From df1b1418dd5912716d8298b31b1e5eadbbc839d3 Mon Sep 17 00:00:00 2001 From: armory-astrolabe Date: Wed, 15 Jul 2026 13:18:30 +0000 Subject: [PATCH 1/3] chore(release): add release notes for 2.40.1 --- .../armoryspinnaker_v2-40-1.md | 193 ++++++++++++++++++ payload.json | 192 ++++++++--------- 2 files changed, 289 insertions(+), 96 deletions(-) create mode 100644 content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md diff --git a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md new file mode 100644 index 0000000000..47b1dd3799 --- /dev/null +++ b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md @@ -0,0 +1,193 @@ +--- +title: v2.40.1 Armory Continuous Deployment Release (Spinnaker™ v1.40.0) +toc_hide: true +version: +date: 2026-07-15 +description: > + Release notes for Armory Continuous Deployment v2.40.1. +--- + + + +## 2026/07/15 release notes + +>Note: If you experience production issues after upgrading Armory Continuous Deployment, roll back to a previous working version and report issues to [http://go.armory.io/support](http://go.armory.io/support). + +## Required Armory Operator version +{{% alert color="warning" title="Important" %}} +[Armory Operator]({{< ref "armory-operator" >}}) has been deprecated and will is considered EOL. Please migrate to the [Kustomize]({{< ref "armory-operator-to-kustomize-migration" >}}) method of deployment. +{{% /alert %}} + +To install, upgrade, or configure Armory CD 2.40.1, use Armory Operator 1.8.6 or later. + +## Security + +Armory scans the codebase as we develop and release software. Contact your Armory account representative for information about CVE scans for this release. + +## Breaking changes + + +> Breaking changes are kept in this list for 3 minor versions from when the change is introduced. For example, a breaking change introduced in 2.21.0 appears in the list up to and including the 2.24.x releases. It would not appear on 2.25.x release notes. + +## Known issues + + +## Highlighted updates + + + + + + +### Spinnaker community contributions + +There have also been numerous enhancements, fixes, and features across all of Spinnaker's other services. See the +[Spinnaker v1.40.0](https://www.spinnaker.io/changelogs/1.40.0-changelog/) changelog for details. + +## Detailed updates + +### Bill Of Materials (BOM) + +
Expand to see the BOM +
+artifactSources:
+  dockerRegistry: docker.io/armory
+dependencies:
+  redis:
+    commit: null
+    version: 2:2.8.4-2
+services:
+  clouddriver:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  deck:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  dinghy:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  echo:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  fiat:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  front50:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  gate:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  igor:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  kayenta:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  monitoring-daemon:
+    commit: null
+    version: 2.26.0
+  monitoring-third-party:
+    commit: null
+    version: 2.26.0
+  orca:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  rosco:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+  terraformer:
+    commit: e099cb401ee08c956cd23ff1871e2d403263f479
+    version: 2.40.1
+timestamp: "2026-07-15 12:34:36"
+version: 2.40.1
+
+
+
+ +### Armory + + +#### Armory Clouddriver - 2.40.0...2.40.1 + + +#### Armory Terraformer - 2.40.0...2.40.1 + + +#### Armory Igor - 2.40.0...2.40.1 + + +#### Armory Echo - 2.40.0...2.40.1 + + +#### Armory Rosco - 2.40.0...2.40.1 + + +#### Armory Dinghy - 2.40.0...2.40.1 + + +#### Armory Deck - 2.40.0...2.40.1 + + +#### Armory Front50 - 2.40.0...2.40.1 + + +#### Armory Orca - 2.40.0...2.40.1 + + +#### Armory Fiat - 2.40.0...2.40.1 + + +#### Armory Gate - 2.40.0...2.40.1 + + +#### Armory Kayenta - 2.40.0...2.40.1 + + + +### Spinnaker + + +#### Spinnaker Clouddriver - 1.40.0 + + +#### Spinnaker Terraformer - 1.40.0 + + +#### Spinnaker Igor - 1.40.0 + + +#### Spinnaker Echo - 1.40.0 + + +#### Spinnaker Rosco - 1.40.0 + + +#### Spinnaker Dinghy - 1.40.0 + + +#### Spinnaker Deck - 1.40.0 + + +#### Spinnaker Front50 - 1.40.0 + + +#### Spinnaker Orca - 1.40.0 + + +#### Spinnaker Fiat - 1.40.0 + + +#### Spinnaker Gate - 1.40.0 + + +#### Spinnaker Kayenta - 1.40.0 + + diff --git a/payload.json b/payload.json index bf96d3d7dc..2679e9f07a 100644 --- a/payload.json +++ b/payload.json @@ -2,153 +2,153 @@ "armoryServices": [ { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Orca", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Clouddriver", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Dinghy", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Terraformer", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Rosco", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Igor", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Clouddriver", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Echo", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Deck", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Rosco", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Echo", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Dinghy", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Fiat", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Deck", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", + "currentVersion": "2.40.1", "name": "Armory Front50", - "previousVersion": "2.38.0" + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Gate", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Orca", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Terraformer", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Fiat", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", - "name": "Armory Igor", - "previousVersion": "2.38.0" + "currentVersion": "2.40.1", + "name": "Armory Gate", + "previousVersion": "2.40.0" }, { "commitMessages": [], - "currentVersion": "2.39.0", + "currentVersion": "2.40.1", "name": "Armory Kayenta", - "previousVersion": "2.38.0" + "previousVersion": "2.40.0" } ], - "armoryVersion": "2.39.0", + "armoryVersion": "2.40.1", "ossServices": [ { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Orca", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Clouddriver", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Dinghy", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Terraformer", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Rosco", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Igor", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Clouddriver", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Echo", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Deck", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Rosco", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Echo", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Dinghy", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Fiat", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Deck", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", + "currentVersion": "1.40.0", "name": "Spinnaker Front50", - "previousVersion": "1.38.0" + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Gate", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Orca", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Terraformer", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Fiat", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", - "name": "Spinnaker Igor", - "previousVersion": "1.38.0" + "currentVersion": "1.40.0", + "name": "Spinnaker Gate", + "previousVersion": "1.40.0" }, { "commitMessages": [], - "currentVersion": "1.39.0", + "currentVersion": "1.40.0", "name": "Spinnaker Kayenta", - "previousVersion": "1.38.0" + "previousVersion": "1.40.0" } ], - "ossVersion": "1.39.0", + "ossVersion": "1.40.0", "prerelease": false, "stack": { "artifactSources": { @@ -162,40 +162,40 @@ }, "services": { "clouddriver": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "deck": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "dinghy": { - "commit": "babaa4704f1df8a6f6b42e533716396c8a0f529b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "echo": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "fiat": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "front50": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "gate": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "igor": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "kayenta": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "monitoring-daemon": { "commit": null, @@ -206,19 +206,19 @@ "version": "2.26.0" }, "orca": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "rosco": { - "commit": "8f40c99bd0979c73db2c003b9dccc00dd960551b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" }, "terraformer": { - "commit": "babaa4704f1df8a6f6b42e533716396c8a0f529b", - "version": "2.39.0" + "commit": "e099cb401ee08c956cd23ff1871e2d403263f479", + "version": "2.40.1" } }, - "timestamp": "2026-06-19 