|
1 | 1 | # Changelog |
2 | 2 |
|
| 3 | +## 0.16.0 |
| 4 | + |
| 5 | +**Release date:** 2022-02-01 |
| 6 | + |
| 7 | +This prerelease comes with security improvements for multi-tenant clusters: |
| 8 | +- Platform admins can enforce impersonation across the cluster using the `--default-service-account` flag. |
| 9 | + When the flag is set, all `HelmReleases`, which don't have `spec.serviceAccountName` specified, |
| 10 | + use the service account name provided by `--default-service-account=<SA Name>` in the namespace of the object. |
| 11 | +- Platform admins can disable cross-namespace references with the `--no-cross-namespace-refs=true` flag. |
| 12 | + When this flag is set, `HelmReleases` can only refer to sources (`HelmRepositories`, `GitRepositories` and `Buckets`) |
| 13 | + in the same namespace as the `HelmRelease` object, preventing tenants from accessing another tenant's repositories. |
| 14 | + |
| 15 | +In addition, the controller comes with a temporary fork of Helm v3.8.0 with a patch applied from |
| 16 | +[helm/pull/10486](https://github.com/helm/helm/pull/10486) to solve a memory leak. |
| 17 | + |
| 18 | +The controller container images are signed with |
| 19 | +[Cosign and GitHub OIDC](https://github.com/sigstore/cosign/blob/22007e56aee419ae361c9f021869a30e9ae7be03/KEYLESS.md), |
| 20 | +and a Software Bill of Materials in [SPDX format](https://spdx.dev) has been published on the release page. |
| 21 | + |
| 22 | +Starting with this version, the controller deployment conforms to the |
| 23 | +Kubernetes [restricted pod security standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted): |
| 24 | +- all Linux capabilities were dropped |
| 25 | +- the root filesystem was set to read-only |
| 26 | +- the seccomp profile was set to the runtime default |
| 27 | +- run as non-root was enabled |
| 28 | +- the user and group ID was set to 65534 |
| 29 | + |
| 30 | +**Breaking changes**: |
| 31 | +- The use of new seccomp API requires Kubernetes 1.19. |
| 32 | +- The controller container is now executed under 65534:65534 (userid:groupid). |
| 33 | + This change may break deployments that hard-coded the user ID of 'controller' in their PodSecurityPolicy. |
| 34 | +- When both `spec.kubeConfig` and `spec.ServiceAccountName` are specified, the controller will impersonate |
| 35 | + the service account on the target cluster, previously the controller ignored the service account. |
| 36 | + |
| 37 | +Features: |
| 38 | +- Allow setting a default service account for impersonation |
| 39 | + [#406](https://github.com/fluxcd/helm-controller/pull/406) |
| 40 | +- Allow disabling cross-namespace references |
| 41 | + [#408](https://github.com/fluxcd/helm-controller/pull/408) |
| 42 | + |
| 43 | +Improvements: |
| 44 | +- Update Helm to patched 3.8.0 |
| 45 | + [#409](https://github.com/fluxcd/helm-controller/pull/409) |
| 46 | +- Publish SBOM and sign release artifacts |
| 47 | + [#401](https://github.com/fluxcd/helm-controller/pull/401) |
| 48 | +- Drop capabilities, set userid and enable seccomp |
| 49 | + [#385](https://github.com/fluxcd/helm-controller/pull/385) |
| 50 | +- Update development documentation |
| 51 | + [#397](https://github.com/fluxcd/helm-controller/pull/397) |
| 52 | +- Refactor Fuzz implementation |
| 53 | + [#396](https://github.com/fluxcd/helm-controller/pull/396) |
| 54 | + |
| 55 | +Fixes: |
| 56 | +- Use patch instead of update when adding finalizers |
| 57 | + [#395](https://github.com/fluxcd/helm-controller/pull/395) |
| 58 | +- Fix the missing protocol for the first port in manager config |
| 59 | + [#405](https://github.com/fluxcd/helm-controller/pull/405) |
| 60 | +- Use go-install-tool for gen-crd-api-reference-docs |
| 61 | + [#392](https://github.com/fluxcd/helm-controller/pull/392) |
| 62 | +- Use go install instead of go get in Makefile |
| 63 | + [#391](https://github.com/fluxcd/helm-controller/pull/391) |
| 64 | + |
3 | 65 | ## 0.15.0 |
4 | 66 |
|
5 | 67 | **Release date:** 2022-01-10 |
|
0 commit comments