Helm

Kargo v1.12.0

Kargo v1.12.0 removes the Connect-based gRPC API, the createTargetBranch option on git-open-pr, and the author block on git-commit. It changes the git-push default integration policy to RebaseOrMerge and removes the legacy Secret namespace chart values, so upgrades that still set them will fail. The release also adds a tar step, an oci-push srcPath option, cross-account ECR pulls, and per-request actor attribution in API logs.

platform teams Platform teams upgrading Kargo must check integrations for the removed gRPC API, remove deprecated step fields from promotion tasks, and confirm required Secrets exist in the system and shared resources namespaces before upgrading. Teams relying on rebase-only pushes should set pushIntegrationPolicy to AlwaysRebase in Helm values to keep the old behavior.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !·The Connect-Based (gRPC) API Has Been Removed (#6617): As announced in the v1.9.0 release notes and reiterated in the v1.11.0 release notes, the Connect-based gRPC API is gone. The UI completed its migration to the REST API in v1.11.0, so the legacy API had no first-party consumers left. If you maintain integrations built against it, migrate them to the REST API before upgrading. Upgrade the CLI to v1.12.0 alongside your server -- older CLIs may still reach for endpoints that no longer exist.other / breaking
• !·CreateTargetBranch Removed from the git-open-pr Step (#6916): Deprecated in v1.10.0, the createTargetBranch option has been removed. The feature never actually worked; see #5847 for the details. Remove the field from any promotion steps or promotion tasks that still set it.other / breaking
• !·Author Removed from the git-commit Step (#7314): Also deprecated in v1.10.0, the author block (name, email, and signingKey) has been removed from git-commit. Authorship and commit signing are configured once, on the git-clone step or in ClusterConfig, and apply to every commit made in that working tree. See the git-commit docs for details.other / breaking
• !·Git-push Defaults to RebaseOrMerge (#7319): As announced in v1.10.0, the default push integration policy for the git-push and github-push steps has changed from AlwaysRebase to RebaseOrMerge. Unconditionally rebasing onto a remote that has moved ahead rewrites commits, and rewriting a signed commit either strips its signature or re-signs it as someone else. RebaseOrMerge rebases only when it can tell that's safe and otherwise integrates with a merge commit. To keep the old behavior, set controller.gitClient.pushIntegrationPolicy: AlwaysRebase in your Helm values. See Push Integration Policy.other / breaking
• !!Legacy Secret Namespace Settings Now Fail the Upgrade (#7320): v1.9.0 replaced the "cluster secrets namespace" and "global credentials namespaces" with the system resources and shared resources namespaces, and shipped a controller that kept Secret s in sync between the old and new locations while you transitioned. That bridge is gone. The chart values global.clusterSecretsNamespace, global.createClusterSecretsNamespace, global.createClusterSecretsRBAC, and controller.globalCredentials.namespaces have been removed, and a helm install or helm upgrade that still sets either legacy namespace fails with a message explaining what to do. Before upgrading, confirm the Secret s you rely on already exist in the namespaces named by global.systemResources.namespace and global.sharedResources.namespace -- especially if you manage them with a GitOps agent, since Kargo will no longer copy them for you. See Migrating from Kargo < 1.9.0.security / breaking
• !·Image Creation Times Are Read Differently (#6777): Kargo previously preferred an image's org.opencontainers.image.created or org.label-schema.build-date label over the creation time recorded in its config. Labels are inherited from the base image unless a build overwrites them, so an image that sets no label of its own reported the build time of the image it was built from -- and every image built from the same base between two republishes of that base reported an identical time. With the NewestBuild image selection strategy, those ties fell back to reverse lexical tag order and were then truncated to discoveryLimit, so genuinely new images could go undiscovered rather than merely mis-ranked.other / breaking
• !Cross-Account ECR: Kargo can now pull image metadata from an Elastic Container Registry in a different AWS account than the controller's. Role assumption is attempted in order -- kargo-project-<project name> in the registry's account, then the same role in the controller's account, then the controller's own role -- so Project-level isolation is preserved instead of silently collapsing to a shared role. (docs,security
• !Who Did That?: Every API server request log line now names its actor -- admin, email:..., or kubernetes:system:serviceaccount:... -- in the same form already used to attribute Promotions and events. API tokens leave a trail too: a new token's Secret is annotated with who minted it, and APITokenCreated and APITokenDeleted events record the token's name, Role, and actor. (docs,security
• +Package and Push Local Artifacts: The new tar step archives a file or directory from the promotion workspace (gzipped by default), and the oci-push step gained a srcPath option that uploads a local file as a proper OCI 1.1 artifact -- streamed from disk, with a top-level artifactType mirrored onto the config media type for Flux, Helm, and ORAS compatibility. Together they close the loop: render manifests during a promotion, package them, and publish them to a registry for a GitOps agent to sync. (#6666,added
• +Http Step Bodies from Files: A new bodyFromFile option takes the request body from a path in the promotion work directory, so a payload produced by an earlier step no longer has to be squeezed through an inline expression. Mutually exclusive with body. (docs,added
• +Clean Up After git-merge-pr: Pipelines that chain git-open-pr and git-merge-pr leave a kargo/promotion/<promotion name> branch behind for every promotion, and GitHub's "automatically delete head branches" setting ignores merges performed with a GitHub App installation token -- which is how Kargo authenticates when given GitHub App credentials. A new deleteSourceBranch option deletes the PR's source branch after a successful merge, on every supported provider. Because the merge is the step's real job, a failed deletion is reported in the step's message rather than failing the step. (docs,added
• +RepoCredentials() Expression Function: secret() returns the raw contents of a Secret selected by name, which is no help when the credentials you actually need are minted on the fly -- a GitHub App installation token, say, or a cloud provider's ambient credentials. The new repoCredentials(repoURL, type) function resolves credentials for a Git, Helm, or image repository by URL through the same machinery built-in steps like git-clone use, returning a username, password, and sshPrivateKey. Custom and generic steps, such as an http step calling a provider's API, can finally authenticate the way built-in steps do. (docs,added

