🚀 New Features

Detect Outdated Helm Chart Versions
Sveltos now periodically checks whether a Helm chart deployed through a ClusterProfile or Profile has a newer version, or a newer same-minor patch, published upstream (HTTP repository or OCI registry). This is detection only: nothing about what gets deployed changes automatically. The result is recorded directly on the ClusterSummary that owns the release, alongside the chart identity already resolved at deploy time, so it's visible per cluster rather than blended across a fleet. latestVersion/latestPatchVersion are only populated when something newer genuinely exists; lastCheckedTime advances on every check regardless of outcome, distinguishing "confirmed up to date" from "not yet checked." A background process (main instance only, to avoid duplicate work across shards) groups deployments that are the same chart from the same source and checks each once; unreachable repositories/registries are skipped and logged rather than blocking the rest, and each check has a timeout. Metrics expose which deployments are behind and the health of the checker itself (last run, failure count). The check interval is configurable and can be disabled.
The dashboard surfaces this in three places: cluster list cards show an icon when a cluster has one or more releases with a newer version or patch available; the addon table on a cluster's detail page gains an "Update Available" column; and a new "Updates" button in the cluster heading queries mcp-server on demand and lists outdated releases with their current and latest available versions.
sveltosctl gets the CLI equivalent: a new show helm-updates command displays, per cluster, every Helm release with a newer version or patch available, filterable by namespace, cluster name, and cluster type. Separately, MCP query failures (as opposed to a successful-but-empty response) now show a distinct "Unable to reach the MCP server" message across all MCP-backed dashboard panels, instead of being indistinguishable from "nothing to report."
PRs: addon-controller #1883, sveltos #772, ui-backend #177, dashboard #180, sveltosctl #442

RemoteURL Support for KustomizationRefs
KustomizationRef.RemoteURL lets a KustomizationRef fetch its content directly from an HTTP/HTTPS endpoint or an OCI registry PolicyRef.RemoteURL. Unlike PolicyRef's OCI path, which flattens all YAML/JSON files across layers into one concatenated blob, this path preserves the fetched content's directory structure, since Kustomize needs it. Namespace/Name/Kind are now optional on KustomizationRef (required only when RemoteURL is unset), and hashing/periodic re-fetch both cover RemoteURL-based refs the same way they already do for PolicyRef.
PR: addon-controller #1882

Instantiate Path/Components Using TemplateResourceRefs
PolicyRef.Path and KustomizationRef.Path/Components can now be Go templates instantiated using TemplateResourceRefs data, not just cluster information. This lets a Kustomize overlay path or PolicyRef directory be selected dynamically based on resources read from the management cluster, instead of being fixed per profile.
PR: addon-controller #1868

Helm Post-Render Strategies
HelmChart.Options gains PostRenderStrategy, controlling whether Helm hooks are included when Patches/PatchesFrom are applied as a post-renderer during install/upgrade: combined (Helm's own default, hooks and templates sent together), separate (hooks and templates sent to the post-renderer in independent invocations, avoiding duplicate-resource errors from post-renderers that de-duplicate by resource identity), or nohooks (only regular templates are post-rendered, matching Helm 3's behavior). Only relevant when Patches or PatchesFrom is set.
PR: addon-controller #1866

EventTrigger Errors Surfaced in EventReport Status
When event-manager processes an EventReport and fails to instantiate the resulting ClusterProfile(s), the error used to be visible only in event-manager's own logs. It's now recorded directly on EventReport.Status, so the failure is visible on the object itself instead of requiring log access.
PR: event-manager #502

mcp-server: Event/Classifier Failure Reporting and Fleet-Wide Label Visibility
Event pipeline tracing now surfaces the error event-manager records when it fails to instantiate a ClusterProfile from an EventReport, so tracing an event-driven deployment tells you directly why no profile was created. Classifier pipeline tracing now also covers ManagementClusterClassifier: tracing by name checks both kinds automatically, reporting cluster match, reconcile failures (bad Lua, resource collection errors), and label ownership/conflicts for either. A new fleet-wide tool lists every label currently being managed by any Classifier or ManagementClusterClassifier across all (or a filtered subset of) managed clusters, along with label ownership and conflicts, mirroring sveltosctl show classifier-labels. Two diagnostic bugs were also fixed: installation health checks reporting agent verification failures as a blank reason, and blocked-dependency names being concatenated with no separator in deployment-error/dependency-analysis output.
The Sveltos MCP Server now exposes 22 tools in total.
PR: mcp-server #63

