectl/HPA-style scaling - interactions without editing the full spec. - - Adds an optional namespace label matcher to inhibit rules (Alertmanager config), - giving finer control over inhibition behavior across namespaces. - - Publishes CRDs YAML as a release asset, simplifying CRD installation/updates - outside of Helm or Git checkout. - - Introduces child labels filtering to better control which labels propagate - from parent/owner resources to generated objects. - - '`vmalert` controller adds OAuth2 and bearer-token auth support for remote - read/query databases, improving secured integrations.' + features: ['Adds a Scaling subresource for `VMAgent`, enabling kubectl/HPA-style + scaling interactions without editing the full spec.', 'Adds an optional + namespace label matcher to inhibit rules (Alertmanager config), giving finer + control over inhibition behavior across namespaces.', 'Publishes CRDs YAML + as a release asset, simplifying CRD installation/updates outside of Helm + or Git checkout.', Introduces child labels filtering to better control which + labels propagate from parent/owner resources to generated objects., '`vmalert` + controller adds OAuth2 and bearer-token auth support for remote read/query + databases, improving secured integrations.'] breaking_changes: [] chart_version: 0.17.0 - images: - - victoriametrics/operator:v0.30.0 + images: ['victoriametrics/operator:v0.30.0'] - version: 0.29.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Operator fix: VMCluster now reconciles VMStorage even when the PodDisruptionBudget - object is missing.' - - Fix for Kubernetes 1.25 crash. - - 'vmagent/vmalert: reduce/handle throttling issues more safely.' - - 'vmalertmanagerconfig: fixes for parsing nested routes plus correct OwnerReference - handling.' - - 'vmagent: allow maxDiskUsage values > 1GB.' - - 'vmagent: correctly merge ports when using an additional Service.' - - 'vmprobe: correctly set labels for ingress targets.' - - 'PodDisruptionBudget: add configurable selectors (new capability in how PDBs - are generated/selected).' - features: - - PodDisruptionBudget support gains configurable selectors, allowing more control - over which pods a PDB targets. + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator fix: VMCluster now reconciles VMStorage even when + the PodDisruptionBudget object is missing.', Fix for Kubernetes 1.25 crash., + 'vmagent/vmalert: reduce/handle throttling issues more safely.', 'vmalertmanagerconfig: + fixes for parsing nested routes plus correct OwnerReference handling.', + 'vmagent: allow maxDiskUsage values > 1GB.', 'vmagent: correctly merge ports + when using an additional Service.', 'vmprobe: correctly set labels for ingress + targets.', 'PodDisruptionBudget: add configurable selectors (new capability + in how PDBs are generated/selected).'] + features: ['PodDisruptionBudget support gains configurable selectors, allowing + more control over which pods a PDB targets.'] breaking_changes: [] chart_version: 0.15.0 - images: - - victoriametrics/operator:v0.29.0 + images: ['victoriametrics/operator:v0.29.0'] - version: 0.28.3 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - TLS endpoint support for the vmauth config reloader (improves secure reload - hookups). - - 'New/expanded CRD capabilities: `claimTemplates` supported for `VMCluster`, - `VMAlertmanager`, and `VMAgent`; `readinessGates` supported on CRD objects; - health checks now respect TLS settings on CRDs.' - - Option to add ArgoCD ignore annotations when converting Prometheus CRDs via - `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to reduce drift/noise - in ArgoCD-managed clusters. + features: [TLS endpoint support for the vmauth config reloader (improves secure + reload hookups)., 'New/expanded CRD capabilities: `claimTemplates` supported + for `VMCluster`, `VMAlertmanager`, and `VMAgent`; `readinessGates` supported + on CRD objects; health checks now respect TLS settings on CRDs.', Option + to add ArgoCD ignore annotations when converting Prometheus CRDs via `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` + to reduce drift/noise in ArgoCD-managed clusters.] breaking_changes: [] chart_version: 0.14.0 - images: - - victoriametrics/operator:v0.28.3 + images: ['victoriametrics/operator:v0.28.3'] - version: 0.27.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds support for `claimTemplates` on `VMCluster`, `VMAlertmanager`, and `VMAgent` - to simplify PVC templating for stateful workloads. - - Adds `readinessGates` support across CRD objects, enabling integration with - custom readiness conditions. - - HealthChecks now respect TLS settings defined on CRD objects, improving correctness - for secured endpoints. - - Adds an env var `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to - ignore Argo CD objects converted from Prometheus CRDs. - - Adds TLS endpoint support for the `vmauth` config reloader for secured reload - operations. + features: ['Adds support for `claimTemplates` on `VMCluster`, `VMAlertmanager`, + and `VMAgent` to simplify PVC templating for stateful workloads.', 'Adds + `readinessGates` support across CRD objects, enabling integration with custom + readiness conditions.', 'HealthChecks now respect TLS settings defined on + CRD objects, improving correctness for secured endpoints.', Adds an env + var `VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS=true` to ignore Argo + CD objects converted from Prometheus CRDs., Adds TLS endpoint support for + the `vmauth` config reloader for secured reload operations.] breaking_changes: [] chart_version: 0.12.0 - images: - - victoriametrics/operator:v0.27.0 + images: ['victoriametrics/operator:v0.27.0'] - version: 0.26.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'VMUser: adds `name` field (v0.25.0) and `tokenRef` (v0.26.0) for improved - user identification and secret-based token management.' - - 'VMAgent: adds `StatefulMode` to run as a StatefulSet, plus new per-remote-storage - `headers` configuration and multitenant mode support.' - - 'VMRule: adds a validation webhook to catch rule errors at admission time.' - - 'Scrape/target config: adds `authorization` support and `headers` fields for - passing custom headers to targets.' - - 'vmauth/ingress: adds `host` parameter for ingress configuration.' - - 'VMCluster: reworks/expands cluster volume expansion behavior and improves - expansion handling overall.' - - 'Operator/ops: adds new operator metrics (log messages, controller object - counts, throttling, app version/uptime/start timestamp) and introduces/adjusts - reconciliation rate limiting.' - - 'Global: adds a setting to override the container registry globally for images.' - breaking_changes: - - "VMRule API change (v0.25.0): `expr` must be a string; integer expressions\ - \ are no longer supported\u2014existing rules with numeric `expr` will fail\ - \ validation/apply." - - v0.26.0 is flagged by upstream as containing breaking changes that were fixed - in v0.26.2; upgrading directly to 0.26.0 is not recommended (use 0.26.2+ instead). + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['VMUser: adds `name` field (v0.25.0) and `tokenRef` (v0.26.0) for + improved user identification and secret-based token management.', 'VMAgent: + adds `StatefulMode` to run as a StatefulSet, plus new per-remote-storage + `headers` configuration and multitenant mode support.', 'VMRule: adds a + validation webhook to catch rule errors at admission time.', 'Scrape/target + config: adds `authorization` support and `headers` fields for passing custom + headers to targets.', 'vmauth/ingress: adds `host` parameter for ingress + configuration.', 'VMCluster: reworks/expands cluster volume expansion behavior + and improves expansion handling overall.', 'Operator/ops: adds new operator + metrics (log messages, controller object counts, throttling, app version/uptime/start + timestamp) and introduces/adjusts reconciliation rate limiting.', 'Global: + adds a setting to override the container registry globally for images.'] + breaking_changes: ["VMRule API change (v0.25.0): `expr` must be a string; integer\ + \ expressions are no longer supported\u2014existing rules with numeric `expr`\ + \ will fail validation/apply.", v0.26.0 is flagged by upstream as containing + breaking changes that were fixed in v0.26.2; upgrading directly to 0.26.0 + is not recommended (use 0.26.2+ instead).] chart_version: 0.11.1 - images: - - victoriametrics/operator:v0.26.0 + images: ['victoriametrics/operator:v0.26.0'] - version: 0.25.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'VMUser CRD: added a `name` field (useful for explicitly naming VMUser objects).' - - 'VMAgent CRD: added `statefulMode` to run VMAgent as a StatefulSet instead - of a Deployment.' - - 'VMRule: added a validation webhook to catch rule errors at admission time - (fails fast on invalid rules).' - - 'Operator metrics: added additional metrics such as `operator_log_messages_total`, - `operator_controller_objects_count`, `operator_reconcile_throttled_events_total`, - and app info metrics (`vm_app_version`, `vm_app_uptime_seconds`, `vm_app_start_timestamp`).' - - 'Reconciliation: added rate limiting for VMAgent and VMAlert reconciliations - to reduce churn under frequent updates.' - breaking_changes: - - 'VMRule API change: `expr` must be a string; integer values are no longer - accepted. Audit and update any VMRule manifests or generated rules that used - numeric expressions.' + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['VMUser CRD: added a `name` field (useful for explicitly naming VMUser + objects).', 'VMAgent CRD: added `statefulMode` to run VMAgent as a StatefulSet + instead of a Deployment.', 'VMRule: added a validation webhook to catch + rule errors at admission time (fails fast on invalid rules).', 'Operator + metrics: added additional metrics such as `operator_log_messages_total`, + `operator_controller_objects_count`, `operator_reconcile_throttled_events_total`, + and app info metrics (`vm_app_version`, `vm_app_uptime_seconds`, `vm_app_start_timestamp`).', + 'Reconciliation: added rate limiting for VMAgent and VMAlert reconciliations + to reduce churn under frequent updates.'] + breaking_changes: ['VMRule API change: `expr` must be a string; integer values + are no longer accepted. Audit and update any VMRule manifests or generated + rules that used numeric expressions.'] chart_version: 0.10.0 - images: - - victoriametrics/operator:v0.25.0 + images: ['victoriametrics/operator:v0.25.0'] - version: 0.24.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Operator can filter converted Prometheus CRD objects, helping control which - migrated resources are reconciled. - - Default CLI args/params can be overridden via configuration, enabling per-install - tuning without patching manifests. - - "Operator-generated VMServiceScrape objects can now be customized for the\ - \ operator\u2019s managed resources." - - CRD-managed workloads can set `terminationGracePeriodSeconds` and `dnsConfig` - for finer pod-level behavior control. - - VMAlertmanagerConfig adds support for `telegram_configs` notification receiver - blocks. - - Retention period can be set to less than one month (previously constrained). - breaking_changes: - - From v0.23.0, the `job` name label for scrape/probe resources changed to include - a CRD-type prefix (probe, podScrape, serviceScrape, nodeScrape, staticScrape). - This can affect alerting/recording rules and dashboards that match on the - old job label value. + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Operator can filter converted Prometheus CRD objects, helping control + which migrated resources are reconciled.', 'Default CLI args/params can + be overridden via configuration, enabling per-install tuning without patching + manifests.', "Operator-generated VMServiceScrape objects can now be customized\ + \ for the operator\u2019s managed resources.", CRD-managed workloads can + set `terminationGracePeriodSeconds` and `dnsConfig` for finer pod-level + behavior control., VMAlertmanagerConfig adds support for `telegram_configs` + notification receiver blocks., Retention period can be set to less than + one month (previously constrained).] + breaking_changes: ['From v0.23.0, the `job` name label for scrape/probe resources + changed to include a CRD-type prefix (probe, podScrape, serviceScrape, nodeScrape, + staticScrape). This can affect alerting/recording rules and dashboards that + match on the old job label value.'] chart_version: 0.9.0 - images: - - victoriametrics/operator:v0.24.0 + images: ['victoriametrics/operator:v0.24.0'] - version: 0.23.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Operator now checks the Kubernetes API server version and automatically uses - the appropriate API versions for deprecated objects (notably PodSecurityPolicy - and PodDisruptionBudget). - - Fixes include correcting bearerToken handling for VMAgent remoteWriteSpec - and adjusting job name labeling to avoid collisions. - breaking_changes: - - 'Job name label format changed: a CRD-type prefix is added (probe, podScrape, - serviceScrape, nodeScrape, staticScrape), which can affect dashboards/alerts/relabeling - that depend on the old job label values.' + features: [Operator now checks the Kubernetes API server version and automatically + uses the appropriate API versions for deprecated objects (notably PodSecurityPolicy + and PodDisruptionBudget)., Fixes include correcting bearerToken handling + for VMAgent remoteWriteSpec and adjusting job name labeling to avoid collisions.] + breaking_changes: ['Job name label format changed: a CRD-type prefix is added + (probe, podScrape, serviceScrape, nodeScrape, staticScrape), which can affect + dashboards/alerts/relabeling that depend on the old job label values.'] chart_version: 0.7.1 - images: - - victoriametrics/operator:v0.23.0 + images: ['victoriametrics/operator:v0.23.0'] - version: 0.22.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Operator API objects were moved into a separate Go package, allowing consumers - to use the API without importing the whole operator codebase. - - "Support was added to configure `rollingUpdateStrategy` for StatefulSets;\ - \ when set to `rollingUpdate`, Kubernetes\u2019 native controller-manager\ - \ handles rolling updates, enabling `kubectl rollout restart` for both Deployments\ - \ and StatefulSets." - - VMAlertmanager gained a global option `disableNamespaceMatcher` to disable - the namespace label matcher behavior. + features: ['Operator API objects were moved into a separate Go package, allowing + consumers to use the API without importing the whole operator codebase.', + "Support was added to configure `rollingUpdateStrategy` for StatefulSets;\ + \ when set to `rollingUpdate`, Kubernetes\u2019 native controller-manager\ + \ handles rolling updates, enabling `kubectl rollout restart` for both Deployments\ + \ and StatefulSets.", VMAlertmanager gained a global option `disableNamespaceMatcher` + to disable the namespace label matcher behavior.] breaking_changes: [] chart_version: 0.6.0 - images: - - victoriametrics/operator:v0.22.0 + images: ['victoriametrics/operator:v0.22.0'] - version: 0.21.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Alertmanager ServiceScrape auto-generation was added, reducing manual scrape - configuration when alertmanager is managed by the operator. - - VMUser now automatically adds routing for VMCluster components (vminsert and - vmselect), simplifying multi-tenant access setup. - - VMAgent can now have its default disk space usage adjusted, making it easier - to tune persistent storage behavior. - - VMUser target references can now include custom HTTP headers, enabling additional - auth/metadata to be passed to upstreams. - breaking_changes: - - "Selector default behavior changed again: v0.21.0 rolls back the v0.20.x \u201C\ - select all when selector is nil\u201D behavior unless you explicitly set `spec.selectAllByDefault:\ - \ true`. This can silently reduce what gets scraped/selected after upgrade\ - \ if you relied on nil selectors selecting everything." - - VMAuth Ingress API moved to `networking.k8s.io/v1`, which effectively raises - the minimum Kubernetes version for VMAuth Ingress usage to 1.19. Clusters - older than 1.19 (or manifests still using v1beta1) will fail to apply. + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Alertmanager ServiceScrape auto-generation was added, reducing manual + scrape configuration when alertmanager is managed by the operator.', 'VMUser + now automatically adds routing for VMCluster components (vminsert and vmselect), + simplifying multi-tenant access setup.', 'VMAgent can now have its default + disk space usage adjusted, making it easier to tune persistent storage behavior.', + 'VMUser target references can now include custom HTTP headers, enabling additional + auth/metadata to be passed to upstreams.'] + breaking_changes: ["Selector default behavior changed again: v0.21.0 rolls back\ + \ the v0.20.x \u201Cselect all when selector is nil\u201D behavior unless\ + \ you explicitly set `spec.selectAllByDefault: true`. This can silently\ + \ reduce what gets scraped/selected after upgrade if you relied on nil selectors\ + \ selecting everything.", 'VMAuth Ingress API moved to `networking.k8s.io/v1`, + which effectively raises the minimum Kubernetes version for VMAuth Ingress + usage to 1.19. Clusters older than 1.19 (or manifests still using v1beta1) + will fail to apply.'] chart_version: 0.5.1 - images: - - victoriametrics/operator:v0.21.0 + images: ['victoriametrics/operator:v0.21.0'] - version: 0.20.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Custom headers can be set on the VMUser targetRef (useful when integrating - with auth/proxies that require extra headers). - breaking_changes: - - "CR selector defaults changed (e.g., vmagent.spec.serviceScrapeSelector and\ - \ similar): if a selector field is omitted, it now selects *all* matching\ - \ objects rather than selecting none. This can drastically increase scrape\ - \ targets if you relied on the old implicit \u2018select nothing\u2019 behavior." - - Operator no longer appends the cluster domain name for in-cluster communication; - the cluster domain value is now empty by default. This fixes clusters with - non-standard DNS domains but may break setups that depended on the previous - explicit domain concatenation. + features: [Custom headers can be set on the VMUser targetRef (useful when integrating + with auth/proxies that require extra headers).] + breaking_changes: ["CR selector defaults changed (e.g., vmagent.spec.serviceScrapeSelector\ + \ and similar): if a selector field is omitted, it now selects *all* matching\ + \ objects rather than selecting none. This can drastically increase scrape\ + \ targets if you relied on the old implicit \u2018select nothing\u2019 behavior.", + Operator no longer appends the cluster domain name for in-cluster communication; + the cluster domain value is now empty by default. This fixes clusters with + non-standard DNS domains but may break setups that depended on the previous + explicit domain concatenation.] chart_version: 0.4.0 - images: - - victoriametrics/operator:v0.20.0 + images: ['victoriametrics/operator:v0.20.0'] - version: 0.19.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Single-namespace mode for the operator, allowing it to watch and reconcile - resources only in a specified namespace instead of cluster-wide. - - VMAlert Notifier service discovery support, enabling discovery of notifier - endpoints for vmalert integrations. - - VMRule updates to support vmalert-specific features (expanded rule capabilities - when managed by vmalert). - - Reduced operator memory usage by disabling client-side caching for Pods, Deployments, - and StatefulSets. - - Improved end-to-end tests (internal quality improvement, no expected user-facing - config change). + features: ['Single-namespace mode for the operator, allowing it to watch and + reconcile resources only in a specified namespace instead of cluster-wide.', + 'VMAlert Notifier service discovery support, enabling discovery of notifier + endpoints for vmalert integrations.', VMRule updates to support vmalert-specific + features (expanded rule capabilities when managed by vmalert)., 'Reduced + operator memory usage by disabling client-side caching for Pods, Deployments, + and StatefulSets.', 'Improved end-to-end tests (internal quality improvement, + no expected user-facing config change).'] breaking_changes: [] chart_version: 0.3.0 - images: - - victoriametrics/operator:v0.19.0 + images: ['victoriametrics/operator:v0.19.0'] - version: 0.18.0 - kube: - - '1.25' - - '1.24' - - '1.23' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - CRDs are now generated for `apiextensions.k8s.io/v1`; `apiextensions.k8s.io/v1beta1` - is deprecated/legacy. Ensure your cluster is on a Kubernetes version that - supports v1 CRDs and that your Helm upgrade applies the updated CRDs (often - via `crds/` or a separate `kubectl apply -f` step). - - 'Major API updates to CRDs: `VMServiceScrape`, `VMPodScrape`, `VMProbe`, `VMStaticScrape`, - `VMNodeScrape` gained additional fields (e.g., `sampleLimit` and other missing - scrape config params) and new `vm_scrape_params` options; manifests may need - to be adjusted to use the new schema/fields.' - - '`spec.selector` is now optional for `VMPodScrape` and `VMServiceScrape`; - review existing resources if you were relying on selector-required validation - or admission behavior.' - - "New CRD `VMAlertmanagerConfig` introduced; it only supports Alertmanager\ - \ v0.22+\u2014plan component version alignment if you intend to use it." - features: - - OAuth2 configuration added for `VMagent` remoteWrite and scrape endpoints; - you can now authenticate outbound remote writes and protected scrape targets - via OAuth2. - - '`TLSConfig` support added for `VMProbe`, enabling TLS settings for blackbox-style - probing targets.' - - New `vm_scrape_params` options and expanded scrape config surface (e.g., `sampleLimit`, - proxy authentication) across multiple scrape-related CRDs, bringing them closer - to vmagent configuration capabilities. - - New `VMAlertmanagerConfig` CRD for managing Alertmanager config via Kubernetes - resources (requires Alertmanager >= v0.22). - breaking_changes: - - "CRD API versioning shifts to `apiextensions.k8s.io/v1` as the primary format;\ - \ clusters relying on `v1beta1` CRDs must treat them as legacy and may fail\ - \ upgrades on newer Kubernetes if CRDs aren\u2019t migrated/applied correctly." - - "The \u201Cmajor API update\u201D to several CRDs can break upgrades if existing\ - \ custom resources no longer validate against the updated OpenAPI schema;\ - \ validate your existing `VMServiceScrape`/`VMPodScrape`/`VMProbe`/`VMStaticScrape`/`VMNodeScrape`\ - \ manifests against the new CRDs before upgrading." + kube: ['1.25', '1.24', '1.23'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [CRDs are now generated for `apiextensions.k8s.io/v1`; `apiextensions.k8s.io/v1beta1` + is deprecated/legacy. Ensure your cluster is on a Kubernetes version that + supports v1 CRDs and that your Helm upgrade applies the updated CRDs (often + via `crds/` or a separate `kubectl apply -f` step)., 'Major API updates + to CRDs: `VMServiceScrape`, `VMPodScrape`, `VMProbe`, `VMStaticScrape`, + `VMNodeScrape` gained additional fields (e.g., `sampleLimit` and other missing + scrape config params) and new `vm_scrape_params` options; manifests may + need to be adjusted to use the new schema/fields.', '`spec.selector` is + now optional for `VMPodScrape` and `VMServiceScrape`; review existing resources + if you were relying on selector-required validation or admission behavior.', + "New CRD `VMAlertmanagerConfig` introduced; it only supports Alertmanager\ + \ v0.22+\u2014plan component version alignment if you intend to use it."] + features: [OAuth2 configuration added for `VMagent` remoteWrite and scrape endpoints; + you can now authenticate outbound remote writes and protected scrape targets + via OAuth2., '`TLSConfig` support added for `VMProbe`, enabling TLS settings + for blackbox-style probing targets.', 'New `vm_scrape_params` options and + expanded scrape config surface (e.g., `sampleLimit`, proxy authentication) + across multiple scrape-related CRDs, bringing them closer to vmagent configuration + capabilities.', New `VMAlertmanagerConfig` CRD for managing Alertmanager + config via Kubernetes resources (requires Alertmanager >= v0.22).] + breaking_changes: ["CRD API versioning shifts to `apiextensions.k8s.io/v1` as\ + \ the primary format; clusters relying on `v1beta1` CRDs must treat them\ + \ as legacy and may fail upgrades on newer Kubernetes if CRDs aren\u2019\ + t migrated/applied correctly.", "The \u201Cmajor API update\u201D to several\ + \ CRDs can break upgrades if existing custom resources no longer validate\ + \ against the updated OpenAPI schema; validate your existing `VMServiceScrape`/`VMPodScrape`/`VMProbe`/`VMStaticScrape`/`VMNodeScrape`\ + \ manifests against the new CRDs before upgrading."] chart_version: 0.2.0 - images: - - victoriametrics/operator:v0.18.0 + images: ['victoriametrics/operator:v0.18.0'] - version: 0.17.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds an experimental custom config reloader to mitigate long configuration - sync; enable it via env var `VM_USECUSTOMCONFIGRELOADER=true`. - - Reduces Kubernetes API server load when handling `VMPodScrape` resources. - - Exposes a `/debug/pprof` endpoint on `0.0.0.0:8435` for profiling/troubleshooting. - - Updates default versions for VictoriaMetrics apps to v1.63.0. - - Documentation updates. - breaking_changes: - - '`VMAgent` `RemoteWriteSpec` was changed: some options were moved into `RemoteWriteSettings`, - so existing CRs may need field/path updates before/after upgrade.' + features: [Adds an experimental custom config reloader to mitigate long configuration + sync; enable it via env var `VM_USECUSTOMCONFIGRELOADER=true`., Reduces + Kubernetes API server load when handling `VMPodScrape` resources., 'Exposes + a `/debug/pprof` endpoint on `0.0.0.0:8435` for profiling/troubleshooting.', + Updates default versions for VictoriaMetrics apps to v1.63.0., Documentation + updates.] + breaking_changes: ['`VMAgent` `RemoteWriteSpec` was changed: some options were + moved into `RemoteWriteSettings`, so existing CRs may need field/path updates + before/after upgrade.'] chart_version: 0.1.18 - images: - - victoriametrics/operator:v0.17.1 + images: ['victoriametrics/operator:v0.17.1'] - version: 0.16.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Experimental custom config-reloader to mitigate long config sync; enable with - env var `VM_USECUSTOMCONFIGRELOADER=true`. - - Reduced Kubernetes API server load when handling `VMPodScrape` resources. - - Added `/debug/pprof` handler served on `0.0.0.0:8435` for profiling/debugging. - breaking_changes: - - '`VMAgent` `RemoteWriteSpec` changed: some options moved into `RemoteWriteSettings`; - existing manifests may need updates to match the new schema.' + features: [Experimental custom config-reloader to mitigate long config sync; + enable with env var `VM_USECUSTOMCONFIGRELOADER=true`., Reduced Kubernetes + API server load when handling `VMPodScrape` resources., 'Added `/debug/pprof` + handler served on `0.0.0.0:8435` for profiling/debugging.'] + breaking_changes: ['`VMAgent` `RemoteWriteSpec` changed: some options moved + into `RemoteWriteSettings`; existing manifests may need updates to match + the new schema.'] chart_version: 0.1.17 - images: - - victoriametrics/operator:v0.16.0 + images: ['victoriametrics/operator:v0.16.0'] - version: 0.15.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - All CRD-backed resources now support `nodeSelector`, allowing you to pin operator-managed - workloads to specific nodes. - - '`vminsert` and `vmselect` can now be autoscaled via HorizontalPodAutoscaler - (HPA).' - - 'Two new CRDs were added: `VMAuth` and `VMUser`, enabling operator-managed - auth/user resources.' - - HostPath volumes are now supported, and you can override the `storageDataPath` - setting when using them. + features: ['All CRD-backed resources now support `nodeSelector`, allowing you + to pin operator-managed workloads to specific nodes.', '`vminsert` and `vmselect` + can now be autoscaled via HorizontalPodAutoscaler (HPA).', 'Two new CRDs + were added: `VMAuth` and `VMUser`, enabling operator-managed auth/user resources.', + 'HostPath volumes are now supported, and you can override the `storageDataPath` + setting when using them.'] breaking_changes: [] chart_version: 0.1.14 - images: - - victoriametrics/operator:v0.15.0 + images: ['victoriametrics/operator:v0.15.0'] - version: 0.14.2 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.13 - images: - - victoriametrics/operator:v0.14.2 + images: ['victoriametrics/operator:v0.14.2'] - version: 0.13.