19:27:18", - "version": "2.39.0" + "timestamp": "2026-07-15 12:34:36", + "version": "2.40.1" } } \ No newline at end of file From 2dda0202b1012e0eb26f162577408d3fdfeed163 Mon Sep 17 00:00:00 2001 From: christosarvanitis Date: Wed, 15 Jul 2026 16:37:07 +0300 Subject: [PATCH 2/3] Updating release notes 2.40.1 --- config.toml | 12 +- .../armoryspinnaker_v2-40-1.md | 357 ++++++++++++++++-- 2 files changed, 327 insertions(+), 42 deletions(-) diff --git a/config.toml b/config.toml index 2a4bb58e86..8d4c4ef97c 100644 --- a/config.toml +++ b/config.toml @@ -199,7 +199,7 @@ terms_and_conditions = "https://www.armory.io/terms-and-conditions/" # Menu title if your navbar has a versions selector to access old versions of your site. # This menu appears only if you have at least one [params.versions] set. -version_menu = "Armory CD v2.39" +version_menu = "Armory CD v2.40" # Flag used in the "version-banner" partial to decide whether to display a # banner on every page indicating that this is an archived version of the docs. @@ -210,7 +210,7 @@ archived_version = false # Used in the "version-banner" partial to display a version number for the # current doc set. # Also used in the PCM to highlight what version the PCM is for -version = "2.39.x" +version = "2.40.x" # A link to latest version of the Armory CD docs. Used in the "version-banner" partial to # point people to the main Armory CD docs site. @@ -331,13 +331,13 @@ theme = "forest" # at the top of the website. [[params.versions]] - version = "Armory CD v2.38" - githubbranch = "v2.38" + version = "Armory CD v2.39" + githubbranch = "v2.39" url = "https://docs.armory.io/continuous-deployment/" [[params.versions]] - version = "Armory CD v2.36" - githubbranch = "v2.36" + version = "Armory CD v2.38" + githubbranch = "v2.38" url = "https://docs.armory.io/continuous-deployment/" diff --git a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md index 47b1dd3799..0444bf5848 100644 --- a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md +++ b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md @@ -1,17 +1,12 @@ --- -title: v2.40.1 Armory Continuous Deployment Release (Spinnaker™ v1.40.0) +title: v2.40.1 Armory Continuous Deployment Release Feature (Spinnaker™ v2026.2.2) toc_hide: true -version: +version: 2.40.1 date: 2026-07-15 description: > Release notes for Armory Continuous Deployment v2.40.1. --- - - ## 2026/07/15 release notes >Note: If you experience production issues after upgrading Armory Continuous Deployment, roll back to a previous working version and report issues to [http://go.armory.io/support](http://go.armory.io/support). @@ -28,28 +23,277 @@ To install, upgrade, or configure Armory CD 2.40.1, use Armory Operator 1.8.6 or Armory scans the codebase as we develop and release software. Contact your Armory account representative for information about CVE scans for this release. ## Breaking changes - > Breaking changes are kept in this list for 3 minor versions from when the change is introduced. For example, a breaking change introduced in 2.21.0 appears in the list up to and including the 2.24.x releases. It would not appear on 2.25.x release notes. +### Gate: Spring Security 5 Oauth2 Migration +Armory CD 2.38.0 removes deprecate Oauth2 annotations and uses Spring Security 5 DSL. In order to configure oauth2 in `gate-local.yml` have changed to: + +## Google Oauth configuration +```yaml +spring: + security: + oauth2: + client: + registration: + google: + client-id: + client-secret: + authorization-grant-type: authorization_code + redirect-uri: "https:///login/oauth2/code/google" + scope: profile,email,openid + client-name: google + provider: + google: + authorization-uri: https://accounts.google.com/o/oauth2/auth + token-uri: https://oauth2.googleapis.com/token + user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo + user-name-attribute: sub +``` +## Github Oauth2 configuration +```yaml +spring: + security: + oauth2: + client: + registration: + userInfoMapping: + email: email + firstName: '' + lastName: name + username: login + github: + client-id: + client-secret: + authorization-grant-type: authorization_code + redirect-uri: "https:///login/oauth2/code/github" + scope: user,email + client-name: github + provider: + github: + authorization-uri: https://github.com/login/oauth/authorize + token-uri: https://github.com/login/oauth/access_token + user-info-uri: https://api.github.com/user + user-name-attribute: login +``` + +### Orca: Tasks configuration changes +The following configuration properties have been restructured in `orca-local.yml`: + +Previous Configuration: + +```yaml +tasks: + days-of-execution-history: + number-of-old-pipeline-executions-to-include: +``` + +New configuration format + +```yaml +tasks: + controller: + days-of-execution-history: + number-of-old-pipeline-executions-to-include: + optimize-execution-retrieval: + max-execution-retrieval-threads: + max-number-of-pipeline-executions-to-process: + execution-retrieval-timeout-seconds: +``` + +These changes improve query performance and execution retrieval efficiency, particularly for large-scale pipeline applications. + +### Policy Engine (OPA) is now built into Armory CD + +The Policy Engine is now built into the Armory CD distribution. The `Armory.PolicyEngine` plugin and the `armory.opa` configuration block are replaced by a native `armory.policy-engine` block. Remove the `Armory.PolicyEngine` plugin from `spinnaker.extensibility.plugins` in every service that had it configured and update the configuration block in `clouddriver-local.yml`, `front50-local.yml`, and any other service profile that references OPA: + +Previous: +```yaml +armory: + opa: + enabled: true + url: http://opa-server.opa:8181/v1 +``` + +New: +```yaml +armory: + policy-engine: + enabled: true + baseurl: http://opa-server.opa:8181/v1 +``` + +The OPA server deployment and policies are unchanged. + +### Kubernetes Agent (Kubesvc) is now built into Armory CD + +The Scale Agent plugin (`Armory.Kubesvc`) is now built into the Armory CD Clouddriver image. The plugin, its repository, and the top-level `kubesvc:` configuration block must be replaced by the native `armory.kubesvc:` block in `clouddriver-local.yml`: + +Previous: +```yaml +kubesvc: + cluster: kubernetes + +spinnaker: + extensibility: + plugins: + Armory.Kubesvc: + enabled: true + version: 0.16.2 + extensions: + armory.kubesvc: + enabled: true + repositories: + armory-agent: + url: https://raw.githubusercontent.com/armory-io/agent-k8s-spinplug-releases/master/repositories.json +``` + +New: +```yaml +armory: + kubesvc: + enabled: true + cluster: kubernetes +``` + +All sub-properties (grpc, cache, heartbeat, operations, credentials) stay the same — only the parent key changes. Remove `Armory.Kubesvc` from `spinnaker.extensibility.plugins` and `armory-agent` from `spinnaker.extensibility.repositories`. The Armory Agent **service** deployed in target clusters is unchanged. + +### Spring Boot 3.5 upgrade + +Armory CD 2.40.1 upgrades to Spring Boot 3.5, the latest supported release. This is a major upgrade from Spring Boot 3.0 introduced in Armory CD 2.39.0. Plugins built against earlier Spring Boot versions will need to be updated to be compatible with this release. + +**Actuator metrics export property changes** (introduced in 2.39.0) + +If upgrading from a version prior to 2.39.0, note that the metrics export properties have moved: + +| Old Property Prefix | New Property Prefix | +|---------------------|---------------------| +| `management.metrics.export.` | `management..metrics.export` | + +**Gate session data cleanup** (introduced in 2.39.0) + +If upgrading from a version prior to 2.39.0, flush Gate's Redis session cache before upgrading: + +```bash +redis-cli keys "spring:session*" | xargs redis-cli del +``` + +### YAML parsing limits now configurable + +Starting with SnakeYAML 1.33, strict safety limits are enforced by default (`maxAliasesForCollections = 50`, `codePointLimit = 3145728`). These can cause large or alias-heavy YAML files such as Kubernetes manifests to fail. Two new properties allow operators to override these limits: + +```yaml +snakeyaml: + max-aliases-for-collections: 500 # default: 50 + code-point-limit: 10485760 # default: 3145728 +``` + +### Docker images moved to GHCR + +Spinnaker and Armory CD images are no longer published to Google Artifact Registry (GAR). All images now pull from GitHub Container Registry (GHCR) at `ghcr.io/spinnaker/`. Update any allowlists, pull-through mirrors, or image references in your deployment configuration before upgrading. + +### Halyard fully deprecated + +Halyard is no longer supported and will not receive patches or updates. Migrate to [spinnaker-kustomize](https://github.com/spinnaker/spinnaker-kustomize-patches) or a similar implementation. + +### MySQL 8+ now required + +Due to recent SQL library upgrades, MySQL 5.7 is no longer supported and