Dashboard: Classifier View
The dashboard now displays Classifier and ManagementClusterClassifier instances, each showing the number of labels it would set and the number of matching clusters. Selecting an instance lists all matching clusters, inline with the existing Events tab. An "Analyze Pipeline" action calls a new MCP tool that verifies a classifier/cluster pair end to end. The overview section also gains Classifier/ManagementClusterClassifier counts.
PRs: ui-backend #176, dashboard #179

Metrics Across the Fleet
addon-controller, event-manager, and sveltoscluster-manager gain a consistent metrics model, replacing ad hoc or cardinality-unsafe gauges/histograms with properly labeled ones (cluster_type, cluster_namespace, cluster_name, and a *_name label per component's own resource): reconcile duration, reconcile outcome (success/failure with the owning profile/trigger), and last-success timestamp, plus component-specific additions: matching_clusters (addon-controller, event-manager), matching_resources (event-manager), connection_failures and agent_last_heartbeat_timestamp_seconds (sveltoscluster-manager). sveltoscluster-manager also fixes two correctness bugs: a stale Kubernetes-version label combination was never removed after a cluster upgraded, and no metric was ever cleaned up when a cluster was deregistered. All components now correctly prefix metrics with projectsveltos_ and ship the auth-proxy RBAC needed to actually scrape /metrics. A Grafana dashboard is available covering the new metrics.
PRs: sveltoscluster-manager #372, event-manager #503, addon-controller #1872, sveltos #768

Recover From Rejected Updates via Force Recreate
PolicyRef/KustomizationRef gain a Force option. Server-side apply cannot always reconcile a manifest change: if a field was set by API server defaulting (or is owned by an unknown field manager) and the new manifest introduces a conflicting value, the apply is rejected and no patch can clear it (e.g. a Deployment moving to strategy.type: Recreate while the API server's previously-defaulted rollingUpdate is still set). When Force is set and an apply is rejected with an error only a delete+recreate can resolve, the object is now deleted and recreated instead of surfacing the error. Never applies to CustomResourceDefinitions, since deleting one cascades to every instance of it, and conflicts (already handled by retry-in-place) are excluded.
PRs: libsveltos #642, addon-controller #1877

---

⚙️ Improvements

Shared, Cached Managed-Cluster Clients
The cluster rest.Config/mapper/discovery-client cache moves from addon-controller-local code into lib/clustercache in libsveltos, so addon-controller, classifier, healthcheck-manager, event-manager, and access-manager all share the same cache instead of each building a fresh client (with a live discovery round-trip) on every call, or managing their own cache independently. The shared cache also adds InvalidateOnAuthError, evicting a cluster's cached client (and the underlying workload-identity cache entry) as soon as the API server rejects credentials with 401/403, instead of waiting for TTL expiry or an explicit cluster delete.
PRs: libsveltos #644, classifier #489, healthcheck-manager #417, event-manager #505, addon-controller #1878, access-manager #352

---

🐞 Bug Fixes

Dashboard: Cluster Label Changes Not Reflected
SveltosClusterPredicate and ClusterStatusPredicate missed reacting to labels changes, so a cluster relabel wasn't always picked up.
PR: ui-backend #175

classifier: Deleted Cluster Reports Treated as Failures
A ClassifierReport left over from a since-deleted cluster was treated as a hard failure on every reconcile. deployClassifier now checks whether the report's cluster still exists before processing it and skips reports for clusters that are gone, and a new background sweep runs every 5 minutes to remove ClassifierReports whose cluster no longer exists.
PR: classifier #487

Missing FailureMessage on ClusterSummary Delete
When deleting a ClusterSummary failed, the error wasn't reported in FailureMessage, leaving no visible reason for the failure.
PR: addon-controller #1873

Helm Upgrade Force Option Silently No-Op
getHelmUpgradeClient unconditionally set ServerSideApply and ForceConflicts on every upgrade, a combination the Helm SDK rejects outright (cannot use force conflicts and force replace together), so an upgrade with force set failed immediately instead of ever taking effect. ServerSideApply/ForceConflicts are now only enabled when force is not set; when force is set, both are disabled so the delete+recreate path can proceed as Helm expects.
PR: addon-controller #1876

DryRun ClusterReports Left Unpopulated on Resource Errors
When a resource's dry-run apply failed (e.g. a StatefulSet update rejected with an immutable-field error), the failure surfaced correctly on ClusterSummary.Status.FeatureSummaries[].FailureMessage, but ClusterReport.Status.ResourceReports was never written, since processing returned early on the deploy error before reaching the call that persists the report. The failing resource now gets a ResourceReport with an Error action recording the failure (DryRun mode only), and whatever ResourceReports were gathered are persisted before the deploy error is returned, instead of the ClusterReport update being skipped entirely.
PR: addon-controller #1885

---

🔧 Maintenance

• All components advanced to Cluster API v1.13.4
• All components advanced to Go 1.26.5

🚀 New Features

Supply Chain Verification for Helm Charts
Sveltos can now verify the integrity and origin of a Helm chart before deploying it, with two mechanisms targeting different chart sources. For charts pulled from OCI registries, Sveltos verifies the Cosign signature attached to the chart: a PublicKey provider checks it against a static key stored in a Kubernetes Secret, while a Keyless provider verifies the Fulcio-issued certificate against an expected OIDC issuer/subject and confirms the signing event was recorded in the Rekor transparency log, so the chart must have been signed by a specific pipeline in a specific repository. Both providers support the Sigstore Bundle v0.3 OCI referrer format and fall back to the legacy tag-based signature format. For charts pulled from HTTP repositories, Sveltos verifies the Helm .prov provenance file against a GPG keyring stored in a Secret. In both cases a failed verification blocks the deployment and the reason is recorded on the ClusterSummary status; charts without a verification field deploy as before.
PRs: addon-controller #1842, sveltos #753

Workload Identity Support
SveltosCluster now supports authenticating to a managed cluster using the cloud provider's native workload identity instead of a stored kubeconfig Secret: AWS (IRSA / EKS Pod Identity), GCP (Workload Identity Federation), and Azure (Azure Workload Identity). When configured, Sveltos obtains short-lived credentials directly from the cloud provider, caching them in-process and refreshing proactively before expiry. sveltosctl register cluster has been extended to configure workload identity when registering a cluster.
PRs: libsveltos #636, sveltosctl #434

OCI Support in PolicyRef
RemoteURL in PolicyRef now accepts oci:// URLs in addition to http:// and https://. Sveltos pulls the OCI artifact from the registry on each reconciliation at the configured interval, computes a content hash, and redeploys when the content changes, identical to the existing HTTP polling behavior. Authentication uses the same secretRef field, supporting a bearer token, basic auth, or a custom CA certificate. Both a tar archive (the standard ORAS/Flux format) and a raw YAML/JSON blob are supported as artifact layouts.
PR: addon-controller #1851

Classify Clusters from Management Cluster Resources
Classifier evaluates rules against resources inside each managed cluster, which leaves a gap when the classification signal instead lives on the management cluster itself, such as a Crossplane Composite Resource created when a team orders an addon on an Internal Developer Platform. A new ManagementClusterClassifier resource closes that gap: it watches resources on the management cluster and runs a Lua function that receives the full set of matched resources and returns which managed clusters should be labeled. A ManagementClusterClassifierReport tracks label ownership per classifier/cluster pair, giving the same conflict detection the existing Classifier provides.
PR: classifier #482

sveltosctl: show classifier-labels
A new sveltosctl show classifier-labels command displays the labels that Classifier and ManagementClusterClassifier instances are actively managing on each cluster, along with the name of the instance that owns each label.
PR: sveltosctl #437

---

⚙️ Improvements

sveltos-agent: Reduced Memory Usage in Agentless Mode
In agentless mode, each sveltos-agent instance runs in the management cluster and is responsible for a single managed cluster, but its controller-runtime cache had no namespace or label restrictions, so every agent's informer held HealthCheckReport, EventReport, and ConfigMap objects for all managed clusters, causing O(N) memory per agent and O(N²) total. The cache is now scoped per agent: HealthCheckReport and EventReport are restricted with a label selector matching the agent's cluster name and type, and the per-cluster ConfigMap is restricted with a field selector on its name.
PR: sveltos-agent #493

addon-controller: Condition-Based Wait for CRD Reapply
When a Helm chart is deployed with UpgradeCRDs: true, the controller used to sleep for 30 seconds after applying the chart's CRD files on every reconcile, regardless of whether the CRDs had actually changed, which was especially costly in ContinuousWithDriftDetection sync mode. The sleep is replaced with a poll against the destination cluster's CRD status, returning as soon as each CRD's Established and NamesAccepted conditions are true, effectively zero delay when CRDs are already established and no more than necessary for a genuine upgrade.
PR: addon-controller #1844

---

🐞 Bug Fixes

sveltos-agent: Reloader Feature Broken in Agentless Mode
In agentless mode, sveltos-agent watched every Reloader instance in the management cluster instead of only the subset belonging to its own managed cluster, and watched ConfigMap/Secret objects in the management cluster instead of the managed cluster. Both are now scoped correctly.
PR: sveltos-agent #494

addon-controller: Tier Change Not Triggering Takeover
Once a ClusterProfile was managing a chart, its tier was never compared against other conflicting profiles on later reconciliations, so raising a profile's tier above a challenger stuck in FailedNonRetriable never woke the challenger up. Tier comparison now runs on every reconcile even for the profile currently managing the chart, so a higher-tier challenger correctly reclaims it.
PR: addon-controller #1837

access-manager: Configurable Namespace
The Sveltos namespace was hardcoded to projectsveltos; this closes a gap missed in the previous release by allowing it to be configurable, part of the broader effort to remove that limitation across components.
PR: access-manager #348

classifier: Upgrade Blocked by Deleted Clusters
The migration init container that upgrades deprecated ClusterInfo entries into ClassifierReport objects would crash-loop and block the upgrade entirely if a managed cluster had been deleted before the upgrade, since its namespace no longer existed. Entries whose cluster namespace is gone are now logged at debug level and skipped, while all other entries migrate normally.
PR: classifier #480

sveltos-agent: Wait for Informer to Be Synced
In agentless mode, sveltos-agent can restart its internal controller-manager without a pod restart, for example when a managed cluster's kubeconfig token expires or a CRD change is detected. If an EventSource was evaluated in the window before the new informers had synced, it returned an empty result that was misread as zero matching resources, causing event-manager to delete previously created ClusterProfiles. An unsynced informer is now treated as a transient error and the evaluation is retried once the informers have synced.
PR: sveltos-agent #495

🔧 Maintenance

• All components advanced to Cluster API v1.13.3
• All components advanced to Kubernetes client-go v1.36.2

🐞 Bug Fixes

ClusterProfile deletion no longer stalls (addon-controller #1829 (#1829))
Fixed a bug where deleting a ClusterProfile could get stuck indefinitely. The allMatchingProfilesProcessed check was not skipping other profiles that were themselves already being deleted, causing the controller to wait forever for work that would never complete.

MCP compare-clusters tool reliability (mcp-server #57 (projectsveltos/mcp-server#57))
Corrected several issues in the compare_managed_clusters MCP tool. A not-found cluster now surfaces a clear error instead of silently returning an empty result. Additionally, when a cluster exists but its ClusterConfiguration has not yet been created (resources still deploying), the tool now returns a non-fatal warning in the output rather than returning misleading empty comparison data.

Spurious pending-updates indicator in the UI (ui-backend #171 (projectsveltos/ui-backend#171))
Fixed incorrect cluster status reporting in the UI backend. A cluster was wrongly flagged as having pending updates when a profile matched it and that profile had declared dependencies. The status is now computed correctly in those cases.