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds probe customization via CRD, allowing you to tune readiness/liveness/startup - probes for managed components without patching generated manifests. + features: ['Adds probe customization via CRD, allowing you to tune readiness/liveness/startup + probes for managed components without patching generated manifests.'] breaking_changes: [] chart_version: 0.1.12 - images: - - victoriametrics/operator:v0.13.0 + images: ['victoriametrics/operator:v0.13.0'] - version: 0.12.2 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.10 - images: - - victoriametrics/operator:v0.12.2 + images: ['victoriametrics/operator:v0.12.2'] - version: 0.11.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.9 - images: - - victoriametrics/operator:v0.11.0 + images: ['victoriametrics/operator:v0.11.0'] - version: 0.9.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'VMPodScrape: basic auth, bearer token, and TLS connection support were added, - enabling secure scraping configurations.' - - 'VMSingle/VMCluster: new `insertPorts` option allows configuring ingestion - ports for OpenTSDB, Graphite, and Influx protocols.' - - 'vmalert: support for `externalLabels` was added to attach extra labels to - generated alerts/metrics.' - breaking_changes: - - 'RBAC changes: role/namespace handling was adjusted; verify the operator has - the expected permissions in the target namespace(s) after upgrade.' + features: ['VMPodScrape: basic auth, bearer token, and TLS connection support + were added, enabling secure scraping configurations.', 'VMSingle/VMCluster: + new `insertPorts` option allows configuring ingestion ports for OpenTSDB, + Graphite, and Influx protocols.', 'vmalert: support for `externalLabels` + was added to attach extra labels to generated alerts/metrics.'] + breaking_changes: ['RBAC changes: role/namespace handling was adjusted; verify + the operator has the expected permissions in the target namespace(s) after + upgrade.'] chart_version: 0.1.8 - images: - - victoriametrics/operator:v0.9.1 + images: ['victoriametrics/operator:v0.9.1'] - version: 0.8.0 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Operator v0.8.0 includes additional VMPodScrape connection/auth options (basic - auth, bearer token, TLS) and new ingestion port configuration via `insertPorts` - for VMSingle and VMCluster. - - Includes minor documentation fixes (operator-hub broken links) and stability - fixes (panic fixes around VMCluster). - features: - - VMPodScrape now supports basic auth, bearer token authentication, and TLS - configuration for scraping endpoints. - - VMSingle and VMCluster add `insertPorts` to configure ingestion ports for - OpenTSDB, Graphite, and Influx protocols. + chart_updates: ['Operator v0.8.0 includes additional VMPodScrape connection/auth + options (basic auth, bearer token, TLS) and new ingestion port configuration + via `insertPorts` for VMSingle and VMCluster.', Includes minor documentation + fixes (operator-hub broken links) and stability fixes (panic fixes around + VMCluster).] + features: ['VMPodScrape now supports basic auth, bearer token authentication, + and TLS configuration for scraping endpoints.', 'VMSingle and VMCluster + add `insertPorts` to configure ingestion ports for OpenTSDB, Graphite, and + Influx protocols.'] breaking_changes: [] chart_version: 0.1.7 - images: - - victoriametrics/operator:v0.8.0 + images: ['victoriametrics/operator:v0.8.0'] - version: 0.7.3 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.5 - images: - - victoriametrics/operator:v0.7.3 + images: ['victoriametrics/operator:v0.7.3'] - version: 0.6.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.4 - images: - - victoriametrics/operator:v0.6.1 + images: ['victoriametrics/operator:v0.6.1'] - version: 0.2.1 - kube: - - '1.25' - - '1.24' - - '1.23' + kube: ['1.25', '1.24', '1.23'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: - - victoriametrics/operator:v0.2.1 - name: victoria-metrics-operator + images: ['victoriametrics/operator:v0.2.1'] - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/nvidia-operator/plural/icons/nvidia.png?raw=true git_url: https://github.com/NVIDIA/gpu-operator release_url: https://github.com/NVIDIA/gpu-operator/releases/tag/{vsn} @@ -38620,545 +28532,299 @@ addons: readme_url: https://github.com/NVIDIA/gpu-operator/blob/main/README.md versions: - version: 26.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] chart_version: 26.7.0 - images: - - nvcr.io/nvidia/gpu-operator:v26.7.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.19.0 + images: ['nvcr.io/nvidia/gpu-operator:v26.7.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.19.0'] incompatibilities: [] - version: 26.3.3 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] chart_version: 26.3.3 - images: - - nvcr.io/nvidia/gpu-operator:v26.3.3 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 + images: ['nvcr.io/nvidia/gpu-operator:v26.3.3', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] incompatibilities: [] - version: 26.3.2 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] chart_version: 26.3.2 - images: - - nvcr.io/nvidia/gpu-operator:v26.3.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 + images: ['nvcr.io/nvidia/gpu-operator:v26.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] incompatibilities: [] - version: 26.3.1 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] chart_version: 26.3.1 - images: - - nvcr.io/nvidia/gpu-operator:v26.3.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 + images: ['nvcr.io/nvidia/gpu-operator:v26.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] incompatibilities: [] - version: 26.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] chart_version: 26.3.0 - images: - - nvcr.io/nvidia/gpu-operator:v26.3.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.3 + images: ['nvcr.io/nvidia/gpu-operator:v26.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.3'] incompatibilities: [] - version: 25.10.1 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] chart_version: 25.10.1 - images: - - nvcr.io/nvidia/gpu-operator:v25.10.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.2 + images: ['nvcr.io/nvidia/gpu-operator:v25.10.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.2'] incompatibilities: [] - version: 25.10.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] chart_version: 25.10.0 - images: - - nvcr.io/nvidia/gpu-operator:v25.10.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.18.2 + images: ['nvcr.io/nvidia/gpu-operator:v25.10.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.18.2'] incompatibilities: [] - version: 25.3.4 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] chart_version: 25.3.4 - images: - - nvcr.io/nvidia/gpu-operator:v25.3.4 - - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 + images: ['nvcr.io/nvidia/gpu-operator:v25.3.4', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] incompatibilities: [] - version: 25.3.3 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] chart_version: 25.3.3 - images: - - nvcr.io/nvidia/gpu-operator:v25.3.3 - - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 + images: ['nvcr.io/nvidia/gpu-operator:v25.3.3', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] incompatibilities: [] - version: 25.3.2 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] chart_version: 25.3.2 - images: - - nvcr.io/nvidia/gpu-operator:v25.3.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 + images: ['nvcr.io/nvidia/gpu-operator:v25.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] incompatibilities: [] - version: 25.3.1 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] chart_version: 25.3.1 - images: - - nvcr.io/nvidia/gpu-operator:v25.3.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.17.3 + images: ['nvcr.io/nvidia/gpu-operator:v25.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.3'] incompatibilities: [] - version: 25.3.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] chart_version: 25.3.0 - images: - - nvcr.io/nvidia/gpu-operator:v25.3.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.17.2 + images: ['nvcr.io/nvidia/gpu-operator:v25.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.17.2'] incompatibilities: [] - version: 24.9.2 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] chart_version: 24.9.2 - images: - - nvcr.io/nvidia/gpu-operator:v24.9.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 + images: ['nvcr.io/nvidia/gpu-operator:v24.9.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] incompatibilities: [] - version: 24.9.1 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] chart_version: 24.9.1 - images: - - nvcr.io/nvidia/gpu-operator:v24.9.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 + images: ['nvcr.io/nvidia/gpu-operator:v24.9.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] incompatibilities: [] - version: 24.9.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] chart_version: 24.9.0 - images: - - nvcr.io/nvidia/gpu-operator:v24.9.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.6 + images: ['nvcr.io/nvidia/gpu-operator:v24.9.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.6'] incompatibilities: [] - version: 24.6.2 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] chart_version: 24.6.2 - images: - - nvcr.io/nvidia/gpu-operator:v24.6.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 + images: ['nvcr.io/nvidia/gpu-operator:v24.6.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] incompatibilities: [] - version: 24.6.1 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] chart_version: 24.6.1 - images: - - nvcr.io/nvidia/gpu-operator:v24.6.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 + images: ['nvcr.io/nvidia/gpu-operator:v24.6.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] incompatibilities: [] - version: 24.6.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] chart_version: 24.6.0 - images: - - nvcr.io/nvidia/gpu-operator:v24.6.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.16.3 + images: ['nvcr.io/nvidia/gpu-operator:v24.6.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.16.3'] incompatibilities: [] - version: 24.3.0 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] chart_version: 24.3.0 - images: - - nvcr.io/nvidia/gpu-operator:v24.3.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.15.4 + images: ['nvcr.io/nvidia/gpu-operator:v24.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.15.4'] incompatibilities: [] - version: 23.9.2 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] chart_version: 23.9.2 - images: - - nvcr.io/nvidia/gpu-operator:v23.9.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 + images: ['nvcr.io/nvidia/gpu-operator:v23.9.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] incompatibilities: [] - version: 23.9.1 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] chart_version: 23.9.1 - images: - - nvcr.io/nvidia/gpu-operator:v23.9.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 + images: ['nvcr.io/nvidia/gpu-operator:v23.9.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] incompatibilities: [] - version: 23.9.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] chart_version: 23.9.0 - images: - - nvcr.io/nvidia/gpu-operator:v23.9.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.14.2 + images: ['nvcr.io/nvidia/gpu-operator:v23.9.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.14.2'] incompatibilities: [] - version: 23.6.2 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] chart_version: 23.6.2 - images: - - nvcr.io/nvidia/gpu-operator:v23.6.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.6.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] incompatibilities: [] - version: 23.6.1 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] chart_version: 23.6.1 - images: - - nvcr.io/nvidia/gpu-operator:v23.6.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.6.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] incompatibilities: [] - version: 23.6.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] chart_version: 23.6.0 - images: - - nvcr.io/nvidia/gpu-operator:v23.6.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.13.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.6.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.13.1'] incompatibilities: [] - version: 23.3.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 23.3.2 - images: - - nvcr.io/nvidia/gpu-operator:v23.3.2 - - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.3.2', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] incompatibilities: [] - version: 23.3.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 23.3.1 - images: - - nvcr.io/nvidia/gpu-operator:v23.3.1 - - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.3.1', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] incompatibilities: [] - version: 23.3.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 23.3.0 - images: - - nvcr.io/nvidia/gpu-operator:v23.3.0 - - registry.k8s.io/nfd/node-feature-discovery:v0.12.1 + images: ['nvcr.io/nvidia/gpu-operator:v23.3.0', 'registry.k8s.io/nfd/node-feature-discovery:v0.12.1'] incompatibilities: [] - version: 22.9.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 22.9.2 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v22.9.2 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.2'] incompatibilities: [] - version: 22.9.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 22.9.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v22.9.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.1'] incompatibilities: [] - version: 22.9.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 22.9.0 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v22.9.0 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v22.9.0'] incompatibilities: [] - version: 1.11.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.11.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v1.11.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.11.1'] incompatibilities: [] - version: 1.11.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.11.0 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v1.11.0 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.11.0'] incompatibilities: [] - version: 1.10.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.10.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v1.10.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.10.1'] incompatibilities: [] - version: 1.10.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.10.0 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.10.1 - - nvcr.io/nvidia/gpu-operator:v1.10.0 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.10.1', 'nvcr.io/nvidia/gpu-operator:v1.10.0'] incompatibilities: [] - version: 1.9.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.9.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.9.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.9.1'] incompatibilities: [] - version: 1.9.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.9.0 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.9.0 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.9.0'] incompatibilities: [] - version: 1.8.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.8.2 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.8.2 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.2'] incompatibilities: [] - version: 1.8.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.8.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.8.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.1'] incompatibilities: [] - version: 1.8.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.8.0 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.8.0 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.8.0'] incompatibilities: [] - version: 1.7.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.7.1 - images: - - k8s.gcr.io/nfd/node-feature-discovery:v0.8.2 - - nvcr.io/nvidia/gpu-operator:v1.7.1 + images: ['k8s.gcr.io/nfd/node-feature-discovery:v0.8.2', 'nvcr.io/nvidia/gpu-operator:v1.7.1'] incompatibilities: [] - version: 1.7.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.7.0 - images: - - nvcr.io/nvidia/gpu-operator:v1.7.0 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:v1.7.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.6.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.6.2 - images: - - nvcr.io/nvidia/gpu-operator:1.6.2 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.6.2', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.6.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.6.1 - images: - - nvcr.io/nvidia/gpu-operator:1.6.1 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.6.1', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.6.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.6.0 - images: - - nvcr.io/nvidia/gpu-operator:1.6.0 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.6.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.5.2 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.5.2 - images: - - nvcr.io/nvidia/gpu-operator:1.5.2 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.5.2', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.5.1 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.5.1 - images: - - nvcr.io/nvidia/gpu-operator:1.5.1 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.5.1', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.5.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.5.0 - images: - - nvcr.io/nvidia/gpu-operator:1.5.0 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.5.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - version: 1.4.0 - kube: - - '1.26' - - '1.25' - - '1.24' + kube: ['1.26', '1.25', '1.24'] requirements: [] chart_version: 1.4.0 - images: - - nvcr.io/nvidia/gpu-operator:1.4.0 - - quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0 + images: ['nvcr.io/nvidia/gpu-operator:1.4.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] - name: gpu-operator - icon: https://avatars.githubusercontent.com/u/14012520?v=4 git_url: https://github.com/goharbor/harbor release_url: https://github.com/goharbor/harbor/releases/tag/v{vsn} @@ -39166,90 +28832,72 @@ addons: chart_name: harbor versions: - version: 2.14.0 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Introduces a replication adapter whitelist to explicitly define which replication - adapters are actively supported (and therefore allowed). - - "Replication: optional \u201CSingle Active Replication\u201D mode to prevent\ - \ parallel executions under the same policy." - - Proxy-cache behavior improved to better synchronize with upstream registries - (purges local cache when upstream artifacts are deleted; can serve local manifests - when digests match upstream). - - 'Artifact scanning enhancements: CVE reports can include fixVersion; vulnerability - checking behavior improved for non-scannable artifacts.' - - 'Garbage collection UX improvement: shows GC progress while a run is in progress.' - - 'CNAI (CloudNativeAI) integration enhanced: supports raw CNAI model format.' - - 'Jobservice enhancement: retention count for job executions can be customized - via environment variable (new configurability).' - - Various component/dependency updates and UI fixes; adds Russian language support. - features: - - "Enhanced proxy-cache: Harbor can delete local cached artifacts when they\u2019\ - re removed upstream and can serve a local manifest when its digest matches\ - \ upstream." - - Single Active Replication option to ensure only one replication execution - runs at a time per policy (prevents overlapping parallel runs). - - 'Enhanced artifact scanning: CVE reports can include fixVersion and Harbor - can better handle/skip checks for non-scannable artifacts.' - - 'Enhanced garbage collection visibility: GC progress is displayed while GC - is running.' - - 'Enhanced CNAI model support: raw CNAI model format is now supported.' - breaking_changes: - - 'Replication adapter whitelist introduced: deployments may need to explicitly - allow the replication adapters they use; unsupported/unlisted adapters may - no longer work until permitted.' + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Introduces a replication adapter whitelist to explicitly define + which replication adapters are actively supported (and therefore allowed)., + "Replication: optional \u201CSingle Active Replication\u201D mode to prevent\ + \ parallel executions under the same policy.", Proxy-cache behavior improved + to better synchronize with upstream registries (purges local cache when + upstream artifacts are deleted; can serve local manifests when digests match + upstream)., 'Artifact scanning enhancements: CVE reports can include fixVersion; + vulnerability checking behavior improved for non-scannable artifacts.', + 'Garbage collection UX improvement: shows GC progress while a run is in progress.', + 'CNAI (CloudNativeAI) integration enhanced: supports raw CNAI model format.', + 'Jobservice enhancement: retention count for job executions can be customized + via environment variable (new configurability).', Various component/dependency + updates and UI fixes; adds Russian language support.] + features: ["Enhanced proxy-cache: Harbor can delete local cached artifacts when\ + \ they\u2019re removed upstream and can serve a local manifest when its\ + \ digest matches upstream.", Single Active Replication option to ensure + only one replication execution runs at a time per policy (prevents overlapping + parallel runs)., 'Enhanced artifact scanning: CVE reports can include fixVersion + and Harbor can better handle/skip checks for non-scannable artifacts.', + 'Enhanced garbage collection visibility: GC progress is displayed while GC + is running.', 'Enhanced CNAI model support: raw CNAI model format is now + supported.'] + breaking_changes: ['Replication adapter whitelist introduced: deployments may + need to explicitly allow the replication adapters they use; unsupported/unlisted + adapters may no longer work until permitted.'] chart_version: 1.18.0 images: [] - version: 2.13.0 - kube: - - '1.31' - - '1.30' - - '1.29' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - 'Audit log extension: adds a new audit_log_ext table plus API/filtering to - provide more granular and performant audit event tracking (including login/logout/config/user - events).' - - 'Enhanced OIDC: adds PKCE support and improves logout/session handling and - related audit logging.' - - 'Redis TLS support: Harbor core/jobservice can now connect to Redis over TLS - (including external Redis TLS options).' - - 'CloudNativeAI integration: introduces a CNAI model processor and a new AI - Model artifact type for managing AI model artifacts.' - - 'Enhanced Dragonfly/P2P preheating: extends preheat policies with new parameters, - scope customization, and targeting (useful for large AI model images).' - breaking_changes: - - CSRF key generation changed; existing deployments may need to regenerate/rotate - CSRF-related secrets to avoid login/session issues after upgrade. - - Removed the with_signature option; any automation or integrations relying - on it must be updated/removed. - - 'RBAC change: Project maintainers/developers/guests can no longer list project - logs; only higher-privilege roles can access those logs now.' - - robotV1 removed from the codebase (deprecation realized); any clients/scripts - using legacy robot APIs must migrate to the newer robot account model. + kube: ['1.31', '1.30', '1.29'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Audit log extension: adds a new audit_log_ext table plus API/filtering + to provide more granular and performant audit event tracking (including + login/logout/config/user events).', 'Enhanced OIDC: adds PKCE support and + improves logout/session handling and related audit logging.', 'Redis TLS + support: Harbor core/jobservice can now connect to Redis over TLS (including + external Redis TLS options).', 'CloudNativeAI integration: introduces a + CNAI model processor and a new AI Model artifact type for managing AI model + artifacts.', 'Enhanced Dragonfly/P2P preheating: extends preheat policies + with new parameters, scope customization, and targeting (useful for large + AI model images).'] + breaking_changes: [CSRF key generation changed; existing deployments may need + to regenerate/rotate CSRF-related secrets to avoid login/session issues + after upgrade., Removed the with_signature option; any automation or integrations + relying on it must be updated/removed., 'RBAC change: Project maintainers/developers/guests + can no longer list project logs; only higher-privilege roles can access + those logs now.', robotV1 removed from the codebase (deprecation realized); + any clients/scripts using legacy robot APIs must migrate to the newer robot + account model.] chart_version: 1.17.0 images: [] - version: 2.12.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: null chart_version: 1.16.0 images: [] - name: harbor - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/elasticsearch/plural/icons/elastic.png?raw=true git_url: https://github.com/elastic/elasticsearch release_url: https://github.com/elastic/elasticsearch/releases/tag/{vsn} @@ -39257,258 +28905,152 @@ addons: readme_url: https://github.com/elastic/elasticsearch/blob/main/README.asciidoc versions: - version: 9.5.3 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: null chart_version: 9.5.3 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.5.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.5.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 9.5.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.5.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.5.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.4.6 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: null chart_version: 9.4.6 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.4.6 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.4.6', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.4.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 9.4.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.4.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.4.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.3.4 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 9.3.4 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.3.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.3.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.3.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 9.3.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.3.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.3.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.2.4 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 9.2.4 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.2.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.2.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.2.0 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 9.2.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.2.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.2.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.1.9 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 9.1.9 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.1.9 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.9', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.1.4 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 9.1.4 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.1.4 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.4', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.1.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 9.1.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.1.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.1.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 9.0.7 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 9.0.7 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.0.7 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.0.7', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 9.0.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 9.0.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:9.0.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:9.0.