github.com/fluxcd/helm-controller

Release date: 2022-12-22

This prerelease sets the default value for the --graceful-shutdown-timeout to match the default value we set in the Deployment for terminationGracePeriodSeconds which is 600s. This should fix handling graceful shutdown correctly.

Fixes:

• Align graceful-shutdown-timeout with terminationGracePeriodSeconds #584

Release date: 2022-12-20

This prerelease disables the caching of Secret and ConfigMap resources to improve memory usage. To opt-out from this behaviour, start the controller with: --feature-gates=CacheSecretsAndConfigMaps=true.

In addition, a new flag --graceful-shutdown-timeout has been added to control the duration of the graceful shutdown period. The default value is -1 (disabled), to help prevent releases from being stuck due to the controller being terminated before the Helm action has completed.

Helm has been updated to v3.10.3, which includes security fixes.

Fixes:

• Assign the value of DisableOpenApiValidation during upgrade #564
• build: Fix cifuzz and improve fuzz tests' reliability #565
• Minor typo in doc #566
• fuzz: Use build script from upstream and fix fuzzers #578

Improvements:

• Disable caching of Secrets and ConfigMaps #513
• Allow overriding ctrl manager graceful shutdown timeout #570 #582
• helm: Update SDK to v3.10.3 #577
• Update source-controller and dependencies #581

Release date: 2022-11-22

This prerelease comes with re-added support for h in the HelmRelease spec.timeout field, so that users can use hours to set reconciliation timeouts.

Improvements:

• Allow 'h' in HelmRelease timeout field #559
• Use Flux Event API v1beta1 #557
• Update dependencies #561

Release date: 2022-10-21

This prerelease comes with support for Cosign verification of Helm OCI charts. The signatures verification can be configured by setting HelmRelease.spec.chart.spec.verify with provider as cosign and a secretRef to a secret containing the public key. Cosign keyless verification is also supported, please see the HelmChart API documentation for more details.

In addition, the controller dependencies have been updated to Kubernetes v1.25.3 and Helm v3.10.1.

Improvements:

• Enable Cosign verification of Helm charts stored as OCI artifacts in container registries #545
• API: allow configuration of h unit for timeouts #549
• Update dependencies #550

Release date: 2022-09-29

This prerelease comes with strict validation rules for API fields which define a (time) duration. Effectively, this means values without a time unit (e.g. ms, s, m, h) will now be rejected by the API server. To stimulate sane configurations, the units ns, us and µs can no longer be configured, nor can h be set for fields defining a timeout value.

In addition, the controller dependencies have been updated to Kubernetes controller-runtime v0.13.

:warning: Breaking changes:

• .spec.interval new validation pattern is "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
• .spec.timeout new validation pattern is "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"

Improvements:

• api: add custom validation for v1.Duration types #533
• Build with Go 1.19 #537
• Update dependencies #538

Release date: 2022-09-12

This prerelease comes with improvements to fuzzing. In addition, the controller dependencies have been updated to Kubernetes controller-runtime v0.12.

:warning: Breaking change: The controller logs have been aligned with the Kubernetes structured logging. For more details on the new logging structure please see: fluxcd/flux2#3051.

Improvements:

• Align controller logs to Kubernetes structured logging #528
• fuzz: Fix upstream build and optimise execution #529

Release date: 2022-08-29

This prerelease comes with updates to the controller dependencies including Kubernetes v1.25.0, Helm v3.9.4 and Kustomize v4.5.7.

Improvements:

• Update Kubernetes packages to v1.25.0 #524

Release date: 2022-08-19

This prerelease comes with panic recovery, to protect the controller from crashing when reconciliations lead to a crash.

The API now enforces validation to Spec.ValuesFrom subfields: TargetPath and ValuesKey.

The new image contains updates to patch alpine CVEs.

Improvements:

• Enable RecoverPanic option on reconciler #516
• Add validation to TargetPath and ValuesKey #520
• Update dependencies #521

Release date: 2022-07-13

This prerelease updates dependencies to patch upstream CVEs.

Improvements:

• Fix github.com/emicklei/go-restful (CVE-2022-1996) #507
• Update dependencies #501
• Update gopkg.in/yaml.v3 to v3.0.1 #502
• build: Upgrade to Go 1.18 #505

Release date: 2022-06-07

This prerelease fixes a regression bug introduced in #480 which would cause the impersonation config to pick the incorrect TargetNamespace for the account name if it was set.

In addition, Kubernetes dependencies have been updated to v0.24.1, and github.com/containerd/containerd was updated to v1.6.6 to mitigate CVE-2022-31030.

Fixes:

• kube: configure proper account impersonation NS #492 #494

Improvements:

• Update dependencies #493

Release date: 2022-06-01

This prerelease fixes an issue where the token used for Helm operations would go stale if it was provided using a Bound Service Account Token Volume.

Starting with this version, the controller conforms to the Kubernetes API Priority and Fairness. The controller detects if the server-side throttling is enabled and uses the advertised rate limits. When server-side throttling is enabled, the controller ignores the --kube-api-qps and --kube-api-burst flags.

Fixes:

• kube: load KubeConfig (token) from FS on every reconcile #480
• Updating API group name to helm.toolkit.fluxcd.io in docs #484

Improvements:

• Update dependencies #482
• Update source-controller to v0.25.0 #490