Helm Chart Values Changelog

Track changes in GitGuardian's Helm chart values across releases.

Latest Version: 2026.10.0

Resources: Helm installation guide | Upgrade procedures

2026.10.0 vs 2026.9.0

New:

• Added beat.metricsPort (default empty, which falls back to celeryWorkerDefaults.metricsPort) for the port where the task scheduler exposes its Prometheus /metrics endpoint. The chart now renders a beat Service for it and, when observability.serviceMonitors is enabled, a beat-servicemonitor ServiceMonitor.
• Added global.podLabels, global.podAnnotations, global.envVars and global.envFrom to the self-hosted values file. They already applied to self-hosted installs but were missing from this reference.
• Added migration.priorityClassName (default empty, which falls back to global.priorityClassName) for the migration Jobs and the remote preflights CronJob.

Updated:

• global.podLabels, global.podAnnotations, global.nodeSelector, global.tolerations, global.priorityClassName, global.envVars and global.envFrom now reach the pods that ignored them: the nginx CRL Job and CronJob, the ClickHouse and Keeper StatefulSets (global.podLabels only), the remote preflights CronJob, the migration Jobs and the upgrade path check. The replicated, loki and loki-minio subcharts do not read most global.* keys: each value's description lists the subchart key to set instead.
• Added the public_monitoring_continuous_scan queue to celeryWorkers.public-monitoring.queues (and the matching public_monitoring_continuous_scan: 10 autoscaling metric).

2026.9.0 vs 2026.8.0

New:

• Added the GGBridge block (GGBridge.enabled, default false; GGBridge.basePublicDomain, GGBridge.baseInternalDomain, GGBridge.bridges) to declare the GitGuardian Bridge servers that reach sources in isolated networks, one bridges entry per network. See GitGuardian Bridge Self-Hosted.
• Added inAppAnalytics.postgresql.applicationSchema, inAppAnalytics.postgresql.useSeparateAnalyticsSchema and inAppAnalytics.postgresql.analyticsSchema to choose the PostgreSQL schemas the in-app analytics job writes to. All unset by default, which keeps the historical layout (GitGuardian tables in public, intermediate objects in analytics). Set them when your database forbids public or cannot grant CREATE to the GitGuardian user. See In-app analytics schemas.
• Added mcpServer.oauth.extraRedirectUris (default []) to register the OAuth callback URLs of your own MCP gateway, as absolute https:// URLs on a host you control. See Connect through your own MCP gateway.
• Added replicated.supportBundle.nodeSelector, replicated.supportBundle.tolerations, replicated.supportBundle.affinity and replicated.supportBundle.podAnnotations to schedule the support bundle pod, for example on tainted nodes, and to keep autoscalers and deschedulers from evicting it. nodeSelector falls back to global.nodeSelector. See Pod eviction.
• Added clickhouse.objectStorage (provider: s3, gcs or azblob, with a typed block per provider: endpoint, bucket, prefix, region, forcePathStyle, credentialless, existingSecret, and the Azure storageAccountUrl and containerName). The chart generates the 00-object-storage.xml config file from it. Leave provider empty to keep hand-writing clickhouse.configdFiles. See ClickHouse storage.
• Added clickhouse.backup.enabled (default true), clickhouse.backup.objectStorage (same shape as clickhouse.objectStorage, but for the backup destination, which must be a different bucket), clickhouse.backup.config.* (camelCase sidecar tunables plus extraVars) and clickhouse.backup.sidecar.* (image, resources, security context, extra env vars and volume mounts). See ClickHouse backup and restore.
• Added clickhouse.serverConfig.metadataDiskKeepFreeSpaceBytes (default 1073741824, 1 GiB) to refuse writes below a free-space threshold on the metadata disk, and clickhouse.serverConfig.extraVars for guardrail variables you add yourself.
• Added clickhouse.cache (enabled, size, storageClass) for the filesystem cache volume, and clickhouse.tls.* to encrypt ClickHouse connections with chart-generated, cert-manager or user-provided certificates.