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 8.19.21 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: null chart_version: 8.19.21 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.19.21 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.21', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 8.19.14 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 8.19.14 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.19.14 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.14', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 8.19.10 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: null chart_version: 8.19.10 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.19.10 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.10', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 8.19.3 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 8.19.3 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.19.3 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.3', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 8.19.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 8.19.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.19.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.19.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 8.18.7 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 8.18.7 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.18.7 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.7', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0'] - version: 8.18.1 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: null chart_version: 8.18.1 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.18.1 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.1', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - version: 8.18.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: null chart_version: 8.18.0 - images: - - docker.elastic.co/elastic-agent/elastic-agent:8.18.0 - - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 - name: elastic-agent + images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] - icon: https://avatars.githubusercontent.com/u/96669?s=48&v=4 git_url: https://github.com/rabbitmq/cluster-operator release_url: https://github.com/rabbitmq/cluster-operator/releases/tag/v{vsn} @@ -39516,892 +29058,433 @@ addons: chart_name: rabbitmq-cluster-operator versions: - version: 2.16.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Support scaling RabbitMQ clusters down to zero replicas (introduced in v2.16.0). - - Operator now deploys RabbitMQ 4.1.3 by default (v2.16.1). - - 'Dependencies/tooling updates: Go toolchain bumped to address CVE-2025-4674 - and CVE-2025-47907, and dependabot config added for Go tooling (v2.16.1).' - breaking_changes: - - Upgrading the cluster-operator triggers reconciliation that will roll RabbitMQ - cluster StatefulSets, causing a rolling update of the RabbitMQ nodes. To control - timing, pause reconciliation before upgrading and resume when safe (noted - for both v2.16.0 and v2.16.1). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Support scaling RabbitMQ clusters down to zero replicas (introduced + in v2.16.0)., Operator now deploys RabbitMQ 4.1.3 by default (v2.16.1)., + 'Dependencies/tooling updates: Go toolchain bumped to address CVE-2025-4674 + and CVE-2025-47907, and dependabot config added for Go tooling (v2.16.1).'] + breaking_changes: ['Upgrading the cluster-operator triggers reconciliation that + will roll RabbitMQ cluster StatefulSets, causing a rolling update of the + RabbitMQ nodes. To control timing, pause reconciliation before upgrading + and resume when safe (noted for both v2.16.0 and v2.16.1).'] chart_version: 4.4.34 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.16.1-debian-12-r0 - - docker.io/bitnami/rmq-messaging-topology-operator:1.17.4-debian-12-r0 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.16.1-debian-12-r0', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.4-debian-12-r0'] - version: 2.16.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Operator now supports scaling RabbitMQ clusters down to zero replicas (useful - for dev/test or cost-saving scenarios). - breaking_changes: - - Upgrading the operator triggers reconciliation that will roll RabbitMQ StatefulSets - (a rolling update of clusters). Pause reconciliation before upgrading if you - need to control when cluster pods roll, then resume when safe. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [Operator now supports scaling RabbitMQ clusters down to zero replicas + (useful for dev/test or cost-saving scenarios).] + breaking_changes: ['Upgrading the operator triggers reconciliation that will + roll RabbitMQ StatefulSets (a rolling update of clusters). Pause reconciliation + before upgrading if you need to control when cluster pods roll, then resume + when safe.'] chart_version: 4.4.32 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.16.0-debian-12-r2 - - docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r2 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.16.0-debian-12-r2', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r2'] - version: 2.15.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator defaults to deploying RabbitMQ 4.1.1 and includes updated Prometheus - alerting/recording rules for RabbitMQ 4.1. - - Grafana queue dashboard was updated. - - Operator Lifecycle Manager (OLM) workflow/refactor updates (mostly packaging/ops - plumbing). - - Go toolchain/dependency bump to address CVE-2025-22874. - features: - - Can optionally auto-enable all RabbitMQ feature flags (new operator option). - - Updated monitoring content (Prometheus rules and Grafana dashboard) aligned - with RabbitMQ 4.1. - - RabbitMQ 4.1.1 is now the default deployed version when the operator manages - clusters. - breaking_changes: - - Upgrading the operator will trigger reconciliation and may cause a rolling - update of managed RabbitMQ StatefulSets; pause reconciliation if you need - to control timing. - - Default RabbitMQ version change to 4.1.1 can be a functional upgrade for clusters - if you were previously relying on the prior default image/version. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator defaults to deploying RabbitMQ 4.1.1 and includes updated + Prometheus alerting/recording rules for RabbitMQ 4.1., Grafana queue dashboard + was updated., Operator Lifecycle Manager (OLM) workflow/refactor updates + (mostly packaging/ops plumbing)., Go toolchain/dependency bump to address + CVE-2025-22874.] + features: [Can optionally auto-enable all RabbitMQ feature flags (new operator + option)., Updated monitoring content (Prometheus rules and Grafana dashboard) + aligned with RabbitMQ 4.1., RabbitMQ 4.1.1 is now the default deployed version + when the operator manages clusters.] + breaking_changes: [Upgrading the operator will trigger reconciliation and may + cause a rolling update of managed RabbitMQ StatefulSets; pause reconciliation + if you need to control timing., Default RabbitMQ version change to 4.1.1 + can be a functional upgrade for clusters if you were previously relying + on the prior default image/version.] chart_version: 4.4.26 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.15.0-debian-12-r1 - - docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r0 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.15.0-debian-12-r1', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.3-debian-12-r0'] - version: 2.14.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator upgrade to v2.14.0 is expected to trigger reconciliation and a rolling - update of managed RabbitMQ StatefulSets unless reconciliation is paused. - - 'Mostly maintenance/refactor release: tooling refactor and dependency bumps; - no new operator-facing features called out beyond logging/doc tweaks.' - features: - - Documentation now explicitly includes the default `delayStartSeconds` value. - - Operator logs an explicit line when FIPS mode is enabled (helps compliance/debugging). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator upgrade to v2.14.0 is expected to trigger reconciliation + and a rolling update of managed RabbitMQ StatefulSets unless reconciliation + is paused., 'Mostly maintenance/refactor release: tooling refactor and dependency + bumps; no new operator-facing features called out beyond logging/doc tweaks.'] + features: [Documentation now explicitly includes the default `delayStartSeconds` + value., Operator logs an explicit line when FIPS mode is enabled (helps + compliance/debugging).] breaking_changes: [] chart_version: 4.4.22 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.14.0-debian-12-r3 - - docker.io/bitnami/rmq-messaging-topology-operator:1.17.1-debian-12-r3 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.14.0-debian-12-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.1-debian-12-r3'] - version: 2.13.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - Default RabbitMQ image (when `.spec.image` is not set) moves from `rabbitmq:4.0.5-management` - (v2.12.0 behavior) to `rabbitmq:4.1.0-management` in v2.13.0, which can trigger - a rolling update of StatefulSets. - - "Resource tuning: the init container defaults are reduced significantly (memory\ - \ 500Mi\u219264Mi, CPU 100m\u219220m)." - - Adds support for custom Service labels via `spec.service.labels` on the RabbitMQ - resource. - - Adds a `PrometheusRule` for RabbitMQ alarm states and improves Prometheus - rule handling (e.g., merging `rabbitmq_identity_info`) plus validation via - `promtool`. - - 'Operational improvements: better cluster deletion behavior, plus general - dependency bumps and codebase modernization.' - breaking_changes: - - Upgrading the cluster-operator to v2.13.0 will update managed RabbitMQ clusters - (rolling update of underlying StatefulSets). If you need to control timing, - pause reconciliation before upgrading and resume afterward when safe. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: ['Default RabbitMQ image (when `.spec.image` is not set) moves from + `rabbitmq:4.0.5-management` (v2.12.0 behavior) to `rabbitmq:4.1.0-management` + in v2.13.0, which can trigger a rolling update of StatefulSets.', "Resource\ + \ tuning: the init container defaults are reduced significantly (memory\ + \ 500Mi\u219264Mi, CPU 100m\u219220m).", Adds support for custom Service + labels via `spec.service.labels` on the RabbitMQ resource., 'Adds a `PrometheusRule` + for RabbitMQ alarm states and improves Prometheus rule handling (e.g., merging + `rabbitmq_identity_info`) plus validation via `promtool`.', 'Operational + improvements: better cluster deletion behavior, plus general dependency + bumps and codebase modernization.'] + breaking_changes: ['Upgrading the cluster-operator to v2.13.0 will update managed + RabbitMQ clusters (rolling update of underlying StatefulSets). If you need + to control timing, pause reconciliation before upgrading and resume afterward + when safe.'] chart_version: 4.4.13 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.13.0-debian-12-r0 - - docker.io/bitnami/rmq-messaging-topology-operator:1.17.0-debian-12-r1 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.13.0-debian-12-r0', 'docker.io/bitnami/rmq-messaging-topology-operator:1.17.0-debian-12-r1'] - version: 2.12.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Default RabbitMQ image when none is specified is now `rabbitmq:4.0.5-management`. - - '`readinessProbe` and `livenessProbe` are now configurable/overridable.' - features: - - Operator can now populate a `connection_string` entry in the default user - Secret, making it easier for apps to discover connection parameters. - - Web MQTT/STOMP TLS port enablement condition logic was updated to better reflect - intended behavior. - - Users can now override `readinessProbe` and `livenessProbe` for RabbitMQ Pods - to tune health checks. - - If no image is specified for a RabbitMQ cluster, the operator now defaults - to `rabbitmq:4.0.5-management`. - breaking_changes: - - Upgrading the operator can trigger rolling updates of managed RabbitMQ clusters - (StatefulSets). If you need to control timing, pause reconciliation before - upgrading and resume when safe. - - The implicit default RabbitMQ image changes to `rabbitmq:4.0.5-management` - when `spec.image` is unset; clusters relying on the previous implicit default - may change RabbitMQ version/variant after upgrade. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Default RabbitMQ image when none is specified is now `rabbitmq:4.0.5-management`.', + '`readinessProbe` and `livenessProbe` are now configurable/overridable.'] + features: ['Operator can now populate a `connection_string` entry in the default + user Secret, making it easier for apps to discover connection parameters.', + Web MQTT/STOMP TLS port enablement condition logic was updated to better reflect + intended behavior., Users can now override `readinessProbe` and `livenessProbe` + for RabbitMQ Pods to tune health checks., 'If no image is specified for + a RabbitMQ cluster, the operator now defaults to `rabbitmq:4.0.5-management`.'] + breaking_changes: ['Upgrading the operator can trigger rolling updates of managed + RabbitMQ clusters (StatefulSets). If you need to control timing, pause reconciliation + before upgrading and resume when safe.', 'The implicit default RabbitMQ + image changes to `rabbitmq:4.0.5-management` when `spec.image` is unset; + clusters relying on the previous implicit default may change RabbitMQ version/variant + after upgrade.'] chart_version: 4.4.2 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.12.0-debian-12-r1 - - docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r5 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.12.0-debian-12-r1', 'docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r5'] - version: 2.11.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator upgrade to v2.11.0 will trigger reconciliation changes that can roll - RabbitMQ StatefulSets; plan/pause reconciliation to control timing. - - 'Default-user secret content changes: a `connection_string` key is now added - to the default_user Secret.' - - TLS listener condition logic updated for Web MQTT/STOMP TLS ports (may affect - when those ports are opened/advertised). - - 'Certificate handling fix: CA certs no longer override server certs (affects - TLS setups).' - - 'Operational robustness: ignore mirroring-related shutdown errors during shutdown/scale - events.' - - 'Misc: dependency updates and linter/CI fixes (no functional action typically - required).' - features: - - Default RabbitMQ user Secret now includes a `connection_string` value to simplify - client configuration. - - Improved condition handling for enabling Web MQTT/STOMP TLS ports. - breaking_changes: - - Upgrading the operator to v2.11.0 will cause a rolling update of managed RabbitMQ - StatefulSets unless reconciliation is paused; schedule maintenance or pause/resume - reconciliation to control rollout. - - If you have automation that consumes the default_user Secret and expects a - fixed schema, the new `connection_string` field may require updates (e.g., - strict JSON/YAML parsing or templating). + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator upgrade to v2.11.0 will trigger reconciliation changes + that can roll RabbitMQ StatefulSets; plan/pause reconciliation to control + timing., 'Default-user secret content changes: a `connection_string` key + is now added to the default_user Secret.', TLS listener condition logic + updated for Web MQTT/STOMP TLS ports (may affect when those ports are opened/advertised)., + 'Certificate handling fix: CA certs no longer override server certs (affects + TLS setups).', 'Operational robustness: ignore mirroring-related shutdown + errors during shutdown/scale events.', 'Misc: dependency updates and linter/CI + fixes (no functional action typically required).'] + features: [Default RabbitMQ user Secret now includes a `connection_string` value + to simplify client configuration., Improved condition handling for enabling + Web MQTT/STOMP TLS ports.] + breaking_changes: [Upgrading the operator to v2.11.0 will cause a rolling update + of managed RabbitMQ StatefulSets unless reconciliation is paused; schedule + maintenance or pause/resume reconciliation to control rollout., 'If you + have automation that consumes the default_user Secret and expects a fixed + schema, the new `connection_string` field may require updates (e.g., strict + JSON/YAML parsing or templating).'] chart_version: 4.4.0 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.11.0-debian-12-r4 - - docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r2 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.11.0-debian-12-r4', 'docker.io/bitnami/rmq-messaging-topology-operator:1.15.0-debian-12-r2'] - version: 2.10.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator upgrade will trigger rolling updates of managed RabbitMQ StatefulSets; - to control timing, pause reconciliation before upgrading the operator and - resume when safe. - - CRD updates included in v2.9.0 (ensure CRDs are applied as part of the upgrade). - - Default RabbitMQ version managed by the operator changes (3.13.2 in v2.9.0; - 3.13.7 in v2.10.0), which can cause cluster rolling restarts if you rely on - defaults. - - "New optional annotation `rabbitmq.com/disable-default-topology-spread-constraints`\ - \ allows disabling the operator\u2019s default topology spread constraints\ - \ behavior." - features: - - Adds support for disabling the default topology spread constraints via a new - `rabbitmq.com/disable-default-topology-spread-constraints` annotation. - - Increases the maximum allowed length of `additionalConfig`, enabling larger - custom RabbitMQ configuration snippets. - - Changes default managed RabbitMQ version to 3.13.7 (from 3.13.2 in 2.9.0), - bringing RabbitMQ patch-level updates by default. - breaking_changes: - - ANONYMOUS login is now disabled by default, which can break clients or tooling - relying on unauthenticated access; verify configured users/permissions and - update integrations accordingly. - - '`vm_memory_high_watermark_paging_ratio` is removed; if you set it anywhere - (additionalConfig, ConfigMap, definitions), remove it to avoid invalid configuration - warnings/errors on newer RabbitMQ versions.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Operator upgrade will trigger rolling updates of managed RabbitMQ + StatefulSets; to control timing, pause reconciliation before upgrading the + operator and resume when safe.', CRD updates included in v2.9.0 (ensure + CRDs are applied as part of the upgrade)., 'Default RabbitMQ version managed + by the operator changes (3.13.2 in v2.9.0; 3.13.7 in v2.10.0), which can + cause cluster rolling restarts if you rely on defaults.', "New optional\ + \ annotation `rabbitmq.com/disable-default-topology-spread-constraints`\ + \ allows disabling the operator\u2019s default topology spread constraints\ + \ behavior."] + features: [Adds support for disabling the default topology spread constraints + via a new `rabbitmq.com/disable-default-topology-spread-constraints` annotation., + 'Increases the maximum allowed length of `additionalConfig`, enabling larger + custom RabbitMQ configuration snippets.', 'Changes default managed RabbitMQ + version to 3.13.7 (from 3.13.2 in 2.9.0), bringing RabbitMQ patch-level + updates by default.'] + breaking_changes: ['ANONYMOUS login is now disabled by default, which can break + clients or tooling relying on unauthenticated access; verify configured + users/permissions and update integrations accordingly.', '`vm_memory_high_watermark_paging_ratio` + is removed; if you set it anywhere (additionalConfig, ConfigMap, definitions), + remove it to avoid invalid configuration warnings/errors on newer RabbitMQ + versions.'] chart_version: 4.3.24 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.10.0-debian-12-r2 - - docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r6 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.10.0-debian-12-r2', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r6'] - version: 2.9.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator CRDs updated in v2.9.0 (plan to re-apply/upgrade CRDs as part of - the Helm upgrade and validate any CRD diff impacts). - features: - - RabbitMQ default/managed version moves forward (v2.8.0 defaulted to 3.13; - v2.9.0 bumps to RabbitMQ 3.13.2). - - 'Improved scale-out behavior: the operator avoids restarting the cluster after - a scale-out.' - - Graceful shutdown behavior was fixed, improving termination/drain reliability - during pod restarts/rollouts. - breaking_changes: - - Upgrading the cluster-operator to v2.9.0 will trigger rolling updates of managed - RabbitMQ clusters (StatefulSets). To control timing, pause reconciliation - before upgrading and resume when safe. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator CRDs updated in v2.9.0 (plan to re-apply/upgrade CRDs + as part of the Helm upgrade and validate any CRD diff impacts).] + features: [RabbitMQ default/managed version moves forward (v2.8.0 defaulted + to 3.13; v2.9.0 bumps to RabbitMQ 3.13.2)., 'Improved scale-out behavior: + the operator avoids restarting the cluster after a scale-out.', 'Graceful + shutdown behavior was fixed, improving termination/drain reliability during + pod restarts/rollouts.'] + breaking_changes: ['Upgrading the cluster-operator to v2.9.0 will trigger rolling + updates of managed RabbitMQ clusters (StatefulSets). To control timing, + pause reconciliation before upgrading and resume when safe.'] chart_version: 4.3.20 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.9.0-debian-12-r8 - - docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r5 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.9.0-debian-12-r8', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.2-debian-12-r5'] - version: 2.8.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: [] - features: - - RabbitMQ 3.13 is now the default deployed RabbitMQ version when using the - operator defaults. - - The operator now filters which Kubernetes objects it caches from the API, - reducing memory/CPU usage and improving performance at scale. - - Certificate annotations for certificates generated via Vault intermediate - CA were corrected, improving compatibility with Vault-based PKI workflows. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [] + features: [RabbitMQ 3.13 is now the default deployed RabbitMQ version when using + the operator defaults., 'The operator now filters which Kubernetes objects + it caches from the API, reducing memory/CPU usage and improving performance + at scale.', 'Certificate annotations for certificates generated via Vault + intermediate CA were corrected, improving compatibility with Vault-based + PKI workflows.'] breaking_changes: [] chart_version: 4.2.7 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.8.0-debian-12-r4 - - docker.io/bitnami/rmq-messaging-topology-operator:1.14.0-debian-12-r0 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.8.0-debian-12-r4', 'docker.io/bitnami/rmq-messaging-topology-operator:1.14.0-debian-12-r0'] - version: 2.7.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Dependency bumps: apimachinery to 0.29 (Kubernetes 1.29 aligned) and related - dependency updates.' - - 'Maintenance cleanup: removal of deprecated modules/function calls.' - - 'CI/build change: reverted docker/build-push-action version bump due to a - known issue.' - features: - - No user-facing features called out; this release is primarily maintenance - and dependency updates. - breaking_changes: - - Potential Kubernetes client/SDK compatibility change due to apimachinery bump - to 0.29; ensure your cluster/operator Kubernetes version and any custom integrations - are compatible. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Dependency bumps: apimachinery to 0.29 (Kubernetes 1.29 aligned) + and related dependency updates.', 'Maintenance cleanup: removal of deprecated + modules/function calls.', 'CI/build change: reverted docker/build-push-action + version bump due to a known issue.'] + features: [No user-facing features called out; this release is primarily maintenance + and dependency updates.] + breaking_changes: [Potential Kubernetes client/SDK compatibility change due + to apimachinery bump to 0.29; ensure your cluster/operator Kubernetes version + and any custom integrations are compatible.] chart_version: 4.2.0 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.7.0-debian-12-r8 - - docker.io/bitnami/rmq-messaging-topology-operator:1.13.0-debian-12-r7 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.7.0-debian-12-r8', 'docker.io/bitnami/rmq-messaging-topology-operator:1.13.0-debian-12-r7'] - version: 2.6.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Dependencies bumped (client-go, kustomize) and overall dependency update to - Kubernetes 1.28 compatibility. - - Operator adds support for Erlang INET configuration. - - Documentation/network policy guidance updated to include stream ports for - inter-node traffic. - - CI/maintenance tweaks (exclude Google Auth in PRs). - - 'Behavioral/values-type change: `imagePullSecrets` is now treated as an array.' - features: - - Support for Erlang INET configuration (lets you tune Erlang networking via - operator-managed config). - - Docs update to include RabbitMQ stream ports in the recommended inter-node - traffic NetworkPolicy. - breaking_changes: - - '`imagePullSecrets` changed to be an array; if you previously supplied a single - object/string, update your manifests/values to list form to avoid rendering - or reconciliation issues.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Dependencies bumped (client-go, kustomize) and overall dependency + update to Kubernetes 1.28 compatibility.', Operator adds support for Erlang + INET configuration., Documentation/network policy guidance updated to include + stream ports for inter-node traffic., CI/maintenance tweaks (exclude Google + Auth in PRs)., 'Behavioral/values-type change: `imagePullSecrets` is now + treated as an array.'] + features: [Support for Erlang INET configuration (lets you tune Erlang networking + via operator-managed config)., Docs update to include RabbitMQ stream ports + in the recommended inter-node traffic NetworkPolicy.] + breaking_changes: ['`imagePullSecrets` changed to be an array; if you previously + supplied a single object/string, update your manifests/values to list form + to avoid rendering or reconciliation issues.'] chart_version: 3.14.0 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.6.0-debian-11-r3 - - docker.io/bitnami/rmq-messaging-topology-operator:1.12.2-debian-11-r1 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.6.0-debian-11-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.2-debian-11-r1'] - version: 2.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumped Go module major version to v2 (internal/module path change; mainly - affects developers building the operator). - - 'CI/build updates to produce images for additional architectures: ppc64le - and s390x.' - - 'Kustomize-related rename: `patches` -> `patchesStrategicMerge` (affects overlays/manifests - if you vendor kustomize configs from the repo).' - - Refactored Makefile (developer/build change). - - README corrected default RabbitMQ version documentation. - features: - - Multi-architecture image build support was expanded to include ppc64le and - s390x, improving deployability on those platforms. - breaking_changes: - - If you use Kustomize manifests/overlays derived from this repo, you may need - to update `patches` to `patchesStrategicMerge` to match newer kustomize syntax; - otherwise kustomize builds can fail. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumped Go module major version to v2 (internal/module path change; + mainly affects developers building the operator)., 'CI/build updates to + produce images for additional architectures: ppc64le and s390x.', 'Kustomize-related + rename: `patches` -> `patchesStrategicMerge` (affects overlays/manifests + if you vendor kustomize configs from the repo).', Refactored Makefile (developer/build + change)., README corrected default RabbitMQ version documentation.] + features: ['Multi-architecture image build support was expanded to include ppc64le + and s390x, improving deployability on those platforms.'] + breaking_changes: ['If you use Kustomize manifests/overlays derived from this + repo, you may need to update `patches` to `patchesStrategicMerge` to match + newer kustomize syntax; otherwise kustomize builds can fail.'] chart_version: 3.10.5 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.5.0-debian-11-r39 - - docker.io/bitnami/rmq-messaging-topology-operator:1.12.1-debian-11-r2 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.5.0-debian-11-r39', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.1-debian-11-r2'] - version: 2.4.