will fail on startup. You must be running MySQL 8.0+ or an equivalent MariaDB version before upgrading to Armory CD 2.40.1. + +### AWS SDK v1 deprecated + +AWS SDK v2 support has been introduced across Spinnaker services. AWS SDK v1 is expected to be removed in an upcoming release. If you have custom implementations using SDK v1, begin migrating to the v2 integrations now. + +### EDDA support removed + +EDDA is no longer supported and will be removed once the AWS SDK v2 migration is complete. If you rely on EDDA, contact the Spinnaker Slack community before upgrading. + +### URL trailing-slash handling changed + +Due to Spring Boot changes, a new filter has been added that restores lenient handling of trailing slashes. If you have controllers (in plugins or custom code) that only register a trailing-slash route, those controllers may break. You can adjust or disable this filter per service: + +```yaml +url-handler: + trailing-slash: + enabled: true # set false to opt out + path-patterns: + - "/**" # narrow if desired +``` + +It is recommended to update any affected controllers to handle both paths with and without a trailing slash. + ## Known issues - + +No known issues at this time. ## Highlighted updates - +### Gate: API token authentication + +Spinnaker now supports first-class, revocable API tokens for authenticating programmatic requests against Gate. Tokens are minted, listed, and revoked through a new self-service UI in Deck, persisted in Redis by Gate, and resolved on every inbound request by a dedicated Spring Security chain. + +The feature is **off by default**. To enable, add the following to your `gate-local.yml`: + +```yaml +api-tokens: + enabled: true +``` + +Key capabilities: +- **Per-credential revocation** — revoking one token does not affect other tokens for the same user or service account +- **Bounded lifetime** — user tokens always expire; admin-tunable max lifetimes (90 days for users, 365 days for service accounts by default) +- **IAP-compatible** — tokens use the `X-Spinnaker-Token: spk_…` header, which flows cleanly through GCP IAP +- **Operator observability** — a new `gate.requests` counter tagged with `authType`, `principalKind`, `method`, `statusCode`, and `status` + +### ECS: Major performance improvements + +ECS caching agents have been migrated to AWS SDK v2 and significantly optimized. Previously, several agents loaded all data for all accounts into memory before filtering. These agents now load only the data relevant to the requested account, significantly reducing memory footprint and database throughput for deployments with large numbers of ECS accounts. + +### Microsoft Teams: Jinja template support +The Microsoft Teams notification integration now uses configurable Jinja templates to determine notification payloads, replacing the previously hardcoded message format. Two templates are provided out of the box and can be overridden: +- `event-notification.jinja` +- `pipeline-notification.jinja` +To override with custom templates, set the template path in your `echo-local.yml`: + +```yaml +microsoftteams: + enabled: true + templatePath: /opt/spinnaker/config/teams-templates +``` + +**Note:** `status` is now a required field on pipeline notification templates. Users on legacy Outlook webhook endpoints will receive deprecation warnings in logs — see the [migration guide](https://github.com/jasonmcintosh/spinnaker/blob/179e86695004fc8ec6c41ccc5b848a59a2154af1/echo/echo-notifications/src/main/resources/templates/microsoftteams/MIGRATION_GUIDE.md) for details. + +### Igor: Jenkins job cancellation + +When a Spinnaker pipeline is cancelled, any associated Jenkins job triggered by that pipeline is now also cancelled automatically. + +### Webhooks: Stage timeout support + +Webhook stages now respect the overridden `stageTimeoutMs` value set on the stage configuration. Previously this value was ignored, causing webhook stages to run until the global timeout elapsed. + +### AWS SDK v2: Credentials bridge for non-AWS environments + +The AWS SDK v2 credential path now bridges v1 credentials to v2, fixing credential discovery in non-AWS environments such as GKE pods using STS assume-role. Previously the v2 path used `DefaultCredentialsProvider` which could not discover credentials in these environments. All configured v1 `AWSCredentialsProvider` instances (including STS assume-role with token refresh) are now adapted for use by the v2 SDK. ### Spinnaker community contributions There have also been numerous