Updated:

• The ClickHouse component is now rendered by native chart templates under the single clickhouse.* key, instead of the vendored clickhouse-server subchart. Persistence, resources, scheduling, probes, security contexts, configdFiles, usersdFiles, sidecars and the other subchart settings keep their names but move from clickhouse-server.* to clickhouse.*.
• clickhouse.serverConfig keys are renamed from environment-variable style to camelCase with typed values: MAX_CONCURRENT_QUERIES becomes maxConcurrentQueries: 32, PARTS_TO_DELAY_INSERT becomes partsToDelayInsert: 1000, and so on. cacheMaxSize now defaults to empty and is derived from clickhouse.cache.size.
• clickhouse.defaultInitContainers.volumePermissions.image now points at gitguardian/wolfi/bash instead of the os-shell-iamguarded image, which could not be pulled.
• mcpServer.image.registry now defaults to the Replicated proxy (proxy.replicated.com/proxy/gitguardian/ghcr.io) instead of ghcr.io.
• Added the team_sync queue to celeryWorkers.long.queues (and the matching team_sync: 10 autoscaling metric).
• celeryWorkers.automatic-severities.resources.requests now sets cpu: 100m.
• replicated.supportBundle.resources.initContainer memory defaults rise from 128Mi / 512Mi to 1Gi request / 4Gi limit, so bundle generation no longer runs out of memory on large instances.
• Added the optional celeryWorkers.container-registries worker (container_registries queue, replicas: 0, fallbackWorker: scanners).

Removed:

• Removed the clickhouse-server.* block: the chart fails to render while it is still present in your values, with a message pointing at the clickhouse.* replacement.
• Removed clickhouse.backupConfig (upper-case sidecar variables), replaced by clickhouse.backup.config and clickhouse.backup.objectStorage.

2026.8.0 vs 2026.7.0

New:

• Added the opt-in clickhouse component (clickhouse.enabled, default false): sizing guardrails and backup settings under clickhouse.*, and the vendored subchart's raw values under clickhouse-server.*. It requires object storage you provide. See ClickHouse.
• Added global.emptyDir.sizeLimit to set a default sizeLimit on every chart-managed emptyDir volume (empty emits no sizeLimit, which is the Kubernetes default of unbounded). Per-volume overrides: secretEngine.emptyDir.modelDir.sizeLimit (the ML model bundle, by far the largest of the machine-learning volumes), secretEngine.emptyDir.bentomlTmp.sizeLimit, secretEngine.emptyDir.bentomlProm.sizeLimit, and logCollector.emptyDir.sizeLimit. Set these if your platform caps emptyDir volumes.
• Added the optional celeryWorkers.incidents-disk worker, which consumes the incidents_disk queue to recompute secret locations on dedicated pods with their own ephemeral storage (5Gi request). Disabled by default (replicas: 0); when disabled, the queue falls back to the scanners worker. Autoscaling metric {"incidents_disk":10}.

Updated:

• Added the core_aspm queue to celeryWorkers.long.queues (and the matching core_aspm: 10 autoscaling metric).

2026.7.0 vs 2026.6.0

New:

• Added the optional celeryWorkers.public-monitoring worker, which consumes the Public Monitoring queues (public_monitoring, public_monitoring_historical_scan, public_monitoring_realtime_scan). It is gated by the is_public_monitoring_enabled license field (effectively disabled until licensed); when enabled it defaults to 1 replica, 1Gi memory request / 2Gi limit.
• Added the opt-in mcpServer deployment. Set mcpServer.enabled: true to deploy the MCP server (default false). When enabled it runs 1 replica, exposes an ingress under the /mcp-server path of the application host, enables the OAuth proxy, and uses latency-based autoscaling (mcpServer.autoscaling.metrics.targetLatency). With the aws_alb controller it requires AWS Load Balancer Controller 2.14 or later.
• Added inAppAnalytics.ephemeralStorage (enabled, size, storageClass, annotations, labels; default enabled: false, size: 20Gi) to attach a dedicated ephemeral volume to the in-app analytics pod, moving Spark scratch and spill data off the node's local /tmp disk. Prevents daily analytics job failures caused by node ephemeral-storage limits on large workspaces. See In-app analytics ephemeral storage.
• Added logCollector.collectMigrationLogs (default true) to also collect logs from the pre-deploy and post-deploy hook Jobs. The collector is injected as a native sidecar, which requires Kubernetes 1.29 or later. Disable it on older clusters.