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Default RabbitMQ image version used by the operator changed from 3.11.18 (in - v2.3.0) to 3.12.2 (in v2.4.0). - features: - - Operator now uses RabbitMQ 3.12.2 by default. - breaking_changes: - - RabbitMQ default bumps to 3.12.x; upgrades from older RabbitMQ require you - to already be on 3.11.18+ and to have all feature flags enabled before moving - to 3.12. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Default RabbitMQ image version used by the operator changed + from 3.11.18 (in v2.3.0) to 3.12.2 (in v2.4.0).] + features: [Operator now uses RabbitMQ 3.12.2 by default.] + breaking_changes: [RabbitMQ default bumps to 3.12.x; upgrades from older RabbitMQ + require you to already be on 3.11.18+ and to have all feature flags enabled + before moving to 3.12.] chart_version: 3.7.1 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.4.0-debian-11-r15 - - docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-debian-11-r14 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.4.0-debian-11-r15', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-debian-11-r14'] - version: 2.3.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Update bundled Grafana dashboards (queue dashboard improvements: fixed datasource - usage, added meaningful legends, refresh set to 10s).' - - 'Alerting tweak: fixed LowDiskWatermarkPredicted alert behavior.' - - Operator now supports multi-namespace cache scoping. - - 'Build/release pipeline changes: publish separate -amd64 and -arm64 release - images; bump CI Kubernetes version; move to Go 1.20; bump controller-runtime - and Kubernetes API libraries to 1.27; remove deprecated methods.' - - Fix plugin-related paths and environment variable name used by examples/manifests. - - 'Examples: simplified import-definitions example.' - - Default RabbitMQ image updated to 3.11.18 (from earlier 3.11.x). - features: - - Multi-namespace cache scoping, enabling the operator to watch/cache resources - across multiple namespaces with more control. - - Improved Grafana dashboards (better legends, corrected datasource usage, and - faster default refresh). - - Multi-arch release artifacts (-amd64 and -arm64) produced on new releases. - breaking_changes: - - Controller-runtime and Kubernetes API dependencies bumped to 1.27 and deprecated - methods removed; if you build/customize the operator or rely on internal APIs, - update your code and ensure cluster version compatibility. - - Default RabbitMQ image version changed to 3.11.18; existing clusters may roll - to the new patch version depending on your image/version pinning strategy. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Update bundled Grafana dashboards (queue dashboard improvements: + fixed datasource usage, added meaningful legends, refresh set to 10s).', + 'Alerting tweak: fixed LowDiskWatermarkPredicted alert behavior.', Operator + now supports multi-namespace cache scoping., 'Build/release pipeline changes: + publish separate -amd64 and -arm64 release images; bump CI Kubernetes version; + move to Go 1.20; bump controller-runtime and Kubernetes API libraries to + 1.27; remove deprecated methods.', Fix plugin-related paths and environment + variable name used by examples/manifests., 'Examples: simplified import-definitions + example.', Default RabbitMQ image updated to 3.11.18 (from earlier 3.11.x).] + features: ['Multi-namespace cache scoping, enabling the operator to watch/cache + resources across multiple namespaces with more control.', 'Improved Grafana + dashboards (better legends, corrected datasource usage, and faster default + refresh).', Multi-arch release artifacts (-amd64 and -arm64) produced on + new releases.] + breaking_changes: ['Controller-runtime and Kubernetes API dependencies bumped + to 1.27 and deprecated methods removed; if you build/customize the operator + or rely on internal APIs, update your code and ensure cluster version compatibility.', + Default RabbitMQ image version changed to 3.11.18; existing clusters may roll + to the new patch version depending on your image/version pinning strategy.] chart_version: 3.6.2 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.3.0-scratch-r3 - - docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-scratch-r2 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.3.0-scratch-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.12.0-scratch-r2'] - version: 2.2.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator now allows the RabbitMQ operator to control images (image selection/control - improvements). - - Adds support to override `StatefulSet.spec.persistentVolumeClaimRetentionPolicy` - in generated StatefulSets. - - 'Logging verbosity adjusted: some verbose log lines moved to debug level.' - - 'Networking behavior update: opens the stream port when the stream management - plugin is enabled.' - - 'Release pipeline/build changes: multi-arch image work continued (including - generating arm64 and single-arch artifacts, sha-based tags for amd64), plus - CI/CD pipeline fixes.' - features: - - Ability for the operator to control RabbitMQ images, giving more flexibility - over what images are deployed. - - Support for overriding `persistentVolumeClaimRetentionPolicy` on StatefulSets - managed by the operator. - - Automatic opening of the RabbitMQ stream port when the stream management plugin - is enabled. - breaking_changes: - - Default RabbitMQ version was bumped (ultimately to `3.11.10-management`), - which may trigger rolling updates or behavior changes unless you pin/override - the RabbitMQ image/version in your RabbitmqCluster spec. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator now allows the RabbitMQ operator to control images + (image selection/control improvements)., Adds support to override `StatefulSet.spec.persistentVolumeClaimRetentionPolicy` + in generated StatefulSets., 'Logging verbosity adjusted: some verbose log + lines moved to debug level.', 'Networking behavior update: opens the stream + port when the stream management plugin is enabled.', 'Release pipeline/build + changes: multi-arch image work continued (including generating arm64 and + single-arch artifacts, sha-based tags for amd64), plus CI/CD pipeline fixes.'] + features: ['Ability for the operator to control RabbitMQ images, giving more + flexibility over what images are deployed.', Support for overriding `persistentVolumeClaimRetentionPolicy` + on StatefulSets managed by the operator., Automatic opening of the RabbitMQ + stream port when the stream management plugin is enabled.] + breaking_changes: ['Default RabbitMQ version was bumped (ultimately to `3.11.10-management`), + which may trigger rolling updates or behavior changes unless you pin/override + the RabbitMQ image/version in your RabbitmqCluster spec.'] chart_version: 3.4.1 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.2.0-scratch-r7 - - docker.io/bitnami/rmq-messaging-topology-operator:1.10.3-scratch-r1 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.2.0-scratch-r7', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.3-scratch-r1'] - version: 2.1.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator image is now multi-architecture (amd64+arm64) and published as a - multi-arch OCI manifest; runtimes will pull the correct arch automatically. - - Operator introduces a 30s delayed start behavior (likely to give the API server/CRDs - time to settle) which can affect perceived startup/rollout timing. - - StatefulSet management now supports `minReadySeconds` in the generated/managed - StatefulSetSpec. - - PodDisruptionBudget manifest updated (behavior may change depending on your - prior expectations/overrides). - - Service binding RBAC added via an aggregating ClusterRole (new ClusterRole - resources/permissions will appear). - - External Secret integration updated to allow skipping creation of the default - user and provides new examples (may change behavior if you rely on default - user provisioning). - - Adds a label to improve service discoverability (affects labels/selectors/monitoring - discovery if you key off labels). - features: - - Multi-arch (AMD64 and ARM64) operator image support out of the box. - - Support for `minReadySeconds` in RabbitMQ cluster StatefulSets managed by - the operator. - - Option in External Secret integration to skip creating the default user, plus - an admin external secret example. - - New aggregating ClusterRole to support Service Bindings and improved service - discoverability labeling. - breaking_changes: - - Upgrading the operator to v2.1.0 will trigger reconciliation changes that - roll RabbitMQ clusters (rolling update of StatefulSets). Pause reconciliation - before upgrading if you need to control when clusters roll, then resume when - safe. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator image is now multi-architecture (amd64+arm64) and published + as a multi-arch OCI manifest; runtimes will pull the correct arch automatically., + Operator introduces a 30s delayed start behavior (likely to give the API server/CRDs + time to settle) which can affect perceived startup/rollout timing., StatefulSet + management now supports `minReadySeconds` in the generated/managed StatefulSetSpec., + PodDisruptionBudget manifest updated (behavior may change depending on your + prior expectations/overrides)., Service binding RBAC added via an aggregating + ClusterRole (new ClusterRole resources/permissions will appear)., External + Secret integration updated to allow skipping creation of the default user + and provides new examples (may change behavior if you rely on default user + provisioning)., Adds a label to improve service discoverability (affects + labels/selectors/monitoring discovery if you key off labels).] + features: [Multi-arch (AMD64 and ARM64) operator image support out of the box., + Support for `minReadySeconds` in RabbitMQ cluster StatefulSets managed by + the operator., 'Option in External Secret integration to skip creating the + default user, plus an admin external secret example.', New aggregating ClusterRole + to support Service Bindings and improved service discoverability labeling.] + breaking_changes: ['Upgrading the operator to v2.1.0 will trigger reconciliation + changes that roll RabbitMQ clusters (rolling update of StatefulSets). Pause + reconciliation before upgrading if you need to control when clusters roll, + then resume when safe.'] chart_version: 3.2.5 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.1.0-scratch-r6 - - docker.io/bitnami/rmq-messaging-topology-operator:1.10.1-scratch-r2 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.1.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.1-scratch-r2'] - version: 2.0.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Operator now requires RabbitMQ >= 3.9.9 and drops support for RabbitMQ 3.8. - - Upgrading the operator will trigger reconciliation that updates existing RabbitMQ - clusters (rolling update of StatefulSets) unless reconciliation is paused. - - Kubernetes/controller-runtime dependencies were bumped (K8s API to 1.25, controller-runtime - 0.13); CRDs were regenerated accordingly. - - Added a pprof debug endpoint (introduced in 1.14.0). - - 'Monitoring/alerting tweak: fixed FileDescriptorsNearLimit alert rule; earlier - 1.14.0 removed Prometheus scrape annotation.' - - 'Build/test/tooling updates: Go bumped to 1.19; system tests made more reliable; - added govulncheck; CI/workflow updates including OperatorHub PR automation - and CodeQL updates.' - features: - - pprof debug endpoint for troubleshooting operator performance/issues. - - Improved system test reliability and additional security scanning via govulncheck. - - OperatorHub-related automation to streamline publishing. - breaking_changes: - - RabbitMQ 3.8 is no longer supported; RabbitMQ clusters must be >= 3.9.9 before - upgrading the operator or clusters may fail to start. - - Operator upgrade can force rolling updates of managed RabbitMQ StatefulSets - via reconciliation; pause reconciliation if you need to control timing. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Operator now requires RabbitMQ >= 3.9.9 and drops support for + RabbitMQ 3.8., Upgrading the operator will trigger reconciliation that updates + existing RabbitMQ clusters (rolling update of StatefulSets) unless reconciliation + is paused., 'Kubernetes/controller-runtime dependencies were bumped (K8s + API to 1.25, controller-runtime 0.13); CRDs were regenerated accordingly.', + Added a pprof debug endpoint (introduced in 1.14.0)., 'Monitoring/alerting + tweak: fixed FileDescriptorsNearLimit alert rule; earlier 1.14.0 removed + Prometheus scrape annotation.', 'Build/test/tooling updates: Go bumped to + 1.19; system tests made more reliable; added govulncheck; CI/workflow updates + including OperatorHub PR automation and CodeQL updates.'] + features: [pprof debug endpoint for troubleshooting operator performance/issues., + Improved system test reliability and additional security scanning via govulncheck., + OperatorHub-related automation to streamline publishing.] + breaking_changes: [RabbitMQ 3.8 is no longer supported; RabbitMQ clusters must + be >= 3.9.9 before upgrading the operator or clusters may fail to start., + Operator upgrade can force rolling updates of managed RabbitMQ StatefulSets + via reconciliation; pause reconciliation if you need to control timing.] chart_version: 3.1.5 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:2.0.0-scratch-r6 - - docker.io/bitnami/rmq-messaging-topology-operator:1.10.0-scratch-r0 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:2.0.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.10.0-scratch-r0'] - version: 1.14.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Manifests are now generated using Kubernetes 1.24 and controller-gen 0.9 (affects - generated CRDs/RBAC YAML output). - - Prometheus scrape annotation was removed (any metrics scraping should rely - on ServiceMonitor/PodMonitor or explicit configuration). - - All errors are now wrapped (may change log messages and error strings used - by tests/alerting). - - A pprof debug endpoint was added (new debug surface; review exposure and network - policies). - - Operator defaults refactored into a separate function (no functional change - expected, but could subtly affect defaulting behavior). - - Controller-runtime bumped from 0.11.2 to 0.12.1 and controller-tools to 0.9.0 - (aligns with newer Kubernetes APIs; may affect supported k8s versions). - features: - - Added a pprof debug endpoint to help with profiling/troubleshooting the operator. - - Improved error handling by wrapping errors, making root causes easier to trace - in logs. - breaking_changes: - - Prometheus scrape annotation removal can break existing Prometheus setups - that depended on annotations for auto-scraping; ensure you have an alternative - scrape configuration in place. + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Manifests are now generated using Kubernetes 1.24 and controller-gen + 0.9 (affects generated CRDs/RBAC YAML output)., Prometheus scrape annotation + was removed (any metrics scraping should rely on ServiceMonitor/PodMonitor + or explicit configuration)., All errors are now wrapped (may change log + messages and error strings used by tests/alerting)., A pprof debug endpoint + was added (new debug surface; review exposure and network policies)., 'Operator + defaults refactored into a separate function (no functional change expected, + but could subtly affect defaulting behavior).', Controller-runtime bumped + from 0.11.2 to 0.12.1 and controller-tools to 0.9.0 (aligns with newer Kubernetes + APIs; may affect supported k8s versions).] + features: [Added a pprof debug endpoint to help with profiling/troubleshooting + the operator., 'Improved error handling by wrapping errors, making root + causes easier to trace in logs.'] + breaking_changes: [Prometheus scrape annotation removal can break existing Prometheus + setups that depended on annotations for auto-scraping; ensure you have an + alternative scrape configuration in place.] chart_version: 2.7.4 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:1.14.0-scratch-r6 - - docker.io/bitnami/rmq-messaging-topology-operator:1.8.0-scratch-r1 + images: ['docker.io/bitnami/rabbitmq-cluster-operator:1.14.0-scratch-r6', 'docker.io/bitnami/rmq-messaging-topology-operator:1.8.0-scratch-r1'] - version: 1.13.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' - - '1.25' - - '1.24' - - '1.23' - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', + '1.27', '1.26', '1.25', '1.24', '1.23', '1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 2.6.6 - images: - - docker.io/bitnami/rabbitmq-cluster-operator:1.13.1-scratch-r3 - - docker.io/bitnami/rmq-messaging-topology-operator:1.6.0-scratch-r0 - name: rabbitmq-cluster-operator + images: ['docker.io/bitnami/rabbitmq-cluster-operator:1.13.1-scratch-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.6.0-scratch-r0'] - icon: https://kserve.github.io/website/img/kserve-logo-small.png git_url: https://github.com/kserve/kserve release_url: https://github.com/kserve/kserve/releases/tag/v{vsn} @@ -40409,63 +29492,46 @@ addons: chart_name: kserve versions: - version: 0.20.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - KServe 0.20.0 includes new/updated CRD and resources Helm chart artifacts - (kserve-crd, kserve-resources, llmisvc-crd/resources, localmodel-crd/resources, - runtime-configs). Expect CRD and controller rollout as part of upgrade. - - Gateway API dependency bumped to v1.5.1; Envoy AI Gateway bumped to v1.0.0 - and Envoy Gateway to v1.8.1 (ensure cluster dependencies match). - - LLMInferenceService routing resources migrated to llm-d.ai CRDs; e2e updates - indicate API group changes for related CRDs (e.g., InferenceObjective). - - Modelcache RBAC updated (adds delete verb for localmodel PV/PVC). - - LocalModel controller and related resources include race-condition fixes; - storage/OCI mounting support expanded. - - LLMInferenceService webhook install/rollout ordering tightened in CI, implying - upgrade sequencing/rollout readiness is important. Look for webhook cert readiness - before proceeding. - features: - - Forward Authorization header from transformer to predictor (helps auth propagation - through inference pipeline). - - Support multiple OCI sources in storageUris and add oci+native:// ImageVolume - mounting for OCI artifacts. - - Add vLLM as a supported runtime; plus new AutoGluon server runtime option. - - 'LLMInferenceService: model-based routing gates with models surfaced in status; - stable/version-independent URLs discovery; traffic splitting APIs including - group routing machinery and readiness gating.' - - 'LLMInferenceService: KV cache offloading spec (CPU tiering + secondary filesystem - tiers) and additional llm-d baseline default alignments.' - - Add Managed DRA support for LLMInferenceService (resource allocation integrations). - - Add platform hooks for InferenceService service customization; canary rollout - support for RawDeployment mode. - - Add support for confidential model serving. - breaking_changes: - - LLMInferenceService routing resources migrated to llm-d.ai CRDs; existing - clusters may need CRD updates and any manifests/controllers referencing old - API groups must be updated accordingly. - - Dependency bumps (Gateway API v1.5.1, Envoy AI Gateway v1.0.0, Envoy Gateway - v1.8.1) can require compatible versions installed in-cluster; mismatches may - break HTTPRoute/Gateway behavior. - - 'Security/dependency update: Starlette bumped to >=1.0.1 (CVE fix). If you - pin images or python deps in custom runtimes, ensure compatibility.' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['KServe 0.20.0 includes new/updated CRD and resources Helm chart + artifacts (kserve-crd, kserve-resources, llmisvc-crd/resources, localmodel-crd/resources, + runtime-configs). Expect CRD and controller rollout as part of upgrade.', + Gateway API dependency bumped to v1.5.1; Envoy AI Gateway bumped to v1.0.0 + and Envoy Gateway to v1.8.1 (ensure cluster dependencies match)., 'LLMInferenceService + routing resources migrated to llm-d.ai CRDs; e2e updates indicate API group + changes for related CRDs (e.g., InferenceObjective).', Modelcache RBAC updated + (adds delete verb for localmodel PV/PVC)., LocalModel controller and related + resources include race-condition fixes; storage/OCI mounting support expanded., + 'LLMInferenceService webhook install/rollout ordering tightened in CI, implying + upgrade sequencing/rollout readiness is important. Look for webhook cert + readiness before proceeding.'] + features: [Forward Authorization header from transformer to predictor (helps + auth propagation through inference pipeline)., 'Support multiple OCI sources + in storageUris and add oci+native:// ImageVolume mounting for OCI artifacts.', + Add vLLM as a supported runtime; plus new AutoGluon server runtime option., + 'LLMInferenceService: model-based routing gates with models surfaced in status; + stable/version-independent URLs discovery; traffic splitting APIs including + group routing machinery and readiness gating.', 'LLMInferenceService: KV + cache offloading spec (CPU tiering + secondary filesystem tiers) and additional + llm-d baseline default alignments.', Add Managed DRA support for LLMInferenceService + (resource allocation integrations)., Add platform hooks for InferenceService + service customization; canary rollout support for RawDeployment mode., Add + support for confidential model serving.] + breaking_changes: [LLMInferenceService routing resources migrated to llm-d.ai + CRDs; existing clusters may need CRD updates and any manifests/controllers + referencing old API groups must be updated accordingly., 'Dependency bumps + (Gateway API v1.5.1, Envoy AI Gateway v1.0.0, Envoy Gateway v1.8.1) can + require compatible versions installed in-cluster; mismatches may break HTTPRoute/Gateway + behavior.', 'Security/dependency update: Starlette bumped to >=1.0.1 (CVE + fix). If you pin images or python deps in custom runtimes, ensure compatibility.'] chart_version: v0.20.0 images: [] - version: 0.19.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -40483,57 +29549,42 @@ addons: \ CRD packaging fix**: v0.19.0 removes **incorrect CRDs included in `llmisvc-crd`**\ \ (PR #5428). Review your CRD installation path to avoid drift between previously-installed\ \ CRDs and the corrected set.\n" - chart_updates: - - LLMISvc CRD chart content corrected (removed incorrect CRDs). - - Helm upgrade guard added to avoid deleting ClusterStorageContainer CRD. - - Defaults updated to match kustomize for imagePullPolicy. - - Minimal (CRD-minimal) installs now enable conversion webhooks. - - LLMISvc chart gains option to skip creating GIE CRDs. - features: - - Standard mode InferenceService can now support dual-protocol routing (REST - and gRPC) for the same service. - - LocalModelCache support was added for LLMInferenceService to improve reuse/efficiency - of locally cached models. - - LLMISvc now propagates spec labels/annotations to the Service and can emit - Kubernetes Events for readiness transitions. - - LLMISvc routing/status observability improved (model-name based routing, topology/workload - refs reporting, applied-configs visibility). - - Autoscaling support and testing for LLMISvc improved, including better surfacing - of HPA/KEDA scaling status in conditions. - breaking_changes: - - Minimal installs now enable conversion webhooks, which can change requirements/behavior - in clusters that previously ran minimal CRDs without webhooks. - - LLMISvc CRD packaging was corrected; if you previously depended on the erroneous - CRDs bundled in `llmisvc-crd`, your upgrade may remove/stop managing them - and you must install any needed CRDs explicitly. + chart_updates: [LLMISvc CRD chart content corrected (removed incorrect CRDs)., + Helm upgrade guard added to avoid deleting ClusterStorageContainer CRD., Defaults + updated to match kustomize for imagePullPolicy., Minimal (CRD-minimal) installs + now enable conversion webhooks., LLMISvc chart gains option to skip creating + GIE CRDs.] + features: [Standard mode InferenceService can now support dual-protocol routing + (REST and gRPC) for the same service., LocalModelCache support was added + for LLMInferenceService to improve reuse/efficiency of locally cached models., + LLMISvc now propagates spec labels/annotations to the Service and can emit + Kubernetes Events for readiness transitions., 'LLMISvc routing/status observability + improved (model-name based routing, topology/workload refs reporting, applied-configs + visibility).', 'Autoscaling support and testing for LLMISvc improved, including + better surfacing of HPA/KEDA scaling status in conditions.'] + breaking_changes: ['Minimal installs now enable conversion webhooks, which can + change requirements/behavior in clusters that previously ran minimal CRDs + without webhooks.', 'LLMISvc CRD packaging was corrected; if you previously + depended on the erroneous CRDs bundled in `llmisvc-crd`, your upgrade may + remove/stop managing them and you must install any needed CRDs explicitly.'] chart_version: v0.19.0 images: [] - version: 0.18.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - v0.18.1 is a patch release containing a cherry-picked Helm chart fix; no functional - application feature changes are called out in the release notes. - - No chart/values details are provided in the supplied notes; expect minor packaging/templating - corrections only. + chart_updates: [v0.18.1 is a patch release containing a cherry-picked Helm chart + fix; no functional application feature changes are called out in the release + notes., No chart/values details are provided in the supplied notes; expect + minor packaging/templating corrections only.] features: [] breaking_changes: [] chart_version: v0.18.1 images: [] - version: 0.18.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -40550,35 +29601,29 @@ addons: - **Runtime-configs chart metadata:** `kserve-runtime-configs` now includes\ \ the **helm chart version** in its output/packaging, which may affect your\ \ internal artifact tracking.\n" - chart_updates: - - 'Main chart renamed to `kserve-resources` (PR #5190).' - - 'Packaging fix: skip `_folder` when packaging charts (PR #5186).' - - 'Charts support dependency version overrides (PR #5268).' - - '`kserve-runtime-configs` includes helm chart version metadata (PR #5209).' - - 'KServe bundle includes GIE CRDs (PR #5214).' - features: - - Adds CSV and Parquet marshallers for inference logging/marshalling use cases. - - Inference logger now records occurrence/time in CloudEvents for better traceability. - - ModelCache gains a namespace-scoped mode; download jobs can run in a dedicated - job namespace for tighter multi-tenancy controls. - - 'LLMInferenceService (llmisvc) improvements: autoscaling integration (KEDA/HPA - and WVA), TLS/config updates, better URL discovery, and more robust validation.' - - Gateway/GKE Gateway support improvements, including an option to disable HTTPRoute - timeouts and new `/v1/responses` route for OpenAI Responses API support. - breaking_changes: - - 'Helm chart reference change: the primary KServe chart is now `kserve-resources`; - upgrade tooling/pipelines that still reference `kserve` will fail until updated.' - - Potential installation/ownership conflicts if you previously managed GIE CRDs - separately, since they are now bundled with KServe in v0.18.0. + chart_updates: ['Main chart renamed to `kserve-resources` (PR #5190).', 'Packaging + fix: skip `_folder` when packaging charts (PR #5186).', 'Charts support + dependency version overrides (PR #5268).', '`kserve-runtime-configs` includes + helm chart version metadata (PR #5209).', 'KServe bundle includes GIE CRDs + (PR #5214).'] + features: [Adds CSV and Parquet marshallers for inference logging/marshalling + use cases., Inference logger now records occurrence/time in CloudEvents + for better traceability., ModelCache gains a namespace-scoped mode; download + jobs can run in a dedicated job namespace for tighter multi-tenancy controls., + 'LLMInferenceService (llmisvc) improvements: autoscaling integration (KEDA/HPA + and WVA), TLS/config updates, better URL discovery, and more robust validation.', + 'Gateway/GKE Gateway support improvements, including an option to disable + HTTPRoute timeouts and new `/v1/responses` route for OpenAI Responses API + support.'] + breaking_changes: ['Helm chart reference change: the primary KServe chart is + now `kserve-resources`; upgrade tooling/pipelines that still reference `kserve` + will fail until updated.', 'Potential installation/ownership conflicts if + you previously managed GIE CRDs separately, since they are now bundled with + KServe in v0.18.0.'] chart_version: v0.18.0 images: [] - version: 0.17.