enhancements, fixes, and features across all of Spinnaker's other services. See the -[Spinnaker v1.40.0](https://www.spinnaker.io/changelogs/1.40.0-changelog/) changelog for details. +[Spinnaker 2026.2.2](https://www.spinnaker.io/changelogs/2026.2.2-changelog/) changelog for details. + +Notable upstream changes included in this release span OSS versions 2026.2.0 through 2026.2.2: +- Spring Boot upgraded to 3.5 (latest supported release) +- Gradle 8 upgrade +- UI build system migrated from yarn/npm to pnpm +- ECS caching agents migrated to AWS SDK v2 +- API token authentication support added to Gate +- Microsoft Teams Jinja template notifications +- Jenkins job cancellation on pipeline cancel +- Webhook stage timeout now respected +- CVE dependency upgrades (2026.2.2) +- Kayenta stage UI formatting fix (2026.2.2) ## Detailed updates @@ -117,77 +361,118 @@ version: 2.40.1 #### Armory Clouddriver - 2.40.0...2.40.1 +- fix(perf): ECS loaded ALL data for ALL accounts then filtered ([#7672](https://github.com/spinnaker/spinnaker/pull/7672)) +- feat(ecs): migrate ECS caching agents to AWS SDK v2 ([#7742](https://github.com/spinnaker/spinnaker/pull/7742)) +- fix(docker): Fixes an issue with RBAC around docker images ([#7746](https://github.com/spinnaker/spinnaker/pull/7746)) +- feat(aws): make AmazonClientProvider bilingual (v1 + v2 SDK) ([#7705](https://github.com/spinnaker/spinnaker/pull/7705)) -#### Armory Terraformer - 2.40.0...2.40.1 +#### Armory Dinghy - 2.40.0...2.40.1 -#### Armory Igor - 2.40.0...2.40.1 +#### Armory Rosco - 2.40.0...2.40.1 -#### Armory Echo - 2.40.0...2.40.1 +#### Armory Deck - 2.40.0...2.40.1 -#### Armory Rosco - 2.40.0...2.40.1 +- feat(api-tokens): add API token authentication support UI -#### Armory Dinghy - 2.40.0...2.40.1 +#### Armory Echo - 2.40.0...2.40.1 +- feat(teams): Allow adaptive and custom templates for MS Teams messages using Jinja ([#7741](https://github.com/spinnaker/spinnaker/pull/7741)) +- feat(echo): add trace hierarchy, stage names and customData promotion to OTLP CDEvents spans -#### Armory Deck - 2.40.0...2.40.1 + +#### Armory Fiat - 2.40.0...2.40.1 #### Armory Front50 - 2.40.0...2.40.1 -#### Armory Orca - 2.40.0...2.40.1 +#### Armory Gate - 2.40.0...2.40.1 +- feat(api-tokens): add API token authentication support ([#7683](https://github.com/spinnaker/spinnaker/pull/7683)) +- fix(mvc): UrlHandlerFilter to trailing slash handle route matching ([#7755](https://github.com/spinnaker/spinnaker/pull/7755)) -#### Armory Fiat - 2.40.0...2.40.1 +#### Armory Terraformer - 2.40.0...2.40.1 -#### Armory Gate - 2.40.0...2.40.1 + +#### Armory Igor - 2.40.0...2.40.1 + +- fix(jenkins): cancel Jenkins job when Spinnaker pipeline is cancelled ([#7752](https://github.com/spinnaker/spinnaker/pull/7752)) #### Armory Kayenta - 2.40.0...2.40.1 +- fix(kayenta): Fix kayenta stage UI formatting ([#7779](https://github.com/spinnaker/spinnaker/pull/7779)) + + +#### Armory Orca - 2.40.0...2.40.1 + +- fix(orca): Pipeline bulk save breaks with managed service accounts ([#7688](https://github.com/spinnaker/spinnaker/pull/7688)) +- chore(change): Fixes #7282: honor `stageTimeoutMs` in `CreateWebhookTask` ([#7689](https://github.com/spinnaker/spinnaker/pull/7689)) ### Spinnaker -#### Spinnaker Clouddriver - 1.40.0 +#### Spinnaker Clouddriver - 2026.2.2 + +- fix(perf): ECS loaded ALL data for ALL accounts then filtered ([#7672](https://github.com/spinnaker/spinnaker/pull/7672)) +- feat(ecs): migrate ECS caching agents to AWS SDK v2 ([#7742](https://github.com/spinnaker/spinnaker/pull/7742)) +- fix(docker): Fixes an issue with RBAC around docker images ([#7746](https://github.com/spinnaker/spinnaker/pull/7746)) +- feat(aws): make AmazonClientProvider bilingual (v1 + v2 SDK) ([#7705](https://github.com/spinnaker/spinnaker/pull/7705)) +- fix(aws): bridge v1 credentials to v2 in AmazonCredentials.getV2CredentialsProvider() ([#7766](https://github.com/spinnaker/spinnaker/pull/7766)) + + +#### Spinnaker Deck - 2026.2.2 + +- feat(api-tokens): add API token authentication support UI + +#### Spinnaker Echo - 2026.2.2 -#### Spinnaker Terraformer - 1.40.0 +- feat(teams): Allow adaptive and custom templates for MS Teams messages using Jinja ([#7741](https://github.com/spinnaker/spinnaker/pull/7741)) +- feat(echo): add trace hierarchy, stage names and customData promotion to OTLP CDEvents spans +- fix(echo): Fix Microsoft Teams webhook URL doubling in Retrofit2 migration ([#7718](https://github.com/spinnaker/spinnaker/pull/7718)) +- fix(echo): GitHub