Release v6.1.0-rc.6

APL v6.1.0 enables upgrades from APL v5.1.0 to the v6.1.x release line. This release modernizes core platform components and introduces significant changes to secrets.

Upgrade

The automated upgrade procedure migrates SOPS encrypted data to SealedSecrets.

⚠️ Before the upgrade, annotate apl-operator deployment:

kubectl annotate deployment apl-operator argocd.argoproj.io/sync-options=Force=true,Replace=true -n apl-operator

Core application changes

App Name	Old Version	New Version	Notes
argocd	9.5.17	9.7.1	Updated
cert-manager	v1.20.2	v1.20.3	Updated
cloudnative-pg	0.28.2	0.28.3	Updated
external-secrets	2.4.1	2.7.0	Updated
istio-base	1.29.2	1.30.2	Updated
istio-cni	1.29.2	1.30.2	Updated
istio-gateway	1.29.2	1.30.2	Updated
istiod	1.29.2	1.30.2	Updated
keycloak	7.1.11	7.2.0	Updated
knative-operator	v1.22.1	v1.22.2	Updated
kserve	v0.16.0	v0.19.0	Updated
kserve-crd	v0.16.0	v0.19.0	Updated
kube-prometheus-stack	85.4.0	86.3.2	Updated
loki	6.55.0	17.4.11	Updated
metrics-server	3.13.0	3.13.1	Updated
oauth2-proxy	10.6.0	10.7.0	Updated
otel-operator	0.113.1	0.117.0	Updated
prometheus-blackbox-exporter	11.10.0	11.15.1	Updated
sealed-secrets	2.18.5	2.18.6	Updated
ztunnel	1.29.2	1.30.2	Updated

What's Changed

• ci: add dummy gh workflows by @j-zimnowoda in #3310
• feat: update disaster recovery flow for passwords by @ferruhcihan in #3296
• fix: error handling in helm cleanup by @merll in #3311
• chore(chart-deps): update external-secrets to version 2.5.0 by @svcAPLBot in #3253
• chore(chart-deps): update argocd to version 9.5.19 by @svcAPLBot in #3315
• chore(chart-deps): update prometheus-blackbox-exporter to version 11.11.0 by @svcAPLBot in #3317
• chore(chart-deps): update sealed-secrets to version 2.18.6 by @svcAPLBot in #3270
• fix: skip validation on additional values by @merll in #3320
• fix: enhance condition for restart of argocd controller by @merll in #3313
• ci: upgrade helmfile action to solve installation issues by @merll in #3326
• chore(deps): bump the npm-dependencies group with 2 updates by @dependabot[bot] in #3324
• fix: create argocd redis secret as needed by @merll in #3314
• chore(chart-deps): update argocd to version 9.5.20 by @svcAPLBot in #3321
• refactor: move team prometheus values to gotmpl values file by @j-zimnowoda in #3319
• fix: Loki volume access without object storage by @merll in #3328
• fix: prefer internal repo url on gitops applications in dev mode by @merll in #3329
• fix: replace team names for avoiding variable name issues by @merll in #3330
• chore: post release changelog 5.1.0 by @merll in #3323
• chore(chart-deps): update argocd to version 9.5.21 by @svcAPLBot in #3335
• chore(chart-deps): update cloudnative-pg to version 0.28.3 by @svcAPLBot in #3331
• fix: added authorization policies per team to per-team deployed apps by @merll in #3325
• ci: add supported lkee versions by @j-zimnowoda in #3344
• ci: bump minor version by @j-zimnowoda in #3343
• chore: add peer entries inserted by npm install by @merll in #3338
• chore: ADR about authentication and podLabel usage by @j-zimnowoda in #3342
• fix: prometheus exporter scrape targets by @merll in #3340
• chore(chart-deps): update kserve to version v0.18.0 by @svcAPLBot in #3248
• chore(chart-deps): update prometheus-blackbox-exporter to version 11.12.0 by @svcAPLBot in #3346
• fix: gitea credentials independent from git credentials by @j-zimnowoda in #3341
• chore(deps): bump the npm-dependencies group with 10 updates by @dependabot[bot] in #3348
• fix: remove sealedsecrets link by @merll in #3349
• chore(chart-deps): update kube-prometheus-stack to version 86.2.3 by @svcAPLBot in #3350
• chore(chart-deps): Update Loki to 17.1.6 (community chart) by @merll in #3304
• chore(chart-deps): update loki to version 17.4.3 by @svcAPLBot in #3351
• chore(chart-deps): update keycloak to version 7.2.0 by @svcAPLBot in #3278
• chore(chart-deps): update metrics-server to version 3.13.1 by @svcAPLBot in #3336
• chore(chart-deps): update otel-operator to version 0.115.0 by @svcAPLBot in #3337
• chore(chart-deps): update loki to version 17.4.4 by @svcAPLBot in #3353
• fix: do not overwrite Dockerfile entrypoint by @j-zimnowoda in #3360
• feat: set user and group ids that are matching security context [TOOLS][MAJOR] by @j-zimnowoda in #3357
• ci: prevent RCE in GH actions by @j-zimnowoda in #3300
• chore: tools version by @j-zimnowoda in #3361
• chore(chart-deps): update loki to version 17.4.9 by @svcAPLBot in #3369
• chore(chart-deps): update kube-prometheus-stack to version 86.3.2 by @svcAPLBot in #3368
• feat: generate team loki password by @j-zimnowoda in #3363
• chore(chart-deps): update prometheus-blackbox-exporter to version 11.13.0 by @svcAPLBot in #3365
• chore(chart-deps): update loki to version 17.4.10 by @svcAPLBot in #3376
• fix: remove obsolete configuration from team values by @merll in #3378
• fix: added additional defaults for template by @merll in #3379
• chore(chart-deps): update loki to version 17.4.11 by @svcAPLBot in #3380
• chore(chart-deps): update otel-operator to version 0.117.0 by @svcAPLBot in #3381
• fix: consolidate git credential management by @merll in #3358
• feat: insert defaults into initial secret by @merll in #3384
• feat: add git clone cmd by @j-zimnowoda in #3392
• ci: apl chart image repository overwrite by @j-zimnowoda in #3394
• fix: push on initial install and encode credentials by @merll in #3395
• docs: add ADR about the manifests directory by @j-zimnowoda in #3383
• ci: add new lke version by @j-zimnowoda in #3393
• chore: remove unused variables from chart by @merll in #3385
• feat: configurable intervals and timouts by @j-zimnowoda in #3359
• fix: templating values for multi-tenant grafana by @j-zimnowoda in #3404
• feat: disable automatic sealing key renewal by @j-zimnowoda in #3403
• chore: adr about platform secrets by @j-zimnowoda in #3410
• chore: adr about gateway api by @j-zimnowoda in #3407
• chore: remove outdated line from adr by @merll in #3413
• chore(chart-deps): update prometheus-blackbox-exporter to version 11.15.1 by @svcAPLBot in #3409
• chore(chart-deps): update knative-operator to version v1.22.2 by @svcAPLBot in #3333
• chore(chart-deps): update external-secrets to version 2.6.0 by @svcAPLBot in #3322
• chore(chart-deps): update oauth2-proxy to version 10.7.0 by @svcAPLBot in #3327
• chore(chart-deps): update kserve to version v0.19.0 by @svcAPLBot in #3347
• chore(chart-deps): update cert-manager to version v1.20.3 by @svcAPLBot in #3390
• chore(chart-deps): update argocd to version 9.7.1 by @svcAPLBot in #3397
• chore(chart-deps): update istio to version 1.30.2 by @svcAPLBot in #3382
• chore(deps): bump helmfile/helmfile-action from 2.4.5 to 2.4.6 in the github-actions-dependencies group by @dependabot[bot] in #3401
• chore(chart-deps): update external-secrets to version 2.7.0 by @svcAPLBot in #3415
• ci: print DNS record on record creation failure by @j-zimnowoda in #3416
• fix: gotmplating for image repository property by @j-zimnowoda in #3412
• fix: set gitea password during migration by @merll in #3426
• ci: support worktree by @j-zimnowoda in #3425
• fix: decrypt values after clone and remove secrets from defaults by @merll in #3427
• ci: add BYO_GIT checkbox to the Deploy APL action by @j-zimnowoda in #3436
• fix: universal fallback mechanism to read git credentials by @j-zimnowoda in #3438
• ci: add HA control plane flag by @j-zimnowoda in #3442
• fix: repo URL fallback mechanism by @j-zimnowoda in #3444
• ci: gh actions to release code by @j-zimnowoda in #3308

Full Changelog: v6.0.0...v6.1.0-rc.6