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -40592,23 +29637,17 @@ addons: chart packaging fixes. ' - chart_updates: - - Includes the missing v0.17.0 installation scripts in the v0.17.1 release artifacts - (fix/cherry-pick). - - Applies a Helm chart fix via cherry-pick (release primarily addresses chart/release - packaging). - - Version bump to v0.17.1; new Helm chart tarballs published for all subcharts - (kserve-crd, kserve-resources, runtime-configs, llmisvc-*, localmodel-*). + chart_updates: [Includes the missing v0.17.0 installation scripts in the v0.17.1 + release artifacts (fix/cherry-pick)., Applies a Helm chart fix via cherry-pick + (release primarily addresses chart/release packaging)., 'Version bump to + v0.17.1; new Helm chart tarballs published for all subcharts (kserve-crd, + kserve-resources, runtime-configs, llmisvc-*, localmodel-*).'] features: [] breaking_changes: [] chart_version: v0.17.1 images: [] - version: 0.17.0 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -40640,57 +29679,46 @@ addons: \ `kserve` was a single chart.\n\n*(Release notes do not include a full values.yaml\ \ diff; you should run `helm show values` for v0.16.0 vs v0.17.0 charts and\ \ reconcile.)*" - chart_updates: - - Helm packaging now publishes multiple artifacts instead of a single kserve - chart; v0.17.0 release assets include CRD-only and resources-only charts for - KServe, LLMISVC, and LocalModel, plus a new runtime-configs chart. - - Manifests are restructured to a component-based layout (will change rendered - resource names/paths used by scripts/patching). - - LLMISVC CRD installation paths fixed; LLMISVC RBAC naming updated with `kserve` - prefixes and bindings adjusted accordingly. - - Quick install / dependency install scripts were centralized/refactored; installation - scripts updated to include required files and to fix several bugs. - - 'Controller/webhook architecture change: LocalModelCache webhook separated - from KServe controller; LLMInferenceService webhook added with E2E tests (may - add/modify webhook deployments/services).' - - Security and dependency refreshes across images and python deps (e.g., starlette - pin, cryptography CVE fixes), plus path traversal hardening in HTTP/tar extraction. - features: - - 'Storage initializer performance improvements: parallel S3/Azure blob downloads - and faster parallel S3 file downloads; plus new git download support and ability - to download only selected files.' - - New routing capability for InferenceServices via `pathTemplate` configuration - for inference service routing. - - Additional runtimes added, including an OpenVINO model server runtime and - a new predictive inference server runtime (with build/publish and E2E coverage). - - 'LLMISVC enhancements: ability to stop LLMInferenceService, optional storageInitializer, - scheduler HA/scaling support, improved CA bundle/cert management, improved - Gateway API URL discovery, autoscaling API support, and annotation/label propagation.' - - 'Gateway/API updates: upgrade to Gateway API v1.4.0 and bump Gateway API Inference - Extension (GIE) to v1.2.0.' - - 'Operational knobs: new env var `INFERENCE_SERVICE_NAME`, new `schedulerName` - field for ServingRuntimePodSpec, configurable Uvicorn event loop, and configurable - agent container resources.' - breaking_changes: - - 'Major Helm chart restructuring in v0.17.0: the old single `kserve` chart - is replaced/renamed and split into multiple charts (notably `kserve-resources`, - plus separate CRD/resources charts for KServe/LLMISVC/LocalModel). Existing - Helm release names, chart references, and patching automation will need changes.' - - 'vLLM/runtime ecosystem changes: KServe bumps vLLM versions and removes Python - 3.9 support for the vLLM runtime line; if you build custom runtime images - or depend on Python 3.9, you must update accordingly.' - - RBAC/name changes for LLMISVC components (prefixed roles/renamed resources) - can break custom RoleBinding/ClusterRoleBinding overrides if they referenced - old names. + chart_updates: ['Helm packaging now publishes multiple artifacts instead of + a single kserve chart; v0.17.0 release assets include CRD-only and resources-only + charts for KServe, LLMISVC, and LocalModel, plus a new runtime-configs chart.', + Manifests are restructured to a component-based layout (will change rendered + resource names/paths used by scripts/patching)., LLMISVC CRD installation + paths fixed; LLMISVC RBAC naming updated with `kserve` prefixes and bindings + adjusted accordingly., Quick install / dependency install scripts were centralized/refactored; + installation scripts updated to include required files and to fix several + bugs., 'Controller/webhook architecture change: LocalModelCache webhook + separated from KServe controller; LLMInferenceService webhook added with + E2E tests (may add/modify webhook deployments/services).', 'Security and + dependency refreshes across images and python deps (e.g., starlette pin, + cryptography CVE fixes), plus path traversal hardening in HTTP/tar extraction.'] + features: ['Storage initializer performance improvements: parallel S3/Azure + blob downloads and faster parallel S3 file downloads; plus new git download + support and ability to download only selected files.', New routing capability + for InferenceServices via `pathTemplate` configuration for inference service + routing., 'Additional runtimes added, including an OpenVINO model server + runtime and a new predictive inference server runtime (with build/publish + and E2E coverage).', 'LLMISVC enhancements: ability to stop LLMInferenceService, + optional storageInitializer, scheduler HA/scaling support, improved CA bundle/cert + management, improved Gateway API URL discovery, autoscaling API support, + and annotation/label propagation.', 'Gateway/API updates: upgrade to Gateway + API v1.4.0 and bump Gateway API Inference Extension (GIE) to v1.2.0.', 'Operational + knobs: new env var `INFERENCE_SERVICE_NAME`, new `schedulerName` field for + ServingRuntimePodSpec, configurable Uvicorn event loop, and configurable + agent container resources.'] + breaking_changes: ['Major Helm chart restructuring in v0.17.0: the old single + `kserve` chart is replaced/renamed and split into multiple charts (notably + `kserve-resources`, plus separate CRD/resources charts for KServe/LLMISVC/LocalModel). + Existing Helm release names, chart references, and patching automation will + need changes.', 'vLLM/runtime ecosystem changes: KServe bumps vLLM versions + and removes Python 3.9 support for the vLLM runtime line; if you build custom + runtime images or depend on Python 3.9, you must update accordingly.', RBAC/name + changes for LLMISVC components (prefixed roles/renamed resources) can break + custom RoleBinding/ClusterRoleBinding overrides if they referenced old names.] chart_version: v0.17.0 images: [] - version: 0.16.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: @@ -40707,276 +29735,180 @@ addons: \ to run LLMISVC, ensure it\u2019s disabled/not installed.\n- **CRD manifest\ \ naming:** CRD file was renamed to reflect all KServe CRDs; if you manage\ \ CRDs separately (GitOps), ensure your CRD sync picks up the renamed file." - chart_updates: - - Added/updated Helm templates and install logic for the new LLMInferenceService - (llmisvc) controller and webhooks, plus RBAC/templating fixes and a quick-install - script. - - Chart now surfaces additional configuration for OpenTelemetry collector and - autoscaler components. - - Bugfixes to chart packaging (e.g., llmisvc-crd-minimal chart) and a fix to - the controller image URL reference. - - '`kserve-resources` chart behavior changed to not enable desired ServingRuntimes - by default (confirm ServingRuntime availability post-upgrade).' - features: - - Introduces new **LLMInferenceService** and **LLMInferenceServiceConfig** CRDs/controllers - (llmisvc) aimed at LLM workloads, with validating webhooks and base configurations. - - "Adds **stop/resume** capabilities across components (InferenceService, Transformer,\ - \ Explainer, InferenceGraph), including support in \u201Craw/standard\u201D\ - \ deployments." - - Adds **inference logging to blob storage**, expanding support to **GCS and - Azure** in addition to prior backends, with metadata/header handling improvements. - - Adds support for **multiple storage URIs** on InferenceServices and secure/extended - storage configuration options (e.g., S3 via secret data, CA bundle injection). - - 'Improves autoscaling/observability integrations: more flexible OpenTelemetry - metrics support for autoscaling and options for securing Prometheus access - in KEDA.' - - Runtime and dependency bumps/updates, including **vLLM 0.9.x** updates and - **Torch 2.6/2.7** upgrades in related images/components. - breaking_changes: - - "Compatibility change: **removed \u201Cdefault\u201D suffix compatibility**\ - \ (if you relied on legacy resource naming/selection that used a `-default`\ - \ suffix, you may need to update manifests or references)." - - 'Python SDK/deps: **dropped Pydantic v1 support** (SDK consumers using Pydantic - v1 must upgrade to v2 or pin/adjust integrations).' - - 'Removed deprecated flag: **`EnableDirectPvcVolumeMount`** was removed (clusters/config - relying on this feature flag must migrate to the supported PVC/modelcar/storage - patterns).' - - 'API validation tightening: **disallow `name` field in standard predictor** - (manifests that set this field will fail validation/admission).' - - "Terminology/refactor: \u201CRawDeployment\u201D renamed to **\u201CStandard\u201D\ - ** and \u201CServerless\u201D to **\u201CKNative\u201D** in code/docs; expect\ - \ configuration/docs/fields to reflect the new naming (verify any automation\ - \ that keys off old terms)." + chart_updates: ['Added/updated Helm templates and install logic for the new + LLMInferenceService (llmisvc) controller and webhooks, plus RBAC/templating + fixes and a quick-install script.', Chart now surfaces additional configuration + for OpenTelemetry collector and autoscaler components., 'Bugfixes to chart + packaging (e.g., llmisvc-crd-minimal chart) and a fix to the controller + image URL reference.', '`kserve-resources` chart behavior changed to not + enable desired ServingRuntimes by default (confirm ServingRuntime availability + post-upgrade).'] + features: ['Introduces new **LLMInferenceService** and **LLMInferenceServiceConfig** + CRDs/controllers (llmisvc) aimed at LLM workloads, with validating webhooks + and base configurations.', "Adds **stop/resume** capabilities across components\ + \ (InferenceService, Transformer, Explainer, InferenceGraph), including\ + \ support in \u201Craw/standard\u201D deployments.", 'Adds **inference logging + to blob storage**, expanding support to **GCS and Azure** in addition to + prior backends, with metadata/header handling improvements.', 'Adds support + for **multiple storage URIs** on InferenceServices and secure/extended storage + configuration options (e.g., S3 via secret data, CA bundle injection).', + 'Improves autoscaling/observability integrations: more flexible OpenTelemetry + metrics support for autoscaling and options for securing Prometheus access + in KEDA.', 'Runtime and dependency bumps/updates, including **vLLM 0.9.x** + updates and **Torch 2.6/2.7** upgrades in related images/components.'] + breaking_changes: ["Compatibility change: **removed \u201Cdefault\u201D suffix\ + \ compatibility** (if you relied on legacy resource naming/selection that\ + \ used a `-default` suffix, you may need to update manifests or references).", + 'Python SDK/deps: **dropped Pydantic v1 support** (SDK consumers using Pydantic + v1 must upgrade to v2 or pin/adjust integrations).', 'Removed deprecated + flag: **`EnableDirectPvcVolumeMount`** was removed (clusters/config relying + on this feature flag must migrate to the supported PVC/modelcar/storage + patterns).', 'API validation tightening: **disallow `name` field in standard + predictor** (manifests that set this field will fail validation/admission).', + "Terminology/refactor: \u201CRawDeployment\u201D renamed to **\u201CStandard\u201D\ + ** and \u201CServerless\u201D to **\u201CKNative\u201D** in code/docs; expect\ + \ configuration/docs/fields to reflect the new naming (verify any automation\ + \ that keys off old terms)."] chart_version: v0.16.0 - images: - - docker.io/seldonio/mlserver:1.5.0 - - kserve/huggingfaceserver:v0.16.0 - - kserve/huggingfaceserver:v0.16.0-gpu - - kserve/kserve-controller:v0.16.0 - - kserve/lgbserver:v0.16.0 - - kserve/paddleserver:v0.16.0 - - kserve/pmmlserver:v0.16.0 - - kserve/sklearnserver:v0.16.0 - - kserve/storage-initializer:v0.16.0 - - kserve/xgbserver:v0.16.0 - - nvcr.io/nvidia/tritonserver:23.05-py3 - - pytorch/torchserve-kfs:0.9.0 - - quay.io/brancz/kube-rbac-proxy:v0.18.0 - - tensorflow/serving:2.6.2 + images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.16.0', + 'kserve/huggingfaceserver:v0.16.0-gpu', 'kserve/kserve-controller:v0.16.0', + 'kserve/lgbserver:v0.16.0', 'kserve/paddleserver:v0.16.0', 'kserve/pmmlserver:v0.16.0', + 'kserve/sklearnserver:v0.16.0', 'kserve/storage-initializer:v0.16.0', 'kserve/xgbserver:v0.16.0', + 'nvcr.io/nvidia/tritonserver:23.05-py3', 'pytorch/torchserve-kfs:0.9.0', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', + 'tensorflow/serving:2.6.2'] - version: 0.15.2 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 'Model caching enhancements in 0.14.1: introduced LocalModelNode/LocalModelCache - resources, node agent, multi node-group support, redownload on missing models, - and an annotation to disable model cache.' - - In 0.15.2, ModelCar is enabled by default and ModelServer init adds predictor_config - support. - - Autoscaler reconciliation behavior updated by changing the order the Knative - autoscaler ConfigMap is read. - breaking_changes: - - 'Potential behavior change: ModelCar is enabled by default in 0.15.2, which - may affect storage/runtime expectations and should be validated in your environment.' - - 'Potential operational change: autoscaler settings may be applied differently - due to the changed ConfigMap read order during reconciliation.' + features: ['Model caching enhancements in 0.14.1: introduced LocalModelNode/LocalModelCache + resources, node agent, multi node-group support, redownload on missing models, + and an annotation to disable model cache.', 'In 0.15.2, ModelCar is enabled + by default and ModelServer init adds predictor_config support.', Autoscaler + reconciliation behavior updated by changing the order the Knative autoscaler + ConfigMap is read.] + breaking_changes: ['Potential behavior change: ModelCar is enabled by default + in 0.15.2, which may affect storage/runtime expectations and should be validated + in your environment.', 'Potential operational change: autoscaler settings + may be applied differently due to the changed ConfigMap read order during + reconciliation.'] chart_version: v0.15.2 - images: - - docker.io/seldonio/mlserver:1.5.0 - - kserve/huggingfaceserver:v0.15.2 - - kserve/huggingfaceserver:v0.15.2-gpu - - kserve/kserve-controller:v0.15.2 - - kserve/lgbserver:v0.15.2 - - kserve/paddleserver:v0.15.2 - - kserve/pmmlserver:v0.15.2 - - kserve/sklearnserver:v0.15.2 - - kserve/storage-initializer:v0.15.2 - - kserve/xgbserver:v0.15.2 - - nvcr.io/nvidia/tritonserver:23.05-py3 - - pytorch/torchserve-kfs:0.9.0 - - quay.io/brancz/kube-rbac-proxy:v0.18.0 - - tensorflow/serving:2.6.2 + images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.15.2', + 'kserve/huggingfaceserver:v0.15.2-gpu', 'kserve/kserve-controller:v0.15.2', + 'kserve/lgbserver:v0.15.2', 'kserve/paddleserver:v0.15.2', 'kserve/pmmlserver:v0.15.2', + 'kserve/sklearnserver:v0.15.2', 'kserve/storage-initializer:v0.15.2', 'kserve/xgbserver:v0.15.2', + 'nvcr.io/nvidia/tritonserver:23.05-py3', 'pytorch/torchserve-kfs:0.9.0', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', + 'tensorflow/serving:2.6.2'] - version: 0.14.1 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - v0.14.1 introduces a new LocalModelNode CR plus a node agent and updated model-cache - controller to support node-local model caching workflows. - - Model cache functionality is expanded with multiple node groups, an admission - webhook for LocalModelCache, and an annotation to disable model cache per - resource. - - Inference protocol responses now support datetime object serialization for - both v1 and v2 APIs. - breaking_changes: - - The ClusterLocalModel resource was renamed to LocalModelCache; existing manifests/controllers - referencing ClusterLocalModel must be updated accordingly. + features: [v0.14.1 introduces a new LocalModelNode CR plus a node agent and + updated model-cache controller to support node-local model caching workflows., + 'Model cache functionality is expanded with multiple node groups, an admission + webhook for LocalModelCache, and an annotation to disable model cache per + resource.', Inference protocol responses now support datetime object serialization + for both v1 and v2 APIs.] + breaking_changes: [The ClusterLocalModel resource was renamed to LocalModelCache; + existing manifests/controllers referencing ClusterLocalModel must be updated + accordingly.] chart_version: v0.14.1 - images: - - docker.io/seldonio/mlserver:1.5.0 - - kserve/huggingfaceserver:v0.14.1 - - kserve/kserve-controller:v0.14.1 - - kserve/lgbserver:v0.14.1 - - kserve/modelmesh-controller:v0.12.0 - - kserve/paddleserver:v0.14.1 - - kserve/pmmlserver:v0.14.1 - - kserve/sklearnserver:v0.14.1 - - kserve/storage-initializer:v0.14.1 - - kserve/xgbserver:v0.14.1 - - nvcr.io/nvidia/tritonserver:23.04-py3 - - nvcr.io/nvidia/tritonserver:23.05-py3 - - openvino/model_server:2022.2 - - pytorch/torchserve-kfs:0.9.0 - - pytorch/torchserve:0.7.1-cpu - - quay.io/brancz/kube-rbac-proxy:v0.18.0 - - seldonio/mlserver:1.3.2 - - tensorflow/serving:2.6.2 + images: ['docker.io/seldonio/mlserver:1.5.0', 'kserve/huggingfaceserver:v0.14.1', + 'kserve/kserve-controller:v0.14.1', 'kserve/lgbserver:v0.14.1', 'kserve/modelmesh-controller:v0.12.0', + 'kserve/paddleserver:v0.14.1', 'kserve/pmmlserver:v0.14.1', 'kserve/sklearnserver:v0.14.1', + 'kserve/storage-initializer:v0.14.1', 'kserve/xgbserver:v0.14.1', 'nvcr.io/nvidia/tritonserver:23.04-py3', + 'nvcr.io/nvidia/tritonserver:23.05-py3', 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', + 'pytorch/torchserve:0.7.1-cpu', 'quay.io/brancz/kube-rbac-proxy:v0.18.0', 'seldonio/mlserver:1.3.2', + 'tensorflow/serving:2.6.2'] - version: 0.13.1 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - HuggingFace vLLM runtime updated to vLLM 0.4.3 and now includes the NCCL package - for improved GPU/distributed performance. - - vLLM startup now propagates the trust_remote_code flag more consistently, - improving compatibility with models that require remote code. - - Chat template generation now uses add_generation_prompt, improving prompt - formatting for chat-style models. - - vLLM logprobs handling was fixed, improving correctness for applications relying - on token probability outputs. - - Additional packages required for vLLM model loading are installed by default, - reducing runtime load failures. + features: [HuggingFace vLLM runtime updated to vLLM 0.4.3 and now includes the + NCCL package for improved GPU/distributed performance., 'vLLM startup now + propagates the trust_remote_code flag more consistently, improving compatibility + with models that require remote code.', 'Chat template generation now uses + add_generation_prompt, improving prompt formatting for chat-style models.', + 'vLLM logprobs handling was fixed, improving correctness for applications + relying on token probability outputs.', 'Additional packages required for + vLLM model loading are installed by default, reducing runtime load failures.'] breaking_changes: [] chart_version: v0.13.1 - images: - - docker.io/seldonio/mlserver:1.3.2 - - gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 - - kserve/huggingfaceserver:v0.13.1 - - kserve/kserve-controller:v0.13.1 - - kserve/lgbserver:v0.13.1 - - kserve/modelmesh-controller:v0.12.0-rc0 - - kserve/paddleserver:v0.13.1 - - kserve/pmmlserver:v0.13.1 - - kserve/sklearnserver:v0.13.1 - - kserve/storage-initializer:v0.13.1 - - kserve/xgbserver:v0.13.1 - - nvcr.io/nvidia/tritonserver:23.04-py3 - - nvcr.io/nvidia/tritonserver:23.05-py3 - - openvino/model_server:2022.2 - - pytorch/torchserve-kfs:0.9.0 - - pytorch/torchserve:0.7.1-cpu - - seldonio/mlserver:1.3.2 - - tensorflow/serving:2.6.2 + images: ['docker.io/seldonio/mlserver:1.3.2', 'gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1', + 'kserve/huggingfaceserver:v0.13.1', 'kserve/kserve-controller:v0.13.1', 'kserve/lgbserver:v0.13.1', + 'kserve/modelmesh-controller:v0.12.0-rc0', 'kserve/paddleserver:v0.13.1', 'kserve/pmmlserver:v0.13.1', + 'kserve/sklearnserver:v0.13.1', 'kserve/storage-initializer:v0.13.1', 'kserve/xgbserver:v0.13.1', + 'nvcr.io/nvidia/tritonserver:23.04-py3', 'nvcr.io/nvidia/tritonserver:23.05-py3', + 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', 'pytorch/torchserve:0.7.1-cpu', + 'seldonio/mlserver:1.3.2', 'tensorflow/serving:2.6.2'] - version: 0.12.1 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Updates FastAPI to 0.109.1 and adds/keeps support for Ray 2.10 in the 0.12.1 - release line. - - Adds Pydantic v2 support for the Python components/runtime in 0.12.1. + features: [Updates FastAPI to 0.109.1 and adds/keeps support for Ray 2.10 in + the 0.12.1 release line., Adds Pydantic v2 support for the Python components/runtime + in 0.12.1.] breaking_changes: [] chart_version: v0.12.1 - images: - - docker.io/seldonio/mlserver:1.3.2 - - gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 - - kserve/huggingfaceserver:v0.12.1 - - kserve/kserve-controller:v0.12.1 - - kserve/lgbserver:v0.12.1 - - kserve/modelmesh-controller:v0.11.2 - - kserve/paddleserver:v0.12.1 - - kserve/pmmlserver:v0.12.1 - - kserve/sklearnserver:v0.12.1 - - kserve/storage-initializer:v0.12.1 - - kserve/xgbserver:v0.12.1 - - nvcr.io/nvidia/tritonserver:23.04-py3 - - nvcr.io/nvidia/tritonserver:23.05-py3 - - openvino/model_server:2022.2 - - pytorch/torchserve-kfs:0.9.0 - - pytorch/torchserve:0.7.1-cpu - - seldonio/mlserver:1.3.2 - - tensorflow/serving:2.6.2 + images: ['docker.io/seldonio/mlserver:1.3.2', 'gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1', + 'kserve/huggingfaceserver:v0.12.1', 'kserve/kserve-controller:v0.12.1', 'kserve/lgbserver:v0.12.1', + 'kserve/modelmesh-controller:v0.11.2', 'kserve/paddleserver:v0.12.1', 'kserve/pmmlserver:v0.12.1', + 'kserve/sklearnserver:v0.12.1', 'kserve/storage-initializer:v0.12.1', 'kserve/xgbserver:v0.12.1', + 'nvcr.io/nvidia/tritonserver:23.04-py3', 'nvcr.io/nvidia/tritonserver:23.05-py3', + 'openvino/model_server:2022.2', 'pytorch/torchserve-kfs:0.9.0', 'pytorch/torchserve:0.7.1-cpu', + 'seldonio/mlserver:1.3.2', 'tensorflow/serving:2.6.2'] - version: 0.11.2 - kube: - - '1.27' - - '1.26' - - '1.25' + kube: ['1.27', '1.26', '1.25'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Performance fix in KServe Python server by switching back to standard sockets - (v0.10.2). - - Security hardening via cherry-picks related to CVE-2023-44487 (v0.11.2). + features: [Performance fix in KServe Python server by switching back to standard + sockets (v0.10.2)., Security hardening via cherry-picks related to CVE-2023-44487 + (v0.11.2).] breaking_changes: [] chart_version: v0.11.2 images: [] - version: 0.10.2 - kube: - - '1.25' - - '1.24' - - '1.23' - - '1.22' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - "KServe manager/controller was converted from a StatefulSet to a Deployment\ - \ to support HA; the StatefulSet is slated for removal in 0.10 (so on 0.10.x\ - \ you should expect/ensure you\u2019re running the Deployment form)." - features: - - InferenceGraph introduced (initial API + Python SDK) for advanced routing/composition - of inference steps. - - ModelMesh became fully compatible with the KServe InferenceService API; transformers - can work with ModelMesh. - - 'New/expanded model serving integrations and knobs: MLflow support, configurable - ingress class name, configurable URL scheme, and autoscaling target/metric - configuration per InferenceService component.' - - Storage spec was unified and expanded (new storage spec, webhdfs support, - Azure file share support). - - ServingRuntime spec expanded (protocolVersion, volumes in pod spec, more container - fields, env for built-in adapters). - - Model Status API added to InferenceService with controller logic to update - it. - breaking_changes: - - 'Operational change: controller/manager moved from StatefulSet to Deployment - (HA); if you had StatefulSet-specific overrides or relied on stable pod identity/PVCs, - you must adapt. The StatefulSet is removed in 0.10 per the 0.9.0 notes.' + kube: ['1.25', '1.24', '1.23', '1.22'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ["KServe manager/controller was converted from a StatefulSet\ + \ to a Deployment to support HA; the StatefulSet is slated for removal in\ + \ 0.10 (so on 0.10.x you should expect/ensure you\u2019re running the Deployment\ + \ form)."] + features: [InferenceGraph introduced (initial API + Python SDK) for advanced + routing/composition of inference steps., ModelMesh became fully compatible + with the KServe InferenceService API; transformers can work with ModelMesh., + 'New/expanded model serving integrations and knobs: MLflow support, configurable + ingress class name, configurable URL scheme, and autoscaling target/metric + configuration per InferenceService component.', 'Storage spec was unified + and expanded (new storage spec, webhdfs support, Azure file share support).', + 'ServingRuntime spec expanded (protocolVersion, volumes in pod spec, more + container fields, env for built-in adapters).', Model Status API added to + InferenceService with controller logic to update it.] + breaking_changes: ['Operational change: controller/manager moved from StatefulSet + to Deployment (HA); if you had StatefulSet-specific overrides or relied + on stable pod identity/PVCs, you must adapt. The StatefulSet is removed + in 0.10 per the 0.9.0 notes.'] chart_version: v0.10.2 images: [] - version: 0.9.0 - kube: - - '1.24' - - '1.23' - - '1.22' - - '1.21' + kube: ['1.24', '1.23', '1.22', '1.21'] requirements: [] incompatibilities: [] summary: @@ -40993,84 +29925,64 @@ addons: \ after CRD upgrade.\n- **New unified storage configuration** introduced (new\ \ storage spec). If you set model storage via configmaps/old knobs, check\ \ chart values for moved/renamed storage settings.\n" - chart_updates: - - KServe manager workload type changed from StatefulSet to Deployment to enable - HA (StatefulSet planned for removal in 0.10). - - Helm chart updated to reflect the new manager kind (Deployment) and related - manifests. - - Chart is published as a release asset starting in this release line (easier - to pin/download exact chart artifact). - features: - - 'InferenceGraph: new API to define model inference DAGs/pipelines (fan-out, - ensembles, chaining) managed by KServe.' - - 'ModelMesh compatibility: ModelMesh is now fully compatible with the KServe - InferenceService API (unified deployment API surface).' - - 'Unified storage spec: new storage configuration model, plus new providers - like Azure File Share and webhdfs support.' - - 'InferenceService improvements: configurable URL scheme, ingress class name - support, domain template generation, and additional autoscaling metric/target - settings.' - - 'ServingRuntime enhancements: protocolVersion plus more pod/container customization - (volumes, env, additional container fields).' - breaking_changes: - - kserve-manager moved from StatefulSet to Deployment. If you depended on StatefulSet-specific - semantics, behavior will change; StatefulSet is slated for removal in 0.10 - so treat this as the migration step. - - "Python SDK class renames happened in the prior release (0.8): `KFModel`\u2192\ - `Model`, `KFServer`\u2192`ModelServer`, `KFModelRepository`\u2192`ModelRepository`.