• ~Primarily dependency updates and k8s-io group to 0.37.0changed
• ~Bump version to 3.22 (#32606) b5de8bbe62975c8f9d4801fd7dfafacff462209f (Scott Rigby)changed
• ~[dev-v3 backport] deps: bump google.golang.org/[email protected] for GO-2026-6061 (#32536) a442b8cf64f5942ca9e920b46fceb15e0878ca80 (Scott Rigby)changed
• ~Apply suggestions from code review 093015b3b7c466828d01697d4d3d8f4811c59942 (Benoit Tigeot)changed
• ~Fixes b7a0fd0ddc84fdfbf571486e5dac829bfb2bd78a (Matheus Pimenta)changed
• ~Update .github/env ceb9a62ec03c8d5aea94dee9c9456a7dfd89ba71 (Terry Howe)changed
• ~[v3] Bump to version v3.21 (#32103) 3033a778b611b7501dffae7bd57c071dde318b6c (George Jenkins)changed
• ~[v3 backport] Fix rollback for missing resources 0a4757359edcdfaad2e19e8ee3518188bd3cfa1b (Feruzjon Muyassarov)changed
• *Set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) 9dbcb9f1edb4cdf2b055870dc9a07e0c0f4b05d1 (kimsungmin1)fixed
• *Bump go.opentelemetry.io/[email protected] for GO-2026-5158 (#32535) adab0ef15d40085b4ddad4334418dc1bf41c85c7 (Scott Rigby)fixed
• *Migrate to ProtonMail/go-crypto to resolve GO-2026-5932 bd392c6a60d09a6c9f467dc52dbfd249a641f80d (Karan V)fixed
• *Prevent Files.Lines panic on empty file c02a9aed3452c0c7ee9d79ded44dd170ce5001ca (Mahesh Sadupalli)fixed

• ~Fix (internal/plugin): remove zero-width spaces from plugin name commentchanged
• ~Enable concurrent status computation to prevent multi-minute delayschanged
• ~Bump version to 4.3 (#32605) 7328f42a01d7fb96bd41b8fc70abc1fd7258cdb5 (Scott Rigby)changed
• ~Remove deprecated internal/chart/v3/ code (#32365) 4dfbaa40c6cd67e1df345889113a7879ec66136c (George Jenkins)changed
• ~Updating the Go version b5b498b77403f93de037cba383f424953e87eaaa (Matt Farina)changed
• ~Updating the Go version 6d1f67cf6a9918ebe6c41f05096b6fa3fdde1b5b (Matt Farina)changed
• ~Make golangci-lint happy f3edb83df48c505878ffd3ebb89ef6a809e14008 (MrJack)changed
• ~Added missing import 94a3315f4d699c6bb4140550d4c98b46bb4382d2 (MrJack)changed
• ~Readded "unicode/utf8" 500f02d597628d8ca7be8b530edcbedbf397b676 (MrJack)changed
• ~Potential fix for pull request finding f1ede7c9c114c745da2f5c6cef8d27e1eb342498 (MrJack)changed
• ~Apply suggestions from code review 4fcc4e4b3db363654f3dd5240211b195e309970e (MrJack)changed
• ~Removed extra space in rollback-with-description.txt b177a8e9060720e91c402cdba2224c6d58789fa3 (MrJack)changed