Updated:

• Added the validity_check_batch autoscaling metric to celeryWorkers.batch.

2026.6.0 vs 2026.5.0

New:

• Added Gateway API support for ingress. New ingress.routingApi (ingress (default) or gateway-api) selects between the Kubernetes Ingress / IngressRoute / VirtualService / HTTPProxy / Route templates and Gateway API HTTPRoute + Gateway. When gateway-api is selected, configure ingress.gatewayApi.gatewayClassName and ingress.gatewayApi.gateway.* (create, name, namespace, httpListenerPort, httpsListenerPort); only the istio, contour, and traefik controllers are supported in this mode. See Gateway API.
• Added the optional celeryWorkers.check-run-scanners worker — consumes the check_run_scan queue to run scan-based (PR-scoped) check-runs on dedicated pods, separate from the historical-scan scanners worker. Disabled by default (replicas: 0); when disabled, the check_run_scan queue falls back to the scanners worker. Autoscaling metric {"check_run_scan":10}, terminationGracePeriodSeconds: 1800.
• Added the optional celeryWorkers.premium-scanners-retry worker — consumes the premium_repo_scan_retry queue and retries failed large-repository scans on a dedicated high-memory pod. Disabled by default (replicas: 0); when disabled, retries fall back to the regular scanner workers. Defaults: 120Gi memory request/limit, autoscaling metric {"premium_repo_scan_retry":1}, terminationGracePeriodSeconds: 86400. See Premium scan retry worker.
• Added the premium_repo_scan_retry queue so retries are processed by the standard celeryWorkers.scanners worker when the dedicated worker is disabled.
• Added tls.customCa.resources to set resource requests/limits on the init-custom-ca init container (default: requests cpu: 50m / memory: 64Mi, limits memory: 128Mi).

Updated:

• webapps.internal_api_long.nginx.location now also routes issues/{id}/occurrences/ and public-monitoring/perimeter/all-developers/ to the long-request internal API webapp (previously only the report/ endpoint).

2026.5.0 vs 2026.4.0

New:

• Added dedicated celeryWorkers.automatic-severities worker (replicas: 1, autoscaling up to 3, requests 1Gi / limits 2Gi memory) — moves the automatic_severities queue out of the long worker into its own scalable worker.
• Added celery queue to celeryWorkers.worker.queues (and matching celery: 10 autoscaling metric).
• Added endpoints queue to celeryWorkers.long.queues (and matching endpoints: 10 autoscaling metric).
• Added inAppAnalytics.annotations and inAppAnalytics.podLabels for finer-grained metadata on analytics workloads.
• Added tls.certManager.issuer.group (default: cert-manager.io) to support external issuers (e.g. AWS PCA).
• Added logCollector.supportBundle.logLevel (info / error, default: info) to filter Loki queries when generating a support bundle.

Updated:

• Default value of inAppAnalytics.enabled changed from false to true.

Removed:

• Removed automatic_severities from celeryWorkers.long.queues (moved into the dedicated celeryWorkers.automatic-severities worker above).

2026.4.0 (Required) vs 2026.3.0

New:

• Added global.labels for common labels applied to all resources (replaces commonLabels).
• Added global.tolerations for common tolerations applied to all workloads (replaces commonTolerations).
• Added global.nodeSelector for a global node selector applied to all GIM pods (component-level nodeSelector takes full precedence). Learn more about node scheduling.
• Added global.image.imagePullPolicy for global image pull policy.
• Added autoscaling.keda.additionalPromqlLabelSelectors for custom PromQL label selectors in KEDA queries.
• Added nginx.extraEnv, nginx.extraVolumes, nginx.extraVolumeMounts for Nginx customization.
• Added inAppAnalytics.terminationGracePeriodSeconds (default: 7200s) for analytics job graceful shutdown.
• Added networkPolicy.mode (dryrun / enforce), networkPolicy.allowedNamespaces, and networkPolicy.extraPolicies for granular network policy control. See Network policies.
• Added replicated.supportBundle.enabled, replicated.supportBundle.admissionPolicy, replicated.supportBundle.credentials, and replicated.supportBundle.resources for enhanced support bundle configuration.

Updated:

• Added onPrem.replicatedRbac.mode (full / minimal / disabled) replacing the previous boolean enabled.
• Added core_default, sources_default, incidents_default to celeryWorkers.worker.queues.
• Added code_fixing to celeryWorkers.scanners.queues.
• Added hmsl, core_long, sources_long, incidents_long, ml_backpopulate to celeryWorkers.long.queues.

Removed:

• Removed commonLabels and commonTolerations (replaced by global.labels / global.tolerations).
• Removed global.security.allowInsecureImages and global.compatibility.openshift.adaptSecurityContext.
• Removed onPrem.replicatedRbac.enabled (replaced by mode).
• Removed sentry section.
• Removed externalSecrets section. Manage ExternalSecret resources yourself and use existingSecrets instead.
• Removed logCollector.networkPolicy.enabled in favor of top-level networkPolicy.enabled.

2026.3.0 vs 2026.2.0

Updated:

• Added ml_backpopulate to celeryWorkers.long.queues default value.

2026.2.0 vs 2026.1.0

New:

• Added hookMethod parameter to handle helm and argocd hooks annotations.
• Added replicated.replicaCount coming with Replicated SDK HA feature.
• Added replicated.highAvailability.podAntiAffinityPreset coming with Replicated SDK HA feature.
• Added replicated.highAvailability.podDisruptionBudget.enabled coming with Replicated SDK HA feature.
• Added replicated.highAvailability.podDisruptionBudget.minAvailable coming with Replicated SDK HA feature.
• Introduced new celeryWorkers.check-runs worker type dedicated to Check Run tasks (default: 0 replicas).

Updated:

• Updated loki.loki.compactor.retention_delete_delay from 168h to 2h to better reflect Loki configuration.
• Added sources_default, incidents_default and individual_validity_check to celeryWorkers.worker.queues.
• Added individual_validity_check to celeryWorkers.worker.autoscaling.metrics.
• Added code_fixing to celeryWorkers.scanners.queues.
• Added hmsl, sources_long and incidents_long to celeryWorkers.long.queues.

2026.1.0 (Required) vs 2025.12.0

New:

• Added webappDefaults and celeryWorkerDefaults sections to centralize common configuration (e.g., nodeSelector, tolerations, priorityClassName). Individual webapp/worker configurations are still fully supported and take priority over defaults - you can override any default value by specifying it directly under webapps.[name] or celeryWorkers.[name], even if not explicitly listed in the values reference.
• Added new Celery queues: core_default and core_long.

Removed:

• Removed apacheTika.javaOpts parameter.

2025.12.0 vs 2025.11.0

New:

• Added extra_hostnames parameter to allow additional hostnames on Nginx proxy.
• Added network.ipFamily parameter to select IP class (IPv4/IPv6) for Service resources. Learn more.
• Introduced new worker type business-contribution under celeryWorkers key value.
• Added new global podDisruptionBudget.enabled parameter to deploy PDB globally.
• Introduced section inAppAnalytics parameter to configure the In App Analytics feature (in beta).
• Added new podDisruptionBudget parameter to control PDB globally.

Updated:

• Tagged experimental.ingressRoutes explicitly as deprecated feature.

2025.11.0 vs 2025.10.0

New:

• Added default RuntimeDefault value to MinIO pod security loki-minio.containerSecurityContext.seccompProfile.type.
• Introduced update_sources_state and nhi_ingestion parameters to celeryWorkers.long.autoscaling.metrics.
• Added replicatedRbac section to control replicated RBAC.

Updated:

• replicated-sdk now inherits from global.imagePullSecrets, removing the need to use replicated.imagePullSecrets if secret is defined globally.
• Default logCollector.supportBundle.since changed from 6h to 12h.
• Changed celeryWorkers.long.queues value to add update_sources_state and nhi_ingestion.

Removed:

• Deleted replicatedSdk key as it is enabled by default now.

2025.10.0 (Required) vs 2025.9.0

Updated:

• Containers are now using readOnlyRootFilesystem by default (containerSecurityContext).
• Updated loki-minio.image.repository from gitguardian/wolfi/minio-bitnami to gitguardian/wolfi/minio.
• Updated loki-minio.image.tag from 0.20250723 to 0.20250907.
• The parameter loki-minio.image.pullPolicy has been renamed to loki-minio.image.imagePullPolicy.
• Added automatic_severities to celeryWorkers.long.queues to allow long-running tasks to complete gracefully before the 24-hour timeout.
• Added NO_PROXY to replicated.extraEnv default to fix license verification when using a proxy.

Removed:

• loki-minio.podSecurityContext.enabled boolean has been removed. To disable podSecurityContext you now need to use empty object such as podSecurityContext: {}.
• loki-minio.containerSecurityContext.enabled boolean has been removed. To disable containerSecurityContext you now need to use empty object such as containerSecurityContext: {}.
• loki-minio.networkPolicy section has been removed since it is not supported anymore.
• loki-minio.console section has been removed since it is not relevant anymore.
• loki-minio.ServiceAccount section has been removed since it is now enabled by default.

2025.9.0 vs 2025.8.0

New:

• Introduced apacheTika parameter to configure the new file scanner service for Non-VCS sources (disabled by default).
• Introduced celeryWorkers.scanners-ods-highdisk parameter to configure workers dedicated to high storage tasks like Microsoft OneDrive and SharePoint scanning (default: 0).

Learn more about Non-VCS Sources.

Updated:

• Updated logCollector.supportBundle.since default value from 3d to 6h to make support bundle lighter.

Removed:

• postgresql.plugins.pgvector.enabled has been removed since it is now enabled by default, pgvector is now required. Learn more about PostgreSQL requirements.

2025.8.0 vs 2025.7.0

Upgrading to 2025.8

Air gap deployment? This release introduces a new image.registry parameter in Helm values to support the Log Collector system. This parameter specifies the location of the GitGuardian images for the Log Collector components (Loki, MinIO, Fluent Bit) and is separate from the main imageRegistry parameter. Follow the upgrade instructions to update your helm values file.

New:

• Introduced a new image.registry parameter in Helm values to support the Log Collector system. This parameter specifies the location of the GitGuardian images for the Log Collector components (Loki, MinIO, Fluent Bit) and is separate from the main imageRegistry parameter. Follow the upgrade instructions to update your helm values file.
• Introduced celeryWorkers.scanners-slack parameter to configure workers dedicated to Slack scanning (default: 0). Learn more about Slack Scanning considerations.
• Added commonTolerations parameter that allows you to apply consistent tolerations across all workloads in the GitGuardian deployment.

Removed:

• beat.replicas has been removed and is now hardcoded in the chart to 1.

2025.7.0 (Required) vs 2025.6.0

New:

• Added priorityClassName parameter for ML Secret Engine and several priority class configuration. Learn more. This is also available for other pods and as a global parameter (global.priorityClassName).

Updated:

• Changed the default value of celeryWorkers.ml-api-priority.replicas from 0 to 1. Learn more.

2025.6.0 vs 2025.5.0

New:

• Added global.fipsEnabled parameter to enable FIPS compliant images. Learn more about FIPS compliance.
• Added pod anti-affinity configuration (podAntiAffinityPreset) and nodeSelector and tolerations parameters across all components for improved workload placement control and high availability. Learn more about scaling.
• Enhanced logCollector with additional configuration options (logCollector.env, logCollector.envFrom, logCollector.pipelines). Learn more about additional pipelines.
• Enhanced migration job resource configuration with separate specifications for pre-deploy, post-deploy, and upgrade path check jobs.

Removed:

• migration.resources has been replaced with job-specific resource configurations for better resource management.

2025.5.0 vs 2025.4.0

Upgrading to 2025.5

Air gap deployment? We've renamed images in this release. See below changes and find all image and tag names on the Air Gap Install page.

New:

• Added support for configuring the proxy via an existing Kubernetes secret using proxy.existingSecret and proxy.existingSecretKeys.*.

Updated:

• FIPS: This release uses Chainguard images without FIPS-approved cryptographic modules. If you would like to use Chainguard images with FIPS, please contact our support team. This change involves renaming the following images:
  • gitguardian/prm-static-chainguard-fips to gitguardian/prm-static-chainguard
  • gitguardian/prm-app-fips to gitguardian/prm-app-chainguard
• Use proxy.replicated.com/proxy/gitguardian/ghcr.io/gitguardian/wolfi/bash:latest image instead of proxy.replicated.com/proxy/gitguardian/docker.io/nginxinc/nginx-unprivileged:stable for Custom CA injection (See tls.customCa.image.*).
• The securityContext.enabled (bool) parameter has been replaced by a new securityContext (object) parameter, which now allows specifying the full Pod Security Context.

Removed:

• experimental.chainguard has been deprecated as GitGuardian images are now using Chainguard by default. Lean more about Chainguard.

2025.4.0 (Required) vs 2025.3.0

Upgrading to 2025.4

Air gap deployment? We've added new images in this release. Find all image and tag names on the Air Gap Install page.

New:

• Our self-hosted deployments now include a log collection system, leveraging Loki, MinIO, and Fluent Bit under the hood. This log collection system is now enabled by default for all installation types (Helm or KOTS). Learn more about the log collector.
• The PostgreSQL pgvector extension is now required by default (postgresql.plugins.pgvector.enabled). Please follow the installation instructions to enable vector similarity search capabilities for upcoming machine learning features.

Updated:

• Added default support-bundle Role and optional ClusterRole creation (configurable via replicated.supportBundle.rbac.clusterRole.create).
• Added global.compatibility.openshift.adaptSecurityContext configuration to support OpenShift's restricted-v2 Security Context Constraints (SCC). Values include auto (default), force, and disabled for flexible security context adaptation.

2025.3.0 vs 2025.2.0

Upgrading to 2025.3

We've updated the path and names of our images in this release. Follow the upgrade instructions to update your tooling for downloading and uploading GitGuardian images to your private registry. Find all image and tag names on the Air Gap Install page.

Updated:

• Change registry URL from proxy.replicated.com/proxy/gitguardian/513715405986.dkr.ecr.us-west-2.amazonaws.com to proxy.replicated.com/proxy/gitguardian/docker.io and rename paths and images name from:
  • /prm/static-chainguard to /gitguardian/prm-static-chainguard-fips
  • /prm/app-chainguard to /gitguardian/prm-app-chainguard-fips
  • /prm/helm-tooling to /gitguardian/prm-helm-tooling
  • /services/nginx-unprivileged to /nginxinc/nginx-unprivileged
  • /ml-detector/ml-secret-engine/app-chainguard to /gitguardian/ml-secret-engine-app-chainguard-fips
• Change registry URL from registry.replicated.com to proxy.replicated.com/proxy/gitguardian/docker.io and rename paths and images name from /gitguardian/replicated-sdk to /replicated/replicated-sdk.
• The nhi-scout parameter has been renamed to ggscout.
• Added celeryWorkers.*.autoscaling.keda.idleReplicaCount parameter to allow specifying the number of replicas when there is no activity on the Celery Worker (default: 0).

2025.2.0 vs 2025.1.0

New:

• Enhanced the webapps.<all>.autoscaling settings to support both Horizontal Pod Autoscaler (HPA) and KEDA autoscaling options, including enabling/disabling and setting triggers. Learn more.
• Added migration.podAnnotations parameter for GitGuardian migration pods.

Updated:

• nhiScout.enabled parameter has been moved to nhi-scout.enabled. Learn more.

2025.1.0 (Required) vs 2024.12.0

Upgrading to 2024.12

The ReplicatedSDK image is now pulled from the Replicated registry instead of Docker Hub. For airgap installations, ensure you update your automation processes for pulling and pushing images to your private registry. For more information, refer to the Airgap Installation page.

New:

• Introduced secretEngine parameter to configure the new ML Secret Engine service. (Disabled by default). Learn more.
• Introduced celeryWorkers.ml-api-priority parameter to configure ML Secret Engine dedicated worker (Disabled by default).
• Introduced nhiScout.enabled parameter to enable NHI Scout deployment (Disabled by default). Learn more
• Introduced nhi-scout parameter to configure NHI Scout.
• Added replicated.image.registry parameter to use the Replicated registry (registry.replicated.com) instead of Docker Hub by default.

Updated:

• Changed the default value of replicated.image.repository from replicated/replicated-sdk to gitguardian/replicated-sdk.

2024.12.0 vs 2024.11.0

Upgrading to 2024.12

This release includes breaking changes. Upgrade to 2024.12.0 using the upgrade notes.

New:

• Ability to deploy Ingress objects with the support of several Ingress controllers. For details, see the Ingress documentation.

Updated:

• front.ingress has been renamed to ingress for improved consistency and standardization across the Helm chart.
• istio have been moved under the ingress.
• The default memory value for migration.resources has been increased from 100Mi to 200Mi.

2024.11.0 vs 2024.10.0

Upgrading to 2024.11

This release includes breaking changes.

New:

• Removed settings.healthCheck.periodicInterval parameter since health checks are now distributed over time rather than executing them simultaneously. This parameter is replaced by spread_periodic_range_minutes in the admin area.
• Added replicated.privateCASecret parameter to specify a custom CA when using a proxy. Learn more.
• Replace the legacy parameter replicated.images.replicated-sdk with the new parameters replicated.image.repository and replicated.image.tag

2024.10.0 (Required) vs 2024.9.0

New:

• Added two new worker types long-ods (non-VCS sources such as Slack, Jira Cloud, Confluence, ...) and long-ods-io (long tasks specialized in Input/Output).
• Added the support of CRL (instead of default OCSP) for certificate-based authentication.

Updated:

• Decreased the default value of celeryWorkers.realtime-ods.replicas from 2 to 0.

2024.9.0 vs 2024.8.0

New:

• Added a new autoscaling object to configure autoscaling settings.
• Enhanced the celeryWorkers.<all>.autoscaling settings to support both Horizontal Pod Autoscaler (HPA) and KEDA autoscaling options, including enabling/disabling and setting triggers. Learn more.
• Introduced a new setting replicated.supportBundle.logs.maxLines to specify the maximum number of lines included in support bundle logs.
• Added experimental.tini, a new option to enable tini for terminating zombie processes on workers.

2024.8.0 vs 2024.7.0

New:

• Introduced tls.clientAuth to support authentication using Common Access Card (CAC) or Personal Identity Verification (PIV). For detailed information, refer to the documentation here.

2024.7.0 (Required) vs 2024.6.0

Upgrading to 2024.7

This release includes breaking changes.

New:

• Added settings.healthCheck.periodicInterval allowing you to change the frequency of health checks.

Updated:

• Renamed front.ingress.tls.secretName to front.ingress.tls.existingSecret.
• Renamed tls.customCa.caCert to tls.customCa.caCrt.
• Renamed tls.customCa.existingSecretCaCertKey to tls.customCa.existingSecretKeys.caCrt and set the Default to "".
• Renamed redis.main.existingSecretKeys.sentinel.password to redis.main.existingSecretKeys.sentinelPassword.
• Renamed redis.main.existingSecretKeys.sentinel.url to redis.main.existingSecretKeys.sentinelUrl.
• Updated default value front.nginx.resources from {"requests":{"cpu":"200m","memory":"500Mi"}} to {"requests":{"cpu":"100m","memory":"200Mi"}}

2024.6.0 vs 2024.5.0

Updated:

• Added new task background_validity_check to celeryWorkers.long.queues.

2024.5.0 vs 2024.4.0

Upgrading to 2024.5

This release includes breaking changes.

New:

• Introduce externalSecrets.refreshIntervaloption to give the ability to customize the refresh interval for external secrets.
• Added istio.gateway.enabled parameter to be able to disable Istio Gateway handling when Istio is enabled.
• Added redis.main.existingSecretKeys.url and redis.main.existingSecretKeys.password.
• Added redis.commitCache.existingSecretKeys.url and redis.commitCache.existingSecretKeys.password.
• Added migration.labels and migration.podLabels for migrations resources.

Updated:

• Replaced postgresql.existingSecretKeys.tls with postgresql.tls.existingSecretKeys and set the Default to "" for
  • password instead of POSTGRES_PASSWORD.
  • crt instead of ``"pg_client.crt"`.
  • key instead of "pg_client.key".
  • caCrt instead of "pg_server.ca_crt".
• Replaced redis.main.existingSecretKeys.tls with redis.main.tls.existingSecretKeys and set the Default values to "" for
  • crt instead of ``"redis_client.crt"`.
  • key instead of "redis_client.key".
  • caCrt instead of "redis_server.ca_crt".
• Replaced redis.commitCache.existingSecretKeys.tls with redis.commitCache.tls.existingSecretKeys and set the Default values to "" for
  • crt instead of ``"redis_client.crt"`.
  • key instead of "redis_client.key".
  • caCrt instead of "redis_server.ca_crt".
• Rename celeryWorkers.realtime_ods to celeryWorkers.realtime-ods.
• Set the Default for miscEncryption.existingSecretKeys attributes to "" for
  • djangoSecretKey instead of "DJANGO_SECRET_KEY".
  • dbEncryptionKeys instead of "ENCRYPTION_KEYS".
  • x509Cert instead of "SP_X509_CERT".
  • x509PrivateKey instead of "SP_PRIVATE_KEY".
• Added "existingSecret":"","existingSecretKeys":{"password":""} in onPrem.adminUser offering the option to specify the admin password in a secret.
• Rename Default value for tls.customCa.existingSecretCaCertKey to "ca.crt" instead of "custom-ca.pem".
• Added report to celeryWorkers.worker.queues.

Removed:

• Removed argoCd.enabled originally used to inject Argo CD phase annotations in Kubernetes resources but, since Argo CD supports Helm hooks annotations by mapping them onto its own hook annotations, it is not used anymore in 2024.5.0.

2024.4.0 (Required) vs 2024.3.0

New:

• Added commonLabels to add custom labels to differentiate multiple GitGuardian deployments within the same Kubernetes cluster.
• Introduce ephemeralStorage option for all celeryWorkers to support Generic Ephemeral Inline Volumes.
• Introduced new celeryWorkers.realtime-ods worker for Other Data Sources (ODS) real time scanning.

Updated:

• Modified celeryWorkers.worker.queues and moved realtime_ods,realtime_retry_ods tasks into new celeryWorkers.realtime-ods.queue.

2024.3.0 vs 2024.2.0

Updated:

• Decreased the default value of celeryWorkers.scanners_ods.replicas from 2 to 0.

2024.2.0 vs 2024.1.0

New:

• Added redis.main.sentinel configuration options for managing Redis Sentinel settings.
• Introduced new settings for redis.main.existingSecretKeys.sentinel.url and redis.main.existingSecretKeys.sentinel.password.
• Added miscEncryption.dbEncryptionKeys and miscEncryption.existingSecretKeys.dbEncryptionKeys for database encryption key management.
• Introduced new celeryWorkers.scanners_ods worker for Other Data Sources (ODS) scanning.

Removed:

• Removed observability.exporters.celeryExporter.

2024.1.0 (Required) vs 2023.12.0

New:

• Expanded nodeSelector and tolerations settings across multiple services: front.nginx, webapps.internal_api, webapps.internal_api_long, webapps.public_api, webapps.hook, webapps.app_exporter, celeryWorkers.worker, celeryWorkers.email, celeryWorkers.scanners, and celeryWorkers.long.
• New replicated.isAirgap setting to manage air-gapped environments.
• Introduced tls.customCa.image configuration for custom CA management.
• Added new settings related to Kubernetes Roles and RoleBindings: rbac.enabled, serviceAccount.create, serviceAccount.name, migration.serviceAccount.create, and migration.serviceAccount.name.

Updated:

• Added new tasks realtime_ods,realtime_retry_ods to celeryWorkers.worker.queues to support additional task types.
• Enabled experimental.chainguard by default, changing from false to true, to utilize Chainguard images for backend and frontend services.