\ - \ If you are jumping versions and still use old names, update imports/usages." + chart_updates: [KServe manager workload type changed from StatefulSet to Deployment + to enable HA (StatefulSet planned for removal in 0.10)., Helm chart updated + to reflect the new manager kind (Deployment) and related manifests., Chart + is published as a release asset starting in this release line (easier to + pin/download exact chart artifact).] + features: ['InferenceGraph: new API to define model inference DAGs/pipelines + (fan-out, ensembles, chaining) managed by KServe.', 'ModelMesh compatibility: + ModelMesh is now fully compatible with the KServe InferenceService API (unified + deployment API surface).', 'Unified storage spec: new storage configuration + model, plus new providers like Azure File Share and webhdfs support.', 'InferenceService + improvements: configurable URL scheme, ingress class name support, domain + template generation, and additional autoscaling metric/target settings.', + 'ServingRuntime enhancements: protocolVersion plus more pod/container customization + (volumes, env, additional container fields).'] + breaking_changes: ['kserve-manager moved from StatefulSet to Deployment. If + you depended on StatefulSet-specific semantics, behavior will change; StatefulSet + is slated for removal in 0.10 so treat this as the migration step.', "Python\ + \ SDK class renames happened in the prior release (0.8): `KFModel`\u2192\ + `Model`, `KFServer`\u2192`ModelServer`, `KFModelRepository`\u2192`ModelRepository`.\ + \ If you are jumping versions and still use old names, update imports/usages."] chart_version: v0.9.0 images: [] - version: 0.8.0 - kube: - - '1.22' - - '1.21' - - '1.20' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Helm chart updated for KServe release v0.8.0 (chart changes not detailed in - provided notes; review chart diff/values schema when upgrading). - features: - - Introduces ServingRuntime and ClusterServingRuntime CRDs to define serving - runtimes (images, supported model formats) as Kubernetes resources instead - of a control-plane ConfigMap. - - Adds automatic runtime selection based on model format and ServingRuntime/ClusterServingRuntime - definitions. - - Adds a multiModel field to ServingRuntime spec to support runtimes capable - of serving multiple models. - - Adds Python SDK support for ServingRuntime resources and updates CloudEvent - handling in the SDK. - - Adds support for gRPC communication between transformer and predictor. - - Adds TorchServe v2 REST protocol support and improves sklearnserver to allow - mixed-type inputs. - breaking_changes: - - "Python SDK class names were renamed: KFModel\u2192Model, KFServer\u2192ModelServer,\ - \ KFModelRepository\u2192ModelRepository; client code must be updated accordingly." - - KServe pytorchserver is deprecated; PyTorch models now default to TorchServe - runtime, which may change runtime behavior/configuration. - - ONNX runtime server is deprecated; ONNX models now default to Triton Inference - Server, potentially changing serving image, args, and supported features. - - cert-manager dependency upgraded to v1; clusters using older cert-manager - APIs/CRDs must be updated before/with the upgrade. - - Controller updated to Knative 1.0; if using Knative-based mode, ensure Knative - components are compatible (API versions/CRDs). + kube: ['1.22', '1.21', '1.20'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Helm chart updated for KServe release v0.8.0 (chart changes + not detailed in provided notes; review chart diff/values schema when upgrading).] + features: ['Introduces ServingRuntime and ClusterServingRuntime CRDs to define + serving runtimes (images, supported model formats) as Kubernetes resources + instead of a control-plane ConfigMap.', Adds automatic runtime selection + based on model format and ServingRuntime/ClusterServingRuntime definitions., + Adds a multiModel field to ServingRuntime spec to support runtimes capable + of serving multiple models., Adds Python SDK support for ServingRuntime + resources and updates CloudEvent handling in the SDK., Adds support for + gRPC communication between transformer and predictor., Adds TorchServe v2 + REST protocol support and improves sklearnserver to allow mixed-type inputs.] + breaking_changes: ["Python SDK class names were renamed: KFModel\u2192Model,\ + \ KFServer\u2192ModelServer, KFModelRepository\u2192ModelRepository; client\ + \ code must be updated accordingly.", 'KServe pytorchserver is deprecated; + PyTorch models now default to TorchServe runtime, which may change runtime + behavior/configuration.', 'ONNX runtime server is deprecated; ONNX models + now default to Triton Inference Server, potentially changing serving image, + args, and supported features.', cert-manager dependency upgraded to v1; + clusters using older cert-manager APIs/CRDs must be updated before/with + the upgrade., 'Controller updated to Knative 1.0; if using Knative-based + mode, ensure Knative components are compatible (API versions/CRDs).'] chart_version: v0.8.0 images: [] - version: 0.7.0 - kube: - - '1.22' - - '1.21' - - '1.20' - - '1.19' + kube: ['1.22', '1.21', '1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: v0.7.0 images: [] - name: kserve - icon: https://avatars.githubusercontent.com/u/100554170?v=4 git_url: https://github.com/kubescape/helm-charts release_url: https://github.com/kubescape/helm-charts/releases/tag/kubescape-operator-{vsn} @@ -41078,10 +29990,7 @@ addons: helm_values: clusterName=example,account=example versions: - version: 1.40.4 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: @@ -41114,53 +30023,42 @@ addons: \ - **Workload container securityContexts** now drop **all Linux capabilities**.\n\ \ - Action: if you had workloads/sidecars depending on additional capabilities\ \ or node-agent deleting pods, confirm your flows still work.\n" - chart_updates: - - 'Updated component images/versions: operator bumped to v0.2.162 (Bottlerocket - detection support); storage image bumped to v0.0.298 (chart note) and upstream - storage includes additional fixes/features in this release train.' - - 'Node-agent behavior update: auto-set `super_t` on Bottlerocket node groups; - Prometheus OTEL exporter enabled; malware detection changed (ClamAV removed, - moved to hash sensor).' - - 'Security hardening in templates: drop all Linux capabilities in workload - container securityContexts; pin `runAsGroup` wherever `runAsUser` is pinned.' - - "Reliability/compat fixes: mount CA certs into sbom-scanner sidecar; mount\ - \ `config.json` as a file (avoid masking policy dir); don\u2019t mask baked\ - \ policy library when downloads are off." - - 'CRD/template polish: omit empty annotations key on seccompprofiles CRD when - empty; align SecurityException vulnerability schema with kubevuln types.' - features: - - Configurable `defaultFrameworks` for operator posture scans; operator honors - the install-time setting for default frameworks. - - Opt-in RBAC support for agent runtime posture (feature gated). - - Storage APIServer can be run on the host network (opt-in). - - Autoupdater supports pod metadata overrides (labels/annotations). - - 'Bottlerocket node groups: node-agent can auto-detect and auto-set `super_t` - to work correctly on Bottlerocket.' - - Options added to disable exec tracing and open tracing. - breaking_changes: - - 'Node-agent malware detection change: **ClamAV removed** and malware detection - moved to the **hash sensor**. If you depended on ClamAV-specific behavior/artifacts, - validate the new detection path.' - - 'Node-agent RBAC reduced: **pods/delete permission removed**. If you had automation - relying on node-agent deleting pods, it will no longer be allowed by default.' - - "Node-agent values structure change: some \u201Cextra node-agent configuration\u201D\ - \ moved under an `extra` section; existing `values.yaml` may need path updates." - - 'SecurityContext hardening: workloads now **drop all Linux capabilities** - by default and `runAsGroup` is pinned alongside `runAsUser`; if any container - required extra capabilities or different group IDs, you must override explicitly.' + chart_updates: ['Updated component images/versions: operator bumped to v0.2.162 + (Bottlerocket detection support); storage image bumped to v0.0.298 (chart + note) and upstream storage includes additional fixes/features in this release + train.', 'Node-agent behavior update: auto-set `super_t` on Bottlerocket + node groups; Prometheus OTEL exporter enabled; malware detection changed + (ClamAV removed, moved to hash sensor).', 'Security hardening in templates: + drop all Linux capabilities in workload container securityContexts; pin + `runAsGroup` wherever `runAsUser` is pinned.', "Reliability/compat fixes:\ + \ mount CA certs into sbom-scanner sidecar; mount `config.json` as a file\ + \ (avoid masking policy dir); don\u2019t mask baked policy library when\ + \ downloads are off.", 'CRD/template polish: omit empty annotations key + on seccompprofiles CRD when empty; align SecurityException vulnerability + schema with kubevuln types.'] + features: [Configurable `defaultFrameworks` for operator posture scans; operator + honors the install-time setting for default frameworks., Opt-in RBAC support + for agent runtime posture (feature gated)., Storage APIServer can be run + on the host network (opt-in)., Autoupdater supports pod metadata overrides + (labels/annotations)., 'Bottlerocket node groups: node-agent can auto-detect + and auto-set `super_t` to work correctly on Bottlerocket.', Options added + to disable exec tracing and open tracing.] + breaking_changes: ['Node-agent malware detection change: **ClamAV removed** + and malware detection moved to the **hash sensor**. If you depended on ClamAV-specific + behavior/artifacts, validate the new detection path.', 'Node-agent RBAC + reduced: **pods/delete permission removed**. If you had automation relying + on node-agent deleting pods, it will no longer be allowed by default.', + "Node-agent values structure change: some \u201Cextra node-agent configuration\u201D\ + \ moved under an `extra` section; existing `values.yaml` may need path updates.", + 'SecurityContext hardening: workloads now **drop all Linux capabilities** + by default and `runAsGroup` is pinned alongside `runAsUser`; if any container + required extra capabilities or different group IDs, you must override explicitly.'] chart_version: 1.40.4 - images: - - quay.io/kubescape/http-request:v0.2.23 - - quay.io/kubescape/kubescape:v4.0.13 - - quay.io/kubescape/kubevuln:v0.3.430 - - quay.io/kubescape/node-agent:v0.3.219 - - quay.io/kubescape/operator:v0.2.169 - - quay.io/kubescape/storage:v0.0.331 + images: ['quay.io/kubescape/http-request:v0.2.23', 'quay.io/kubescape/kubescape:v4.0.13', + 'quay.io/kubescape/kubevuln:v0.3.430', 'quay.io/kubescape/node-agent:v0.3.219', + 'quay.io/kubescape/operator:v0.2.169', 'quay.io/kubescape/storage:v0.0.331'] - version: 1.40.3 - kube: - - '1.37' - - '1.36' - - '1.35' + kube: ['1.37', '1.36', '1.35'] requirements: [] incompatibilities: [] summary: @@ -41182,51 +30080,39 @@ addons: \ targeting**: node-agent targeting updated to include **label-less nodes**\ \ (affinity `DoesNotExist`); also mount guards aligned for the operator node-agent\ \ autoscaler.\n" - chart_updates: - - Enables/ships **CEL admission rules** support in the operator and adds **CEL - validation** to `SecurityException` CRDs (plus a CEL rule tweak for GitOps - reconcilers using `oldSelf` semantics). - - Synchronizer now syncs additional resource types, including **ServiceAccounts**, - **ContainerProfiles**, and registers **AISandboxHeartbeats httpEndpoint** - resource. - - 'Node-agent GKE Autopilot allowlist: default bumped to **1.40-v2**, plus drift-gating - tooling and optional **AllowlistSynchronizer** install when enabled.' - - 'Storage: pod now restarts on storage config changes (to apply config reliably).' - - 'Label hygiene: sanitizes `''+''` in `app.kubernetes.io/version` label to - comply with label constraints.' - features: - - Operator can run **CRD-driven CEL admission rules** (including async validation) - and chart enables this capability. - - '`SecurityException` CRDs gain **CEL validation**, improving early rejection - of invalid exceptions; operator also watches exceptions and can rescan on - change/expiry.' - - '**Opt-in remediation capability** (`capabilities.remediation`) with the required - mutating RBAC gates.' - - Kubevuln gains **registry/proxy mapping and matching controls** (`proxyRegistryMap`, - `cveMatchingMode`, `trustedVendors`) to tune vuln matching in enterprise registries. - - Node-agent OTEL improvements and config exposure (notably `alertDeduplication.bypass`) - plus better scheduling behavior on nodes missing grouping labels. - - Synchronizer expands what it syncs (ServiceAccounts, ContainerProfiles) and - adds optional **Kafka backend** support (component-level). - breaking_changes: - - Chart enforces **Kubernetes >= 1.28**; installs/upgrades will fail on older - clusters until the cluster is upgraded. - - Chart **no longer bundles an OpenTelemetry collector**; if you depended on - it, you must deploy/operate your own OTEL collector and configure node-agent - to use it via `otelUrl`. + chart_updates: [Enables/ships **CEL admission rules** support in the operator + and adds **CEL validation** to `SecurityException` CRDs (plus a CEL rule + tweak for GitOps reconcilers using `oldSelf` semantics)., 'Synchronizer + now syncs additional resource types, including **ServiceAccounts**, **ContainerProfiles**, + and registers **AISandboxHeartbeats httpEndpoint** resource.', 'Node-agent + GKE Autopilot allowlist: default bumped to **1.40-v2**, plus drift-gating + tooling and optional **AllowlistSynchronizer** install when enabled.', 'Storage: + pod now restarts on storage config changes (to apply config reliably).', + 'Label hygiene: sanitizes `''+''` in `app.kubernetes.io/version` label to + comply with label constraints.'] + features: [Operator can run **CRD-driven CEL admission rules** (including async + validation) and chart enables this capability., '`SecurityException` CRDs + gain **CEL validation**, improving early rejection of invalid exceptions; + operator also watches exceptions and can rescan on change/expiry.', '**Opt-in + remediation capability** (`capabilities.remediation`) with the required + mutating RBAC gates.', 'Kubevuln gains **registry/proxy mapping and matching + controls** (`proxyRegistryMap`, `cveMatchingMode`, `trustedVendors`) to + tune vuln matching in enterprise registries.', Node-agent OTEL improvements + and config exposure (notably `alertDeduplication.bypass`) plus better scheduling + behavior on nodes missing grouping labels., 'Synchronizer expands what it + syncs (ServiceAccounts, ContainerProfiles) and adds optional **Kafka backend** + support (component-level).'] + breaking_changes: [Chart enforces **Kubernetes >= 1.28**; installs/upgrades + will fail on older clusters until the cluster is upgraded., 'Chart **no + longer bundles an OpenTelemetry collector**; if you depended on it, you + must deploy/operate your own OTEL collector and configure node-agent to + use it via `otelUrl`.'] chart_version: 1.40.3 - images: - - quay.io/kubescape/http-request:v0.2.20 - - quay.io/kubescape/kubescape:v4.0.11 - - quay.io/kubescape/kubevuln:v0.3.159 - - quay.io/kubescape/node-agent:v0.3.158 - - quay.io/kubescape/operator:v0.2.159 - - quay.io/kubescape/storage:v0.0.297 + images: ['quay.io/kubescape/http-request:v0.2.20', 'quay.io/kubescape/kubescape:v4.0.11', + 'quay.io/kubescape/kubevuln:v0.3.159', 'quay.io/kubescape/node-agent:v0.3.158', + 'quay.io/kubescape/operator:v0.2.159', 'quay.io/kubescape/storage:v0.0.297'] - version: 1.40.0 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: @@ -41247,153 +30133,119 @@ addons: - If adopting GitOps, the chart adds **Argo CD GitOps support** (review any new annotations/packaging expectations in your environment).' - chart_updates: - - 'Templates: remove redundant `GOMAXPROCS` wiring.' - - Argo CD GitOps support added for the chart. - - Helm chart releases now include artifact provenance attestations. - - 'Node-agent + kubevuln: set `GOMEMLIMIT` to ~80% of container memory limit.' - - Rules CRD updated with `profileDataRequired` to support rule-aware projection. - - 'Runtime sensing architecture change: host sensor replaced with node-agent - sensing.' - features: - - "Argo CD\u2013friendly GitOps support for deploying Kubescape via Helm." - - 'Supply-chain enhancement: Helm chart releases now publish artifact provenance - attestations.' - - 'Improved memory management: node-agent and kubevuln set `GOMEMLIMIT` relative - to pod memory limits; operator autoscaler can compute it per node group.' - - Rule-aware profile projection support via new `profileDataRequired` field - in the rules CRD. - - Multiple performance and correctness improvements across scanning, OPA processing, - and error surfacing in partial resource collection. - breaking_changes: - - 'Runtime sensing change: **host sensor is replaced by node-agent sensing**. - If you relied on host-sensor behavior, config, or DaemonSet specifics, validate - equivalent coverage and update any assumptions/allowlists.' - - CRD schema changes (rules CRD adds `profileDataRequired`) require CRDs to - be updated; mismatched CRDs can cause reconciliation/validation issues during - upgrade. + chart_updates: ['Templates: remove redundant `GOMAXPROCS` wiring.', Argo CD + GitOps support added for the chart., Helm chart releases now include artifact + provenance attestations., 'Node-agent + kubevuln: set `GOMEMLIMIT` to ~80% + of container memory limit.', Rules CRD updated with `profileDataRequired` + to support rule-aware projection., 'Runtime sensing architecture change: + host sensor replaced with node-agent sensing.'] + features: ["Argo CD\u2013friendly GitOps support for deploying Kubescape via\ + \ Helm.", 'Supply-chain enhancement: Helm chart releases now publish artifact + provenance attestations.', 'Improved memory management: node-agent and kubevuln + set `GOMEMLIMIT` relative to pod memory limits; operator autoscaler can + compute it per node group.', Rule-aware profile projection support via new + `profileDataRequired` field in the rules CRD., 'Multiple performance and + correctness improvements across scanning, OPA processing, and error surfacing + in partial resource collection.'] + breaking_changes: ['Runtime sensing change: **host sensor is replaced by node-agent + sensing**. If you relied on host-sensor behavior, config, or DaemonSet specifics, + validate equivalent coverage and update any assumptions/allowlists.', CRD + schema changes (rules CRD adds `profileDataRequired`) require CRDs to be + updated; mismatched CRDs can cause reconciliation/validation issues during + upgrade.] chart_version: 1.40.0 images: [] - version: 1.30.7 - kube: - - '1.36' - - '1.35' - - '1.34' + kube: ['1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - 'From 1.30.0 release notes: otel-collector deployment fix to allow external - OTEL URL without requiring a cloud provider.' - - 'NetworkPolicy fixes: prometheus-exporter egress + storage ingress rules corrected.' - - NetworkPolicy fix to allow Prometheus ServiceMonitor traffic to kubescape. - - 'Feature added: image-based capability (per PR ''Feat/image based'').' - - No specific changelog items were provided for 1.30.7 in the notes you shared - (release exists but has no listed changes). - features: - - 'Adds an image-based mode/capability (details depend on chart values; see - PR #770 in kubescape/helm-charts).' + chart_updates: ['From 1.30.0 release notes: otel-collector deployment fix to + allow external OTEL URL without requiring a cloud provider.', 'NetworkPolicy + fixes: prometheus-exporter egress + storage ingress rules corrected.', NetworkPolicy + fix to allow Prometheus ServiceMonitor traffic to kubescape., 'Feature added: + image-based capability (per PR ''Feat/image based'').', No specific changelog + items were provided for 1.30.7 in the notes you shared (release exists but + has no listed changes).] + features: ['Adds an image-based mode/capability (details depend on chart values; + see PR #770 in kubescape/helm-charts).'] breaking_changes: [] chart_version: 1.30.7 images: [] - version: 1.30.0 - kube: - - '1.35' - - '1.34' - - '1.33' + kube: ['1.35', '1.34', '1.33'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Fix otel-collector deployment so an external OTEL URL works even when no cloud - provider is set (#766). - - Fix NetworkPolicy for prometheus-exporter egress and storage ingress (#768). - - Fix NetworkPolicy to allow Prometheus ServiceMonitor traffic for Kubescape - (#767). - - 'Add feature: image-based mode/support (#770).' - features: - - Adds image-based functionality (image-based scanning/mode) to the operator. + chart_updates: [Fix otel-collector deployment so an external OTEL URL works + even when no cloud provider is set (#766)., Fix NetworkPolicy for prometheus-exporter + egress and storage ingress (#768)., Fix NetworkPolicy to allow Prometheus + ServiceMonitor traffic for Kubescape (#767)., 'Add feature: image-based + mode/support (#770).'] + features: [Adds image-based functionality (image-based scanning/mode) to the + operator.] breaking_changes: [] chart_version: 1.30.0 images: [] - version: 1.29.12 - kube: - - '1.35' - - '1.34' - - '1.33' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps component images/versions across the stack (operator and synchronizer) - between chart 1.29.1 and 1.29.12. - - Includes dependency refreshes in operator (armoapi-go, registryx) and synchronizer - (jose2go v1.7.0). - features: - - No new user-facing features called out in the provided 1.29.12 notes; changes - appear to be dependency/version bumps for operator and synchronizer. - - From 1.29.1 notes (baseline), notable functional behavior includes improved - handling on startup (process existing APs/SBOMs) and vulnerability scanning - behavior (error when severity threshold exceeded), plus node-agent performance/robustness - improvements and Prometheus support. + kube: ['1.35', '1.34', '1.33'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Bumps component images/versions across the stack (operator and + synchronizer) between chart 1.29.1 and 1.29.12., 'Includes dependency refreshes + in operator (armoapi-go, registryx) and synchronizer (jose2go v1.7.0).'] + features: [No new user-facing features called out in the provided 1.29.12 notes; + changes appear to be dependency/version bumps for operator and synchronizer., + 'From 1.29.1 notes (baseline), notable functional behavior includes improved + handling on startup (process existing APs/SBOMs) and vulnerability scanning + behavior (error when severity threshold exceeded), plus node-agent performance/robustness + improvements and Prometheus support.'] breaking_changes: [] chart_version: 1.29.12 images: [] - version: 1.29.1 - kube: - - '1.34' - - '1.33' - - '1.32' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Bumps bundled component versions across the Kubescape stack (kubescape core, - operator, kubevuln, storage, node-agent, synchronizer). - - General stability/performance tweaks in node-agent; improved startup behavior - in operator; logging noise reduction in storage. No chart-structure changes - mentioned in provided notes. - features: - - 'Kubescape core: image scanning can now return an error when the configured - severity threshold is exceeded (enables fail-fast/CI-style enforcement behavior).' - - 'Operator: on startup, it processes existing ApplicationProfiles (APs) and - SBOMs instead of only handling newly created ones.' - - 'Kubevuln: supports non-image source types (broader input support beyond container - images).' - - 'Node-agent: adds Prometheus-related work and introduces configurable worker - pool behavior for tuning throughput/resource usage.' + kube: ['1.34', '1.33', '1.32'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Bumps bundled component versions across the Kubescape stack + (kubescape core, operator, kubevuln, storage, node-agent, synchronizer).', + General stability/performance tweaks in node-agent; improved startup behavior + in operator; logging noise reduction in storage. No chart-structure changes + mentioned in provided notes.] + features: ['Kubescape core: image scanning can now return an error when the + configured severity threshold is exceeded (enables fail-fast/CI-style enforcement + behavior).', 'Operator: on startup, it processes existing ApplicationProfiles + (APs) and SBOMs instead of only handling newly created ones.', 'Kubevuln: + supports non-image source types (broader input support beyond container + images).', 'Node-agent: adds Prometheus-related work and introduces configurable + worker pool behavior for tuning throughput/resource usage.'] breaking_changes: [] chart_version: 1.29.1 images: [] - version: 1.29.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - No explicit chart/values changes are described in the provided notes for `kubescape-operator-1.29.0` - (release entry contains only metadata). - - 'From `1.28.0`, the chart added **kubelet directory support** in the node-agent - configuration (PR #707).' - features: - - (From 1.28.0 notes) Node agent configuration gained support for specifying/handling - the kubelet directory, improving compatibility across node layouts/distributions. + chart_updates: [No explicit chart/values changes are described in the provided + notes for `kubescape-operator-1.29.0` (release entry contains only metadata)., + 'From `1.28.0`, the chart added **kubelet directory support** in the node-agent + configuration (PR #707).'] + features: ['(From 1.28.0 notes) Node agent configuration gained support for + specifying/handling the kubelet directory, improving compatibility across + node layouts/distributions.'] breaking_changes: [] chart_version: 1.29.0 images: [] - version: 1.28.0 - kube: - - '1.33' - - '1.32' - - '1.31' + kube: ['1.33', '1.32', '1.31'] requirements: [] incompatibilities: [] summary: @@ -41403,49 +30255,38 @@ addons: directory path if your kubelet uses a non-default location. ' - chart_updates: - - Bumped kubescape-operator chart/app version to **1.28.0**. - - Added kubelet directory support in node-agent configuration. - features: - - Node-agent can now be configured with an explicit kubelet directory path, - improving compatibility with clusters where kubelet uses non-standard directories. + chart_updates: [Bumped kubescape-operator chart/app version to **1.28.0**., + Added kubelet directory support in node-agent configuration.] + features: ['Node-agent can now be configured with an explicit kubelet directory + path, improving compatibility with clusters where kubelet uses non-standard + directories.'] breaking_changes: [] chart_version: 1.28.0 images: [] - version: 1.27.3 - kube: - - '1.33' - - '1.32' - - '1.31' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Added Kubernetes recommended labels and other additional labels across resources. - - Added additional labels for ServiceMonitor resources. - - Enabled node SBOM generation (nodeSbomGeneration). - - Migrated AppArmor configuration from annotations to native AppArmor fields. - - Fixed HTTP detection flag wiring/behavior. - - "Bumped subcomponents: operator v0.2.82\u2192v0.2.84, kubevuln v0.3.69\u2192\ - v0.3.72, node-agent v0.2.287\u2192v0.2.298, inspektor-gadget to v0.39.0, and\ - \ registryx to address a panic." - features: - - Consistent Kubernetes recommended labels (and extra chart labels) are applied - to resources; ServiceMonitor now supports additional labels. - - Node SBOM generation can be enabled to produce SBOMs at the node level. - - Generated SBOMs include an artifact type label for better identification. - breaking_changes: - - AppArmor moved from pod annotations to the newer Kubernetes AppArmor fields; - clusters relying on legacy annotation-based AppArmor need to validate their - policies/manifests still apply. + kube: ['1.33', '1.32', '1.31'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Added Kubernetes recommended labels and other additional labels + across resources., Added additional labels for ServiceMonitor resources., + Enabled node SBOM generation (nodeSbomGeneration)., Migrated AppArmor configuration + from annotations to native AppArmor fields., Fixed HTTP detection flag wiring/behavior., + "Bumped subcomponents: operator v0.2.82\u2192v0.2.84, kubevuln v0.3.69\u2192\ + v0.3.72, node-agent v0.2.287\u2192v0.2.298, inspektor-gadget to v0.39.0,\ + \ and registryx to address a panic."] + features: [Consistent Kubernetes recommended labels (and extra chart labels) + are applied to resources; ServiceMonitor now supports additional labels., + Node SBOM generation can be enabled to produce SBOMs at the node level., Generated + SBOMs include an artifact type label for better identification.] + breaking_changes: [AppArmor moved from pod annotations to the newer Kubernetes + AppArmor fields; clusters relying on legacy annotation-based AppArmor need + to validate their policies/manifests still apply.] chart_version: 1.27.3 images: [] - version: 1.27.