status conversion exception ([#7701](https://github.com/spinnaker/spinnaker/pull/7701)) -#### Spinnaker Igor - 1.40.0 +#### Spinnaker Fiat - 2026.2.2 -#### Spinnaker Echo - 1.40.0 +#### Spinnaker Front50 - 2026.2.2 -#### Spinnaker Rosco - 1.40.0 +#### Spinnaker Gate - 2026.2.2 +- feat(api-tokens): add API token authentication support ([#7683](https://github.com/spinnaker/spinnaker/pull/7683)) +- fix(mvc): UrlHandlerFilter to trailing slash handle route matching ([#7755](https://github.com/spinnaker/spinnaker/pull/7755)) -#### Spinnaker Dinghy - 1.40.0 +#### Spinnaker Igor - 2026.2.2 -#### Spinnaker Deck - 1.40.0 +- fix(jenkins): cancel Jenkins job when Spinnaker pipeline is cancelled ([#7752](https://github.com/spinnaker/spinnaker/pull/7752)) -#### Spinnaker Front50 - 1.40.0 +#### Spinnaker Kayenta - 2026.2.2 +- fix(kayenta): Fix kayenta stage UI formatting ([#7779](https://github.com/spinnaker/spinnaker/pull/7779)) +- chore(cves): Upgrade various deps based on security scans ([#7775](https://github.com/spinnaker/spinnaker/pull/7775)) -#### Spinnaker Orca - 1.40.0 +#### Spinnaker Orca - 2026.2.2 -#### Spinnaker Fiat - 1.40.0 +- fix(orca): Pipeline bulk save breaks with managed service accounts ([#7688](https://github.com/spinnaker/spinnaker/pull/7688)) +- chore(change): Fixes #7282: honor `stageTimeoutMs` in `CreateWebhookTask` ([#7689](https://github.com/spinnaker/spinnaker/pull/7689)) -#### Spinnaker Gate - 1.40.0 +#### Spinnaker Rosco - 2026.2.2 -#### Spinnaker Kayenta - 1.40.0 +#### Spinnaker Dinghy - 2026.2.2 +#### Spinnaker Terraformer - 2026.2.2 From a7c9e3b02dc87a493048df47840ec4f99982abc4 Mon Sep 17 00:00:00 2001 From: christosarvanitis Date: Wed, 15 Jul 2026 17:48:29 +0300 Subject: [PATCH 3/3] Updating release notes on 2.40.1 --- .../rn-armory-spinnaker/armoryspinnaker_v2-40-1.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md index 0444bf5848..e5ffb3a1da 100644 --- a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md +++ b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-1.md @@ -188,9 +188,9 @@ snakeyaml: code-point-limit: 10485760 # default: 3145728 ``` -### Docker images moved to GHCR +### OSS Spinnaker images moved to GHCR -Spinnaker and Armory CD images are no longer published to Google Artifact Registry (GAR). All images now pull from GitHub Container Registry (GHCR) at `ghcr.io/spinnaker/`. Update any allowlists, pull-through mirrors, or image references in your deployment configuration before upgrading. +OSS Spinnaker images are no longer published to Google Artifact Registry (GAR) and now pull from GitHub Container Registry (GHCR) at `ghcr.io/spinnaker/`. **Armory CD images continue to be published to Docker Hub** (`docker.io/armory`) and are unaffected. If you consume any OSS Spinnaker images directly alongside your Armory CD deployment, update those image references to point to GHCR before upgrading. ### Halyard fully deprecated @@ -200,6 +200,10 @@ Halyard is no longer supported and will not receive patches or updates. Migrate Due to recent SQL library upgrades, MySQL 5.7 is no longer supported and will fail on startup. You must be running MySQL 8.0+ or an equivalent MariaDB version before upgrading to Armory CD 2.40.1. +### Redis/Valkey 7+ now required + +Redis or Valkey 7.0+ is required for Armory CD 2.40.1. Older versions are not supported and may cause failures. Armory already deploys Redis 7+ by default — verify your Redis version before upgrading if you manage your own Redis instance. + ### AWS SDK v1 deprecated AWS SDK v2 support has been introduced across Spinnaker services. AWS SDK v1 is expected to be removed in an upcoming release. If you have custom implementations using SDK v1, begin migrating to the v2 integrations now. @@ -208,6 +212,10 @@ AWS SDK v2 support has been introduced across Spinnaker services. AWS SDK v1 is EDDA is no longer supported and will be removed once the AWS SDK v2 migration is complete. If you rely on EDDA, contact the Spinnaker Slack community before upgrading. +### Armory Scale Agent (Kubesvc) deprecation notice + +The Armory Scale Agent (Kubesvc) is planned for deprecation in the next major release of Armory CD. + ### URL trailing-slash handling changed Due to Spring Boot changes, a new filter has been added that restores lenient handling of trailing slashes. If you have controllers (in plugins or custom code) that only register a trailing-slash route, those controllers may break. You can adjust or disable this filter per service: