🚀 New Features

GitOps Friendly Kubeconfig Renewal

Support for In-place Secret Updates: Previously, Sveltos rotated kubeconfigs by creating a new key (re-kubeconfig) and updating the SveltosCluster spec. This caused drift in GitOps tools like ArgoCD or Flux.

You can now define spec.tokenRequestRenewalOption.kubeconfigKeyName. If set to the original key name, Sveltos will overwrite the existing Secret in-place and skip updating the Spec, keeping your live state and Git source-of-truth in sync.

PR: sveltoscluster-manager 361

Enhanced Helm Testing

Native Helm Tests: Introduced RunTests in the Helm configuration. When set to true, Sveltos will automatically run Helm test hooks (helm.sh/hook: test) after successful installs or upgrades.

Failing tests will surface as deployment failures in the ClusterSummary status, providing an automated operational gate.

PR: addon-controller 1687

Flexible Namespace Management

Skip Namespace Creation: To support multi-tenant environments where Sveltos may have restricted RBAC (lacking cluster-wide Namespace permissions), we’ve introduced SkipNamespaceCreation to PolicyRef and KustomizationRef.

When enabled, Sveltos bypasses the check/creation logic and attempts to deploy resources directly into pre-provisioned namespaces.

PR: addon-controller 1685

🐞 Bug Fixes

Helm & Patching Consistency

• Patch-Triggered Redeployments: Fixed an issue where modifying Helm patches did not trigger a redeploy because the chart version and values remained unchanged. Sveltos now tracks a hash of the patches to accurately detect changes.

PR: addon-controller 1686

• Persistence of Failure Messages: Resolved a sequencing bug where FailureMessage for Helm releases was being overwritten in the API server before it could be persisted.

PR: addon-controller 1693

• Template Resolution in Summaries: Fixed a lookup failure where failure messages weren't being correctly mapped when ReleaseName or ReleaseNamespace contained Go templates.

PR: addon-controller 1693

Controller Robustness

• Out-of-band Deletions: Fixed a reconciliation deadlock that occurred if a ClusterSummary was deleted manually while the cluster was in an UpdatingClusters state. The controller now recovers gracefully by dropping the cluster from the update list and forcing a requeue.

PR: addon-controller 1704

✨ Key Highlights

• Reconciliation Stability (#1657): Fixed "reconciliation storms" in production environments by implementing a robust NextReconcileTime guard and an in-memory cooldown map to prevent tight loops and high CPU usage.
• Discovery Optimization (#1644): Drastically reduced API overhead by caching DiscoveryClient and RESTMapper. Added targeted invalidation to discover new CRDs instantly without restarts.
• Granular Helm Debugging (#1663): Added FailureMessage to individual Helm release summaries, making it easier to pinpoint exactly which chart failed and why.
• Unified Promotion Logic (#1666): Shared validation and health check logic across both Auto and Manual promotion modes for consistent guardrails.

Advanced to:

• Helm v4
• Updated to Flux v1 OCIRepository/Bucket sources.
• Upgraded to Go v1.26.1 and CAPI v1.12.4.

🐞 Bug Fixes

#1641: Hardened Helm Lifecycle: Resolved issues causing Helm releases to stall or fail during upgrades.

• Improved handling of missing sub-charts within the dependency management flow.
• Added metadata sanitization to prevent "invalid semantic version" errors during the upgrade process.

✨ Improvements

Intelligent Resource Filtering: Optimized the EventSource and HealthCheck reconcilers. The system now performs a pre-evaluation check on Name and Namespace before triggering a full evaluation. This eliminates redundant processing for resources that don't match your ResourceSelector criteria.