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -41462,37 +30303,26 @@ addons: \ values changes are called out in the snippet (mostly component bumps and\ \ internal changes), but still run a `helm diff upgrade` to catch template/value\ \ drift." - chart_updates: - - '1.26.0: Enable host sensor configurations (#624).' - - '1.26.0: Change default chart settings for node SBOM, mTLS, Admission Controller, - and HTTP (#625).' - - '1.26.0: Add missing nodeSelector for linux OS (#626).' - - '1.27.0: Bump referenced component versions across kubescape, operator, kubevuln, - storage, node-agent, synchronizer, prometheus-exporter (various PRs).' - features: - - Prerequisites UI enhanced with new review-values flow and improved prerequisites - experience (kubescape v3.0.34 range). - - Prerequisites updated to support custom kubeconfig (kubescape). - - 'Operator: added process tree information for exec-to-pod events (operator).' - - 'Node-agent: added task-based enricher and additional alert/enrichment improvements - (node-agent).' - - 'Storage: reduced SQLite connection lock contention (storage).' - breaking_changes: - - 'Storage: **NetworkNeighbors deprecated and removed** (storage). If you have - any downstream tooling/queries relying on this data/model, validate compatibility - before upgrading.' + chart_updates: ['1.26.0: Enable host sensor configurations (#624).', '1.26.0: + Change default chart settings for node SBOM, mTLS, Admission Controller, + and HTTP (#625).', '1.26.0: Add missing nodeSelector for linux OS (#626).', + '1.27.0: Bump referenced component versions across kubescape, operator, kubevuln, + storage, node-agent, synchronizer, prometheus-exporter (various PRs).'] + features: [Prerequisites UI enhanced with new review-values flow and improved + prerequisites experience (kubescape v3.0.34 range)., Prerequisites updated + to support custom kubeconfig (kubescape)., 'Operator: added process tree + information for exec-to-pod events (operator).', 'Node-agent: added task-based + enricher and additional alert/enrichment improvements (node-agent).', 'Storage: + reduced SQLite connection lock contention (storage).'] + breaking_changes: ['Storage: **NetworkNeighbors deprecated and removed** (storage). + If you have any downstream tooling/queries relying on this data/model, validate + compatibility before upgrading.'] chart_version: 1.27.0 - images: - - quay.io/kubescape/kubescape:v3.0.34 - - quay.io/kubescape/kubevuln:v0.3.69 - - quay.io/kubescape/node-agent:v0.2.282 - - quay.io/kubescape/operator:v0.2.81 - - quay.io/kubescape/storage:v0.0.172 + images: ['quay.io/kubescape/kubescape:v3.0.34', 'quay.io/kubescape/kubevuln:v0.3.69', + 'quay.io/kubescape/node-agent:v0.2.282', 'quay.io/kubescape/operator:v0.2.81', + 'quay.io/kubescape/storage:v0.0.172'] - version: 1.26.0 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: @@ -41511,203 +30341,137 @@ addons: your custom patch/override. ' - chart_updates: - - Enabled/configured host sensor options in the chart. - - Adjusted default chart settings affecting node SBOM, mTLS, admission controller, - and HTTP. - - Added missing `nodeSelector` for Linux OS scheduling. - features: - - Host sensor configurations are now enabled/configurable via the chart. - - Improved correctness around continuous scanning setting validation (operator - change). - breaking_changes: - - Default behavior changes for node SBOM, mTLS, admission controller, and HTTP - may alter runtime behavior after upgrade if you relied on prior defaults. - Treat as potentially breaking unless you pin explicit values. + chart_updates: [Enabled/configured host sensor options in the chart., 'Adjusted + default chart settings affecting node SBOM, mTLS, admission controller, + and HTTP.', Added missing `nodeSelector` for Linux OS scheduling.] + features: [Host sensor configurations are now enabled/configurable via the chart., + Improved correctness around continuous scanning setting validation (operator + change).] + breaking_changes: ['Default behavior changes for node SBOM, mTLS, admission + controller, and HTTP may alter runtime behavior after upgrade if you relied + on prior defaults. Treat as potentially breaking unless you pin explicit + values.'] chart_version: 1.26.0 - images: - - quay.io/kubescape/kubescape:v3.0.30 - - quay.io/kubescape/kubevuln:v0.3.62 - - quay.io/kubescape/node-agent:v0.2.259 - - quay.io/kubescape/operator:v0.2.74 - - quay.io/kubescape/storage:v0.0.161 + images: ['quay.io/kubescape/kubescape:v3.0.30', 'quay.io/kubescape/kubevuln:v0.3.62', + 'quay.io/kubescape/node-agent:v0.2.259', 'quay.io/kubescape/operator:v0.2.74', + 'quay.io/kubescape/storage:v0.0.161'] - version: 1.25.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Added support for air-gapped scans. - - Made recurring scan request body configurable. - - Expanded ClusterRole permissions when workload metrics are enabled. - - Updated/filled missing test values and refreshed E2E tests. - - Synchronizer no longer retries on invalid credentials. - - Fixed node-agent annotation to use a dynamic name. - - Added node-agent mounts. - - Fixed whitespace issue affecting `serviceScanConfig.enabled`. - - Deprecated the gateway component. - features: - - Air-gapped scans can now be enabled for environments without external network - access. - - Recurring scan request body is now configurable. - - When workload metrics are enabled, required RBAC resources are added automatically. - - Node-agent has additional mounts and uses a dynamic annotation name for better - correctness across installs. - breaking_changes: - - Gateway is deprecated; plan to remove/disable it and ensure your deployment - works without it (e.g., route traffic directly to the recommended component). + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Added support for air-gapped scans., Made recurring scan request + body configurable., Expanded ClusterRole permissions when workload metrics + are enabled., Updated/filled missing test values and refreshed E2E tests., + Synchronizer no longer retries on invalid credentials., Fixed node-agent annotation + to use a dynamic name., Added node-agent mounts., Fixed whitespace issue + affecting `serviceScanConfig.enabled`., Deprecated the gateway component.] + features: [Air-gapped scans can now be enabled for environments without external + network access., Recurring scan request body is now configurable., 'When + workload metrics are enabled, required RBAC resources are added automatically.', + Node-agent has additional mounts and uses a dynamic annotation name for better + correctness across installs.] + breaking_changes: ['Gateway is deprecated; plan to remove/disable it and ensure + your deployment works without it (e.g., route traffic directly to the recommended + component).'] chart_version: 1.25.0 - images: - - quay.io/kubescape/kubescape:v3.0.23 - - quay.io/kubescape/kubevuln:v0.3.52 - - quay.io/kubescape/node-agent:v0.2.210 - - quay.io/kubescape/operator:v0.2.63 - - quay.io/kubescape/storage:v0.0.148 + images: ['quay.io/kubescape/kubescape:v3.0.23', 'quay.io/kubescape/kubevuln:v0.3.52', + 'quay.io/kubescape/node-agent:v0.2.210', 'quay.io/kubescape/operator:v0.2.63', + 'quay.io/kubescape/storage:v0.0.148'] - version: 1.24.0 - kube: - - '1.32' - - '1.31' - - '1.30' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - 'Node-agent: switched to using the released node-agent image and updated the - chart in preparation for the 1.24.0 release.' - - 'Node-agent: added SBOM generation capability (introduced in 1.23.4).' - - 'Image pull secrets: chart can now generate an imagePullSecret when registry - credentials are provided.' - - "Relevancy logic: switched from SBOM-based relevancy (\u201Csbomp\u201D) to\ - \ using Application Profile for relevancy in 1.24.0." - - 'Release engineering updates: pre-release image bumps and general release - prep changes in 1.24.0.' - features: - - Node-agent SBOM generation support (added in 1.23.4). - - Automatic creation of imagePullSecret from provided registry credentials (added - in 1.23.4). - - "Relevancy now uses Application Profile instead of SBOM (\u201Csbomp\u201D\ - ) (changed in 1.24.0)." - breaking_changes: - - "Relevancy mechanism changed from SBOM (\u201Csbomp\u201D) to Application\ - \ Profile in 1.24.0; any workflows or expectations tied to SBOM-based relevancy\ - \ may change and should be validated post-upgrade." + kube: ['1.32', '1.31', '1.30'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: ['Node-agent: switched to using the released node-agent image + and updated the chart in preparation for the 1.24.0 release.', 'Node-agent: + added SBOM generation capability (introduced in 1.23.4).', 'Image pull secrets: + chart can now generate an imagePullSecret when registry credentials are + provided.', "Relevancy logic: switched from SBOM-based relevancy (\u201C\ + sbomp\u201D) to using Application Profile for relevancy in 1.24.0.", 'Release + engineering updates: pre-release image bumps and general release prep changes + in 1.24.0.'] + features: [Node-agent SBOM generation support (added in 1.23.4)., Automatic + creation of imagePullSecret from provided registry credentials (added in + 1.23.4)., "Relevancy now uses Application Profile instead of SBOM (\u201C\ + sbomp\u201D) (changed in 1.24.0)."] + breaking_changes: ["Relevancy mechanism changed from SBOM (\u201Csbomp\u201D\ + ) to Application Profile in 1.24.0; any workflows or expectations tied to\ + \ SBOM-based relevancy may change and should be validated post-upgrade."] chart_version: 1.24.0 - images: - - quay.io/kubescape/kubescape:v3.0.22 - - quay.io/kubescape/kubevuln:v0.3.48 - - quay.io/kubescape/node-agent:v0.2.204 - - quay.io/kubescape/operator:v0.2.55 - - quay.io/kubescape/storage:v0.0.146 + images: ['quay.io/kubescape/kubescape:v3.0.22', 'quay.io/kubescape/kubevuln:v0.3.48', + 'quay.io/kubescape/node-agent:v0.2.204', 'quay.io/kubescape/operator:v0.2.55', + 'quay.io/kubescape/storage:v0.0.146'] - version: 1.23.4 - kube: - - '1.32' - - '1.31' - - '1.30' + kube: ['1.32', '1.31', '1.30'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Fix node-agent Service selector (was not working). - - Fix inspektor-gadget access to Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`. - - Use released node-agent image (align chart to released node-agent for 1.23.4). - - Add imagePullSecret generation capability when registry credentials are provided. - features: - - Node-agent can generate SBOMs (new optional feature introduced in 1.23.4). - - Chart can generate an imagePullSecret from provided registry credentials to - simplify pulling images from private registries. + chart_updates: [Fix node-agent Service selector (was not working)., Fix inspektor-gadget + access to Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`., + Use released node-agent image (align chart to released node-agent for 1.23.4)., + Add imagePullSecret generation capability when registry credentials are provided.] + features: [Node-agent can generate SBOMs (new optional feature introduced in + 1.23.4)., Chart can generate an imagePullSecret from provided registry credentials + to simplify pulling images from private registries.] breaking_changes: [] chart_version: 1.23.4 - images: - - quay.io/kubescape/kubescape:v3.0.21 - - quay.io/kubescape/kubevuln:v0.3.41 - - quay.io/kubescape/node-agent:v0.2.197 - - quay.io/kubescape/operator:v0.2.51 - - quay.io/kubescape/storage:v0.0.141 + images: ['quay.io/kubescape/kubescape:v3.0.21', 'quay.io/kubescape/kubevuln:v0.3.41', + 'quay.io/kubescape/node-agent:v0.2.197', 'quay.io/kubescape/operator:v0.2.51', + 'quay.io/kubescape/storage:v0.0.141'] - version: 1.23.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Fixed node-agent Service selector so it correctly selects the intended pods. - - Fixed inspektor-gadget access to the Kubernetes node proxy endpoint `api/v1/nodes//proxy/configz`. - - Release prep/version bump for kubescape-operator 1.23.0. + chart_updates: [Fixed node-agent Service selector so it correctly selects the + intended pods., Fixed inspektor-gadget access to the Kubernetes node proxy + endpoint `api/v1/nodes//proxy/configz`., Release prep/version + bump for kubescape-operator 1.23.0.] features: [] breaking_changes: [] chart_version: 1.23.0 - images: - - quay.io/kubescape/kubescape:v3.0.21 - - quay.io/kubescape/kubevuln:v0.3.36 - - quay.io/kubescape/node-agent:v0.2.178 - - quay.io/kubescape/operator:v0.2.41 - - quay.io/kubescape/storage:v0.0.137 + images: ['quay.io/kubescape/kubescape:v3.0.21', 'quay.io/kubescape/kubevuln:v0.3.36', + 'quay.io/kubescape/node-agent:v0.2.178', 'quay.io/kubescape/operator:v0.2.41', + 'quay.io/kubescape/storage:v0.0.137'] - version: 1.22.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Fix prometheus-exporter missing endpoints. - - Add permissions to application profile. - - Add configurable endpoint detection. - - Add missing service account to jobs. - - Bump synchronizer component. - features: - - Configurable endpoint detection was added. - - Application profile permissions were extended to support required access. + chart_updates: [Fix prometheus-exporter missing endpoints., Add permissions + to application profile., Add configurable endpoint detection., Add missing + service account to jobs., Bump synchronizer component.] + features: [Configurable endpoint detection was added., Application profile permissions + were extended to support required access.] breaking_changes: [] chart_version: 1.22.0 - images: - - quay.io/kubescape/kubescape:v3.0.17 - - quay.io/kubescape/kubevuln:v0.3.33 - - quay.io/kubescape/node-agent:v0.2.141 - - quay.io/kubescape/operator:v0.2.31 - - quay.io/kubescape/storage:v0.0.117 + images: ['quay.io/kubescape/kubescape:v3.0.17', 'quay.io/kubescape/kubevuln:v0.3.33', + 'quay.io/kubescape/node-agent:v0.2.141', 'quay.io/kubescape/operator:v0.2.31', + 'quay.io/kubescape/storage:v0.0.117'] - version: 1.21.0 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Added standard Kubernetes labels to chart resources (#486). - - Added a new rule to the operator/chart configuration (#489). - features: - - Standardized labels across deployed Kubernetes resources to align with common - labeling conventions. - - Introduced an additional security/scanning rule (details not included in the - provided notes). + chart_updates: [Added standard Kubernetes labels to chart resources (#486)., + Added a new rule to the operator/chart configuration (#489).] + features: [Standardized labels across deployed Kubernetes resources to align + with common labeling conventions., Introduced an additional security/scanning + rule (details not included in the provided notes).] breaking_changes: [] chart_version: 1.21.0 - images: - - docker.io/bitnami/kubectl:1.30.3 - - quay.io/kubescape/kubescape:v3.0.16 - - quay.io/kubescape/kubevuln:v0.3.30 - - quay.io/kubescape/node-agent:v0.2.130 - - quay.io/kubescape/operator:v0.2.28 - - quay.io/kubescape/storage:v0.0.106 + images: ['docker.io/bitnami/kubectl:1.30.3', 'quay.io/kubescape/kubescape:v3.0.16', + 'quay.io/kubescape/kubevuln:v0.3.30', 'quay.io/kubescape/node-agent:v0.2.130', + 'quay.io/kubescape/operator:v0.2.28', 'quay.io/kubescape/storage:v0.0.106'] - version: 1.20.3 - kube: - - '1.31' - - '1.30' - - '1.29' + kube: ['1.31', '1.30', '1.29'] requirements: [] incompatibilities: [] summary: @@ -41718,58 +30482,41 @@ addons: \ by digest** for `grype-offline-db`. If you previously used custom image\ \ overrides, you may optionally switch to digest pinning for supply-chain\ \ immutability.\n" - chart_updates: - - 'Node-agent bugfix: resource size limits are now enforced again for application - profiles and network neighbourhoods (fixes prior non-enforcement).' - - Updated bundled `docker.io/bitnami/kubectl` image tag from 1.27.6 to 1.30.3. - - 'Helm chart enhancement: allow specifying `grype-offline-db` image via tag - or digest.' - features: - - Ability to reference the `grype-offline-db` image by digest (or tag), improving - flexibility and enabling immutable image pinning. - - (Behavioral fix) Resource size limits for application profiles and network - neighbourhoods are enforced again due to node-agent fix. + chart_updates: ['Node-agent bugfix: resource size limits are now enforced again + for application profiles and network neighbourhoods (fixes prior non-enforcement).', + Updated bundled `docker.io/bitnami/kubectl` image tag from 1.27.6 to 1.30.3., + 'Helm chart enhancement: allow specifying `grype-offline-db` image via tag + or digest.'] + features: ['Ability to reference the `grype-offline-db` image by digest (or + tag), improving flexibility and enabling immutable image pinning.', (Behavioral + fix) Resource size limits for application profiles and network neighbourhoods + are enforced again due to node-agent fix.] breaking_changes: [] chart_version: 1.20.3 - images: - - quay.io/kubescape/kubescape:v3.0.15 - - quay.io/kubescape/kubevuln:v0.3.25 - - quay.io/kubescape/node-agent:v0.2.109 - - quay.io/kubescape/operator:v0.2.20 - - quay.io/kubescape/storage:v0.0.90 + images: ['quay.io/kubescape/kubescape:v3.0.15', 'quay.io/kubescape/kubevuln:v0.3.25', + 'quay.io/kubescape/node-agent:v0.2.109', 'quay.io/kubescape/operator:v0.2.20', + 'quay.io/kubescape/storage:v0.0.90'] - version: 1.20.1 - kube: - - '1.30' - - '1.29' - - '1.28' - requirements: [] - incompatibilities: [] - summary: - helm_changes: '' - chart_updates: - - Fixed the include/exclude namespace feature behavior. - - Added a `skipKernelVersionCheck` capability to the node-agent. - - Fixed Harbor image scanning. - - Renamed CRDs generated by CronJobs. - features: - - Added `skipKernelVersionCheck` feature to node-agent to allow bypassing kernel - version validation in environments with non-standard or unsupported kernels. - breaking_changes: - - CRDs generated by CronJobs were renamed; any existing references, RBAC rules, - scripts, or automation targeting the old CRD names may need updating and resources - may be recreated on upgrade. + kube: ['1.30', '1.29', '1.28'] + requirements: [] + incompatibilities: [] + summary: + helm_changes: '' + chart_updates: [Fixed the include/exclude namespace feature behavior., Added + a `skipKernelVersionCheck` capability to the node-agent., Fixed Harbor image + scanning., Renamed CRDs generated by CronJobs.] + features: [Added `skipKernelVersionCheck` feature to node-agent to allow bypassing + kernel version validation in environments with non-standard or unsupported + kernels.] + breaking_changes: ['CRDs generated by CronJobs were renamed; any existing references, + RBAC rules, scripts, or automation targeting the old CRD names may need + updating and resources may be recreated on upgrade.'] chart_version: 1.20.1 - images: - - quay.io/kubescape/kubescape:v3.0.15 - - quay.io/kubescape/kubevuln:v0.3.25 - - quay.io/kubescape/node-agent:v0.2.105 - - quay.io/kubescape/operator:v0.2.20 - - quay.io/kubescape/storage:v0.0.90 + images: ['quay.io/kubescape/kubescape:v3.0.15', 'quay.io/kubescape/kubevuln:v0.3.25', + 'quay.io/kubescape/node-agent:v0.2.105', 'quay.io/kubescape/operator:v0.2.20', + 'quay.io/kubescape/storage:v0.0.90'] - version: 1.19.1 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: @@ -41787,102 +30534,71 @@ addons: \ - `alertCRD.scopeClustered=true`\n - `nodeAgent.config.prometheusExporter=enable`\n\ \ Re-validate these values are still correct/needed in 1.19.1 and that the\ \ chart hasn\u2019t renamed any keys." - chart_updates: - - Release packaging updates for 1.19.1 (chart release prep). - - Chart adds configuration hooks for skipping SSL verification. - - Chart adds `imagePullSecrets` wiring for node-agent and servicediscovery. - features: - - Option to skip SSL verification (useful for environments with intercepting - proxies or custom CAs, but reduces transport security if misused). - - Support for setting imagePullSecrets on node-agent and servicediscovery to - pull from private registries. + chart_updates: [Release packaging updates for 1.19.1 (chart release prep)., + Chart adds configuration hooks for skipping SSL verification., Chart adds + `imagePullSecrets` wiring for node-agent and servicediscovery.] + features: ['Option to skip SSL verification (useful for environments with intercepting + proxies or custom CAs, but reduces transport security if misused).', Support + for setting imagePullSecrets on node-agent and servicediscovery to pull + from private registries.] breaking_changes: [] chart_version: 1.19.1 - images: - - quay.io/kubescape/kubescape:v3.0.13 - - quay.io/kubescape/kubevuln:v0.3.25 - - quay.io/kubescape/node-agent:v0.2.93 - - quay.io/kubescape/operator:v0.2.13 - - quay.io/kubescape/storage:v0.0.89 + images: ['quay.io/kubescape/kubescape:v3.0.13', 'quay.io/kubescape/kubevuln:v0.3.25', + 'quay.io/kubescape/node-agent:v0.2.93', 'quay.io/kubescape/operator:v0.2.13', + 'quay.io/kubescape/storage:v0.0.89'] - version: 1.18.11 - kube: - - '1.30' - - '1.29' - - '1.28' + kube: ['1.30', '1.29', '1.28'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Adds beta (release-candidate) rule-based alerting support. Enable by setting - `runtimeDetection` (unexpected file exec/open) and `malwareDetection` (anti-virus) - during install. + features: [Adds beta (release-candidate) rule-based alerting support. Enable + by setting `runtimeDetection` (unexpected file exec/open) and `malwareDetection` + (anti-virus) during install.] breaking_changes: [] chart_version: 1.18.11 - images: - - quay.io/kubescape/kubescape:v3.0.8 - - quay.io/kubescape/kubevuln:v0.3.14 - - quay.io/kubescape/node-agent:v0.2.50 - - quay.io/kubescape/operator:v0.2.9 - - quay.io/kubescape/storage:v0.0.81 + images: ['quay.io/kubescape/kubescape:v3.0.8', 'quay.io/kubescape/kubevuln:v0.3.14', + 'quay.io/kubescape/node-agent:v0.2.50', 'quay.io/kubescape/operator:v0.2.9', + 'quay.io/kubescape/storage:v0.0.81'] - version: 1.18.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - 1.17.0 enables network policy generation. - - 1.17.0 enables Application Profiles and exposes them via `kubectl get applicationprofiles - -A`. - - 1.17.0 makes Application Activities available by default and exposes them - via `kubectl get applicationactivities -A`. - - 1.17.0 enables the Synchronizer component for future development work. - - 1.18.0 switches the internal SBOM format from SPDX to Syft, which is expected - to reduce false positives. - breaking_changes: - - "1.18.0 SBOM format change (SPDX \u2192 Syft): previously collected SBOM-related\ - \ data is ignored and must be re-collected after upgrade; SPDX is no longer\ - \ supported." + features: [1.17.0 enables network policy generation., 1.17.0 enables Application + Profiles and exposes them via `kubectl get applicationprofiles -A`., 1.17.0 + makes Application Activities available by default and exposes them via `kubectl + get applicationactivities -A`., 1.17.0 enables the Synchronizer component + for future development work., '1.18.0 switches the internal SBOM format + from SPDX to Syft, which is expected to reduce false positives.'] + breaking_changes: ["1.18.0 SBOM format change (SPDX \u2192 Syft): previously\ + \ collected SBOM-related data is ignored and must be re-collected after\ + \ upgrade; SPDX is no longer supported."] chart_version: 1.18.0 - images: - - quay.io/kubescape/kubescape:v3.0.3 - - quay.io/kubescape/kubevuln:v0.3.0 - - quay.io/kubescape/node-agent:v0.2.4 - - quay.io/kubescape/operator:v0.2.1 - - quay.io/kubescape/storage:v0.0.60 + images: ['quay.io/kubescape/kubescape:v3.0.3', 'quay.io/kubescape/kubevuln:v0.3.0', + 'quay.io/kubescape/node-agent:v0.2.4', 'quay.io/kubescape/operator:v0.2.1', + 'quay.io/kubescape/storage:v0.0.60'] - version: 1.17.0 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - "Release notes provided don\u2019t include Helm chart values/templating changes\ - \ between 1.16.5 and 1.17.0 (the 1.16.5 notes failed to load). Treat this\ - \ as an application-focused upgrade and review the chart diff/`values.yaml`\ - \ between tags before upgrading." - features: - - Application profiles are enabled in 1.17.0. - - Application activities are enabled by default. - - A Synchronizer component is enabled to support future developments. - - Automatic generation of NetworkPolicies is enabled. + chart_updates: ["Release notes provided don\u2019t include Helm chart values/templating\ + \ changes between 1.16.5 and 1.17.0 (the 1.16.5 notes failed to load). Treat\ + \ this as an application-focused upgrade and review the chart diff/`values.yaml`\ + \ between tags before upgrading."] + features: [Application profiles are enabled in 1.17.0., Application activities + are enabled by default., A Synchronizer component is enabled to support + future developments., Automatic generation of NetworkPolicies is enabled.] breaking_changes: [] chart_version: 1.17.0 images: [] - version: 1.16.5 - kube: - - '1.29' - - '1.28' - - '1.27' + kube: ['1.29', '1.28', '1.27'] requirements: [] incompatibilities: [] summary: @@ -41893,10 +30609,7 @@ addons: chart_version: 1.16.5 images: [] - version: 1.16.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: @@ -41907,117 +30620,88 @@ addons: chart_version: 1.16.0 images: [] - version: 1.15.0 - kube: - - '1.28' - - '1.27' - - '1.26' + kube: ['1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: helm_changes: '' - chart_updates: - - Release notes provided are only the GitHub release metadata (no changelog - entries for values, templates, CRDs, RBAC, or defaults). Cannot infer chart - changes between 0.29.6 and 1.15.0 from this data alone. - features: - - Not specified in the provided notes (no feature list or commit/changelog details - included). - breaking_changes: - - Not specified in the provided notes (no breaking-change section or migration - guidance included). + chart_updates: ['Release notes provided are only the GitHub release metadata + (no changelog entries for values, templates, CRDs, RBAC, or defaults). Cannot + infer chart changes between 0.29.6 and 1.15.0 from this data alone.'] + features: [Not specified in the provided notes (no feature list or commit/changelog + details included).] + breaking_changes: [Not specified in the provided notes (no breaking-change section + or migration guidance included).] chart_version: 1.15.0 images: [] - version: 0.29.6 - kube: - - '1.34' - - '1.33' - - '1.32' + kube: ['1.34', '1.33', '1.32'] requirements: [] incompatibilities: [] summary: null chart_version: 0.29.6 images: [] - name: kubescape-operator - icon: https://assets.dynatrace.com/global/resources/Signet_Logo_RGB_CP_512x512px.png git_url: https://github.com/Dynatrace/dynatrace-operator release_url: https://github.com/Dynatrace/dynatrace-operator/releases/tag/v{vsn} helm_repository_url: https://raw.githubusercontent.com/Dynatrace/dynatrace-operator/main/config/helm/repos/stable versions: - version: 1.8.1 - kube: - - '1.35' + kube: ['1.35'] requirements: [] incompatibilities: [] summary: null chart_version: 1.8.1 images: [] - version: 1.8.0 - kube: - - '1.35' + kube: ['1.35'] requirements: [] incompatibilities: [] summary: null chart_version: 1.8.0 images: [] - version: 1.7.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' - - '1.27' - - '1.26' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30', '1.29', '1.28', '1.27', '1.26'] requirements: [] incompatibilities: [] summary: null chart_version: 1.7.0 images: [] - version: 1.4.0 - kube: - - '1.25' + kube: ['1.25'] requirements: [] incompatibilities: [] summary: null chart_version: 1.4.0 images: [] - version: 1.3.0 - kube: - - '1.24' + kube: ['1.24'] requirements: [] incompatibilities: [] summary: null chart_version: 1.3.0 images: [] - version: 1.0.0 - kube: - - '1.23' - - '1.22' + kube: ['1.23', '1.22'] requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 images: [] - version: 0.12.0 - kube: - - '1.21' + kube: ['1.21'] requirements: [] incompatibilities: [] summary: null chart_version: 0.12.0 images: [] - version: 0.6.0 - kube: - - '1.20' - - '1.19' + kube: ['1.20', '1.19'] requirements: [] incompatibilities: [] summary: null chart_version: 0.6.0 images: [] - name: dynatrace-operator - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-sensor-{vsn} @@ -42026,35 +30710,24 @@ addons: chart_name: wiz-sensor versions: - version: 1.0.11966 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: helm_changes: '' chart_updates: [] - features: - - Release package published for wiz-sensor chart/application version 1.0.11966. + features: [Release package published for wiz-sensor chart/application version + 1.0.11966.] breaking_changes: [] chart_version: 1.0.11966 - images: - - wizio.azurecr.io/sensor:v1 + images: ['wizio.azurecr.io/sensor:v1'] - version: 1.0.3999 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 1.0.3999 - images: - - wizio.azurecr.io/sensor:v1 - name: wiz-sensor + images: ['wizio.azurecr.io/sensor:v1'] - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-admission-controller-{vsn} @@ -42063,201 +30736,124 @@ addons: chart_name: wiz-admission-controller versions: - version: 2.12.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.12.10-preview images: [] - version: 2.12.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.12.10-preview images: [] - version: 2.11.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.12.0-preview.2 images: [] - version: 2.10.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.11.0-preview images: [] - version: 2.9.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.9.4 images: [] - version: 2.8.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.8.0-preview images: [] - version: 2.7.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.7.0-preview - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.7 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.7'] - version: 2.6.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.6.0-preview - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.6 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.6'] - version: 2.5.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.5.0-alpha - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.5 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.5'] - version: 2.4.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.4.0-alpha - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.4 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.4'] - version: 2.3.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.1.3 - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.3 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.3'] - version: 2.2.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 3.1.0-alpha - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.2 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.2'] - version: 2.1.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 2.3.0-alpha - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.1 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2.1'] - version: 2.0.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 2.2.0 - images: - - wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-admission-controller:2'] - version: 1.0.152921 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 1.0.0 images: [] - version: 0.2.119420 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 0.0.11 images: [] - version: 0.0.1 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 0.0.1 images: [] - name: wiz-admission-controller - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-network-analyzer-{vsn} @@ -42266,98 +30862,56 @@ addons: chart_name: wiz-network-analyzer versions: - version: 0.1.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: - - wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1 + images: ['wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1'] - version: 0.1.0 - kube: - - '1.37' - - '1.36' - - '1.35' - - '1.34' + kube: ['1.37', '1.36', '1.35', '1.34'] requirements: [] incompatibilities: [] summary: null chart_version: 0.1.1 - images: - - wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1 - name: wiz-network-analyzer + images: ['wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1'] - icon: https://helm.elastic.co/icons/eck.png git_url: https://github.com/elastic/cloud-on-k8s release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} helm_repository_url: https://helm.elastic.co versions: - version: 3.5.0 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] chart_version: 3.5.0 requirements: [] incompatibilities: [] summary: null - version: 3.4.1 - kube: - - '1.36' - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] chart_version: 3.4.1 requirements: [] incompatibilities: [] summary: null - version: 3.3.2 - kube: - - '1.35' - - '1.34' - - '1.33' - - '1.32' - - '1.31' + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] chart_version: 3.3.2 requirements: [] incompatibilities: [] summary: null - version: 3.2.0 - kube: - - '1.34' - - '1.33' - - '1.32' - - '1.31' - - '1.30' + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] chart_version: 3.2.0 requirements: [] incompatibilities: [] summary: null - version: 3.1.0 - kube: - - '1.33' - - '1.32' - - '1.31' - - '1.30' - - '1.29' + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] chart_version: 3.1.0 requirements: [] incompatibilities: [] summary: null - version: 3.0.0 - kube: - - '1.32' - - '1.31' - - '1.30' - - '1.29' - - '1.28' + kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] chart_version: 3.0.0 requirements: [] incompatibilities: [] From d0fca40533464c9054708df9c2f78bdc02961e0a Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:31:46 +0100 Subject: [PATCH 12/17] ci: fix ECK aggregate diff --- .github/workflows/eck-fix-aggregate.yml | 75 +++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 .github/workflows/eck-fix-aggregate.yml diff --git a/.github/workflows/eck-fix-aggregate.yml b/.github/workflows/eck-fix-aggregate.yml new file mode 100644 index 0000000000..2e8aba36f2 --- /dev/null +++ b/.github/workflows/eck-fix-aggregate.yml @@ -0,0 +1,75 @@ +name: Fix ECK compatibility aggregate + +on: + push: + branches: + - feat/eck-operator-compatibility + paths: + - '.github/workflows/eck-fix-aggregate.yml' + +permissions: + contents: write + +jobs: + fix: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + ref: feat/eck-operator-compatibility + fetch-depth: 0 + - name: Restore aggregate formatting and append ECK + run: | + git show e25569197d9c6427f5c0256dd3e2270975ed292b:static/compatibilities.yaml > static/compatibilities.yaml + cat >> static/compatibilities.yaml <<'EOF' + - icon: https://helm.elastic.co/icons/eck.png + git_url: https://github.com/elastic/cloud-on-k8s + release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} + helm_repository_url: https://helm.elastic.co + versions: + - version: 3.5.0 + kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] + chart_version: 3.5.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.4.1 + kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] + chart_version: 3.4.1 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.3.2 + kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] + chart_version: 3.3.2 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.2.0 + kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] + chart_version: 3.2.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.1.0 + kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] + chart_version: 3.1.0 + requirements: [] + incompatibilities: [] + summary: null + - version: 3.0.0 + kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] + chart_version: 3.0.0 + requirements: [] + incompatibilities: [] + summary: null + name: eck-operator + EOF + git diff --check + - name: Commit corrected aggregate + run: | + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add static/compatibilities.yaml + git commit -m 'fix: keep ECK aggregate update minimal' + git push origin HEAD:feat/eck-operator-compatibility From 74ffd13768f38ae495b7cad6a570f4a722705009 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:32:09 +0000 Subject: [PATCH 13/17] fix: keep ECK aggregate update minimal --- static/compatibilities.yaml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/static/compatibilities.yaml b/static/compatibilities.yaml index 128f7d644b..0760b12925 100644 --- a/static/compatibilities.yaml +++ b/static/compatibilities.yaml @@ -34,6 +34,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: kubevirt - icon: https://avatars.githubusercontent.com/u/30269780?s=200&v=4 git_url: https://github.com/argoproj/argo-rollouts release_url: https://github.com/argoproj/argo-rollouts/releases/tag/v{vsn} @@ -176,6 +177,7 @@ addons: summary: null chart_version: 2.2.0 images: ['quay.io/argoproj/argo-rollouts:v1.1.0'] + name: argo-rollouts - icon: https://kubernetes.io/images/blog-logging/2018-04-10-container-storage-interface-beta/csi-logo.png git_url: https://github.com/kubernetes-sigs/aws-ebs-csi-driver release_url: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/tag/v{vsn} @@ -952,6 +954,7 @@ addons: 'public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4', 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4', 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4'] + name: aws-ebs-csi-driver - icon: https://cdn.worldvectorlogo.com/logos/amazon-elastic-file-system.svg git_url: https://github.com/kubernetes-sigs/aws-efs-csi-driver release_url: https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v{vsn} @@ -1182,6 +1185,7 @@ addons: images: ['amazon/aws-efs-csi-driver:v1.7.4', 'public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.3-eks-1-29-2', 'public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-29-2', 'public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.3-eks-1-29-2'] + name: aws-efs-csi-driver - icon: https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/e5d625f96415fd44e6399e9c75e2bd985f5a2288/docs/assets/images/aws_load_balancer_icon.svg git_url: https://github.com/kubernetes-sigs/aws-load-balancer-controller release_url: https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v{vsn} @@ -1770,6 +1774,7 @@ addons: summary: null chart_version: 1.0.6 images: ['602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller:v2.0.0'] + name: aws-load-balancer-controller - name: bigbang icon: https://artifacthub.io/image/0ca7dd5c-47ec-4d6a-87b7-2f2b74a3cca5 git_url: https://repo1.dso.mil/big-bang/bigbang @@ -11372,6 +11377,7 @@ addons: summary: null chart_version: 1.1.15 images: [] + name: amazon-vpc-cni-k8s - icon: https://docs.tigera.io/img/calico-logo.webp git_url: https://github.com/projectcalico/calico release_url: https://github.com/projectcalico/calico/releases/tag/v{vsn} @@ -15089,6 +15095,7 @@ addons: summary: null chart_version: 1.15.1 images: ['coredns/coredns:1.8.0'] + name: coredns - icon: https://avatars.githubusercontent.com/u/112438027?s=200&v=4 git_url: https://github.com/cloudnative-pg/cloudnative-pg release_url: https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v{vsn} @@ -15441,6 +15448,7 @@ addons: summary: null chart_version: 0.13.0 images: ['ghcr.io/cloudnative-pg/cloudnative-pg:1.15.0'] + name: cloudnative-pg - icon: https://github.com/kubernetes/kubernetes/raw/master/logo/logo.png git_url: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler release_url: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-{vsn} @@ -15830,6 +15838,7 @@ addons: summary: null chart_version: 9.4.0 images: ['us.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1'] + name: cluster-autoscaler - icon: https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/assets/logo/descheduler-stacked-color.png git_url: https://github.com/kubernetes-sigs/descheduler release_url: https://github.com/kubernetes-sigs/descheduler/releases/tag/v{vsn} @@ -16385,6 +16394,7 @@ addons: summary: null chart_version: 0.18.2 images: ['us.gcr.io/k8s-artifacts-prod/descheduler/descheduler:v0.18.0'] + name: descheduler - icon: https://github.com/kubernetes-sigs/external-dns/blob/master/docs/img/external-dns.png?raw=true git_url: https://github.com/kubernetes-sigs/external-dns release_url: https://github.com/kubernetes-sigs/external-dns/releases/tag/v{vsn} @@ -16823,6 +16833,7 @@ addons: summary: null chart_version: 1.2.0 images: ['k8s.gcr.io/external-dns/external-dns:v0.9.0'] + name: external-dns - icon: https://raw.githubusercontent.com/external-secrets/external-secrets/main/assets/eso-logo-large.png git_url: https://github.com/external-secrets/external-secrets release_url: https://github.com/external-secrets/external-secrets/releases/tag/v{vsn} @@ -17658,6 +17669,7 @@ addons: summary: null chart_version: 0.3.11 images: ['ghcr.io/external-secrets/external-secrets:v0.3.11'] + name: external-secrets - icon: https://avatars.githubusercontent.com/u/52158677?s=200&v=4 git_url: https://github.com/fluxcd/flux2 release_url: https://github.com/fluxcd/flux2/releases/tag/v{vsn} @@ -18341,6 +18353,7 @@ addons: chart_version: 4.2.5 images: ['registry.k8s.io/ingress-nginx/controller:v1.3.1@sha256:54f7fe2c6c5a9db9a0ebf1131797109bb7a4d91f56b9b362bde2abd237dd1974', 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.3.0@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47'] + name: ingress-nginx - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/istio/plural/icons/istio.png?raw=true git_url: https://github.com/istio/istio release_url: https://github.com/istio/istio/releases/tag/{vsn} @@ -19125,6 +19138,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: karpenter - icon: https://avatars.githubusercontent.com/u/49917779?s=48&v=4 git_url: https://github.com/kedacore/keda release_url: https://github.com/kedacore/keda/releases/tag/v{vsn} @@ -21039,6 +21053,7 @@ addons: 'quay.io/prometheus/node-exporter:v1.7.0', 'quay.io/prometheus/prometheus:v2.48.0', 'registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1'] + name: kube-prometheus-stack - icon: https://avatars.githubusercontent.com/u/68448710?s=48&v=4 git_url: https://github.com/kyverno/kyverno release_url: https://github.com/kyverno/kyverno/releases/tag/v{vsn} @@ -21744,6 +21759,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: linkerd - icon: https://avatars.githubusercontent.com/u/51335366?s=48&v=4 git_url: https://github.com/longhorn/longhorn release_url: https://github.com/longhorn/longhorn/releases/tag/v{vsn} @@ -22320,6 +22336,7 @@ addons: summary: null chart_version: 1.0.0 images: ['longhornio/longhorn-manager:v1.0.0', 'longhornio/longhorn-ui:v1.0.0'] + name: longhorn - icon: https://avatars.githubusercontent.com/u/36015203?s=400&v=4 git_url: https://github.com/kubernetes-sigs/metrics-server release_url: https://github.com/kubernetes-sigs/metrics-server/releases/tag/v{vsn} @@ -22436,6 +22453,7 @@ addons: summary: null chart_version: 3.5.0 images: ['k8s.gcr.io/metrics-server/metrics-server:v0.5.0'] + name: metrics-server - icon: https://avatars.githubusercontent.com/u/49998002?s=48&v=4 git_url: https://github.com/open-telemetry/opentelemetry-operator release_url: https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v{vsn} @@ -22681,6 +22699,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: opentelemetry-operator - icon: https://avatars.githubusercontent.com/u/22860722?s=48&v=4 git_url: https://github.com/rook/rook release_url: https://github.com/rook/rook/releases/tag/v{vsn} @@ -23137,6 +23156,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: rook - icon: https://avatars.githubusercontent.com/u/34767428?s=48&v=4 git_url: https://github.com/strimzi/strimzi-kafka-operator release_url: https://github.com/strimzi/strimzi-kafka-operator/releases/tag/{vsn} @@ -23392,6 +23412,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: strimzi-kafka - icon: https://github.com/traefik/traefik/raw/master/docs/content/assets/img/traefik.logo-dark.png git_url: https://github.com/traefik/traefik release_url: https://github.com/traefik/traefik/releases/tag/v{vsn} @@ -23908,6 +23929,7 @@ addons: requirements: [] incompatibilities: [] summary: null + name: velero - icon: https://avatars.githubusercontent.com/u/33043890?s=48&v=4 git_url: https://github.com/vitessio/vitess release_url: https://github.com/vitessio/vitess/releases/tag/v{vsn} @@ -26262,6 +26284,7 @@ addons: summary: null chart_version: 0.3.0 images: ['quay.io/argoproj/argocli:v3.0.7', 'quay.io/argoproj/workflow-controller:v3.0.7'] + name: argo-workflows - icon: https://avatars.githubusercontent.com/u/16866914 git_url: https://github.com/vectordotdev/vector/ release_url: https://github.com/vectordotdev/vector/releases/tag/v{vsn} @@ -26997,6 +27020,7 @@ addons: summary: null chart_version: 0.1.0-alpha.4 images: ['timberio/vector:0.16.1-distroless-libc'] + name: vector - git_url: https://github.com/VictoriaMetrics/operator release_url: https://github.com/VictoriaMetrics/operator/releases/tag/v{vsn} helm_repository_url: https://victoriametrics.github.io/helm-charts @@ -28524,6 +28548,7 @@ addons: summary: null chart_version: 0.1.1 images: ['victoriametrics/operator:v0.2.1'] + name: victoria-metrics-operator - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/nvidia-operator/plural/icons/nvidia.png?raw=true git_url: https://github.com/NVIDIA/gpu-operator release_url: https://github.com/NVIDIA/gpu-operator/releases/tag/{vsn} @@ -28825,6 +28850,7 @@ addons: chart_version: 1.4.0 images: ['nvcr.io/nvidia/gpu-operator:1.4.0', 'quay.io/kubernetes_incubator/node-feature-discovery:v0.6.0'] incompatibilities: [] + name: gpu-operator - icon: https://avatars.githubusercontent.com/u/14012520?v=4 git_url: https://github.com/goharbor/harbor release_url: https://github.com/goharbor/harbor/releases/tag/v{vsn} @@ -28898,6 +28924,7 @@ addons: summary: null chart_version: 1.16.0 images: [] + name: harbor - icon: https://raw.githubusercontent.com/pluralsh/plural-artifacts/main/elasticsearch/plural/icons/elastic.png?raw=true git_url: https://github.com/elastic/elasticsearch release_url: https://github.com/elastic/elasticsearch/releases/tag/{vsn} @@ -29051,6 +29078,7 @@ addons: summary: null chart_version: 8.18.0 images: ['docker.elastic.co/elastic-agent/elastic-agent:8.18.0', 'registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0'] + name: elastic-agent - icon: https://avatars.githubusercontent.com/u/96669?s=48&v=4 git_url: https://github.com/rabbitmq/cluster-operator release_url: https://github.com/rabbitmq/cluster-operator/releases/tag/v{vsn} @@ -29485,6 +29513,7 @@ addons: summary: null chart_version: 2.6.6 images: ['docker.io/bitnami/rabbitmq-cluster-operator:1.13.1-scratch-r3', 'docker.io/bitnami/rmq-messaging-topology-operator:1.6.0-scratch-r0'] + name: rabbitmq-cluster-operator - icon: https://kserve.github.io/website/img/kserve-logo-small.png git_url: https://github.com/kserve/kserve release_url: https://github.com/kserve/kserve/releases/tag/v{vsn} @@ -29983,6 +30012,7 @@ addons: summary: null chart_version: v0.7.0 images: [] + name: kserve - icon: https://avatars.githubusercontent.com/u/100554170?v=4 git_url: https://github.com/kubescape/helm-charts release_url: https://github.com/kubescape/helm-charts/releases/tag/kubescape-operator-{vsn} @@ -30641,6 +30671,7 @@ addons: summary: null chart_version: 0.29.6 images: [] + name: kubescape-operator - icon: https://assets.dynatrace.com/global/resources/Signet_Logo_RGB_CP_512x512px.png git_url: https://github.com/Dynatrace/dynatrace-operator release_url: https://github.com/Dynatrace/dynatrace-operator/releases/tag/v{vsn} @@ -30702,6 +30733,7 @@ addons: summary: null chart_version: 0.6.0 images: [] + name: dynatrace-operator - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-sensor-{vsn} @@ -30728,6 +30760,7 @@ addons: summary: null chart_version: 1.0.3999 images: ['wizio.azurecr.io/sensor:v1'] + name: wiz-sensor - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-admission-controller-{vsn} @@ -30854,6 +30887,7 @@ addons: summary: null chart_version: 0.0.1 images: [] + name: wiz-admission-controller - icon: https://avatars.githubusercontent.com/u/54533161?s=200&v=4 git_url: https://github.com/wiz-sec/charts release_url: https://github.com/wiz-sec/charts/releases/tag/wiz-network-analyzer-{vsn} @@ -30875,6 +30909,7 @@ addons: summary: null chart_version: 0.1.1 images: ['wiziopublic.azurecr.io/wiz-app/wiz-network-analyzer:0.1'] + name: wiz-network-analyzer - icon: https://helm.elastic.co/icons/eck.png git_url: https://github.com/elastic/cloud-on-k8s release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} From 29cc7ae06348906d58de425fa4b0ff69f4e379d7 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:32:35 +0100 Subject: [PATCH 14/17] ci: remove temporary ECK aggregate workflow --- .github/workflows/eck-fix-aggregate.yml | 75 ------------------------- 1 file changed, 75 deletions(-) delete mode 100644 .github/workflows/eck-fix-aggregate.yml diff --git a/.github/workflows/eck-fix-aggregate.yml b/.github/workflows/eck-fix-aggregate.yml deleted file mode 100644 index 2e8aba36f2..0000000000 --- a/.github/workflows/eck-fix-aggregate.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Fix ECK compatibility aggregate - -on: - push: - branches: - - feat/eck-operator-compatibility - paths: - - '.github/workflows/eck-fix-aggregate.yml' - -permissions: - contents: write - -jobs: - fix: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - ref: feat/eck-operator-compatibility - fetch-depth: 0 - - name: Restore aggregate formatting and append ECK - run: | - git show e25569197d9c6427f5c0256dd3e2270975ed292b:static/compatibilities.yaml > static/compatibilities.yaml - cat >> static/compatibilities.yaml <<'EOF' - - icon: https://helm.elastic.co/icons/eck.png - git_url: https://github.com/elastic/cloud-on-k8s - release_url: https://github.com/elastic/cloud-on-k8s/releases/tag/v{vsn} - helm_repository_url: https://helm.elastic.co - versions: - - version: 3.5.0 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32'] - chart_version: 3.5.0 - requirements: [] - incompatibilities: [] - summary: null - - version: 3.4.1 - kube: ['1.36', '1.35', '1.34', '1.33', '1.32', '1.31'] - chart_version: 3.4.1 - requirements: [] - incompatibilities: [] - summary: null - - version: 3.3.2 - kube: ['1.35', '1.34', '1.33', '1.32', '1.31'] - chart_version: 3.3.2 - requirements: [] - incompatibilities: [] - summary: null - - version: 3.2.0 - kube: ['1.34', '1.33', '1.32', '1.31', '1.30'] - chart_version: 3.2.0 - requirements: [] - incompatibilities: [] - summary: null - - version: 3.1.0 - kube: ['1.33', '1.32', '1.31', '1.30', '1.29'] - chart_version: 3.1.0 - requirements: [] - incompatibilities: [] - summary: null - - version: 3.0.0 - kube: ['1.32', '1.31', '1.30', '1.29', '1.28'] - chart_version: 3.0.0 - requirements: [] - incompatibilities: [] - summary: null - name: eck-operator - EOF - git diff --check - - name: Commit corrected aggregate - run: | - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add static/compatibilities.yaml - git commit -m 'fix: keep ECK aggregate update minimal' - git push origin HEAD:feat/eck-operator-compatibility From 15c9a7745a77484343b90579596717c2829af092 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:32:56 +0100 Subject: [PATCH 15/17] ci: remove temporary ECK aggregate workflow --- .../workflows/eck-regenerate-aggregate.yml | 59 ------------------- 1 file changed, 59 deletions(-) delete mode 100644 .github/workflows/eck-regenerate-aggregate.yml diff --git a/.github/workflows/eck-regenerate-aggregate.yml b/.github/workflows/eck-regenerate-aggregate.yml deleted file mode 100644 index 7256f445c8..0000000000 --- a/.github/workflows/eck-regenerate-aggregate.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Regenerate ECK compatibility aggregate - -on: - push: - branches: - - feat/eck-operator-compatibility - paths: - - '.github/workflows/eck-regenerate-aggregate.yml' - -permissions: - contents: write - -jobs: - regenerate: - runs-on: ubuntu-latest - steps: - - name: Checkout feature branch - uses: actions/checkout@v6 - with: - ref: feat/eck-operator-compatibility - - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: '3.13' - - - name: Install compatibility utility dependencies - run: python -m pip install PyYAML==6.0.2 requests==2.33.0 semantic-version==2.10.0 colorama==0.4.6 packaging==24.1 - - - name: Regenerate aggregate with repository formatter - working-directory: utils/compatibility - run: | - python - <<'PY' - import utils - - manifest = utils.read_yaml('../../static/compatibilities/manifest.yaml') - if not manifest or not manifest.get('names'): - raise SystemExit('compatibility manifest is empty') - - addons = [] - for name in manifest['names']: - addon = utils.read_yaml(f'../../static/compatibilities/{name}.yaml') - if not addon: - raise SystemExit(f'missing compatibility data for {name}') - addons.append(addon) - - if not utils.write_yaml('../../static/compatibilities.yaml', {'addons': addons}): - raise SystemExit('failed to write aggregate compatibility matrix') - PY - - - name: Commit aggregate - run: | - git diff --check - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add static/compatibilities.yaml - git diff --cached --quiet && exit 0 - git commit -m 'chore: regenerate compatibility aggregate for ECK' - git push origin HEAD:feat/eck-operator-compatibility From 95742d38966d9809b1483f8f227db89edd0d3d52 Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:33:48 +0100 Subject: [PATCH 16/17] ci: verify ECK compatibility fixes --- .github/workflows/eck-verify.yml | 42 ++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/eck-verify.yml diff --git a/.github/workflows/eck-verify.yml b/.github/workflows/eck-verify.yml new file mode 100644 index 0000000000..c4daa1ffcc --- /dev/null +++ b/.github/workflows/eck-verify.yml @@ -0,0 +1,42 @@ +name: Verify ECK compatibility fix + +on: + push: + branches: + - feat/eck-operator-compatibility + paths: + - '.github/workflows/eck-verify.yml' + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + ref: feat/eck-operator-compatibility + - uses: actions/setup-python@v6 + with: + python-version: '3.13' + - run: python -m pip install packaging==24.1 PyYAML==6.0.2 + - name: Run focused tests + run: python -m unittest discover -s utils/compatibility/tests -p 'test_eck_operator.py' -v + - name: Compile scraper and tests + run: python -m py_compile utils/compatibility/scrapers/eck-operator.py utils/compatibility/tests/test_eck_operator.py + - name: Validate YAML and aggregate registration + run: | + python - <<'PY' + import yaml + from pathlib import Path + addon = yaml.safe_load(Path('static/compatibilities/eck-operator.yaml').read_text()) + aggregate = yaml.safe_load(Path('static/compatibilities.yaml').read_text()) + manifest = yaml.safe_load(Path('static/compatibilities/manifest.yaml').read_text()) + assert addon and addon.get('versions') + assert 'eck-operator' in manifest['names'] + matches = [a for a in aggregate['addons'] if a.get('name') == 'eck-operator'] + assert len(matches) == 1 + assert matches[0]['versions'] == addon['versions'] + print('ECK YAML, manifest and aggregate are consistent') + PY From 16f71dbcd7165b6100da552bbee515daca1f672a Mon Sep 17 00:00:00 2001 From: MiTM-1 Date: Tue, 8 Sep 2026 12:34:33 +0100 Subject: [PATCH 17/17] ci: remove temporary ECK verification workflow --- .github/workflows/eck-verify.yml | 42 -------------------------------- 1 file changed, 42 deletions(-) delete mode 100644 .github/workflows/eck-verify.yml diff --git a/.github/workflows/eck-verify.yml b/.github/workflows/eck-verify.yml deleted file mode 100644 index c4daa1ffcc..0000000000 --- a/.github/workflows/eck-verify.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Verify ECK compatibility fix - -on: - push: - branches: - - feat/eck-operator-compatibility - paths: - - '.github/workflows/eck-verify.yml' - -permissions: - contents: read - -jobs: - verify: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - ref: feat/eck-operator-compatibility - - uses: actions/setup-python@v6 - with: - python-version: '3.13' - - run: python -m pip install packaging==24.1 PyYAML==6.0.2 - - name: Run focused tests - run: python -m unittest discover -s utils/compatibility/tests -p 'test_eck_operator.py' -v - - name: Compile scraper and tests - run: python -m py_compile utils/compatibility/scrapers/eck-operator.py utils/compatibility/tests/test_eck_operator.py - - name: Validate YAML and aggregate registration - run: | - python - <<'PY' - import yaml - from pathlib import Path - addon = yaml.safe_load(Path('static/compatibilities/eck-operator.yaml').read_text()) - aggregate = yaml.safe_load(Path('static/compatibilities.yaml').read_text()) - manifest = yaml.safe_load(Path('static/compatibilities/manifest.yaml').read_text()) - assert addon and addon.get('versions') - assert 'eck-operator' in manifest['names'] - matches = [a for a in aggregate['addons'] if a.get('name') == 'eck-operator'] - assert len(matches) == 1 - assert matches[0]['versions'] == addon['versions'] - print('ECK YAML, manifest and aggregate are consistent') - PY