Release v1.12.0

[gianlucam76]

🚀 New Features

Supply Chain Verification for Helm Charts
Sveltos can now verify the integrity and origin of a Helm chart before deploying it, with two mechanisms targeting different chart sources. For charts pulled from OCI registries, Sveltos verifies the Cosign signature attached to the chart: a PublicKey provider checks it against a static key stored in a Kubernetes Secret, while a Keyless provider verifies the Fulcio-issued certificate against an expected OIDC issuer/subject and confirms the signing event was recorded in the Rekor transparency log, so the chart must have been signed by a specific pipeline in a specific repository. Both providers support the Sigstore Bundle v0.3 OCI referrer format and fall back to the legacy tag-based signature format. For charts pulled from HTTP repositories, Sveltos verifies the Helm .prov provenance file against a GPG keyring stored in a Secret. In both cases a failed verification blocks the deployment and the reason is recorded on the ClusterSummary status; charts without a verification field deploy as before.
PRs: addon-controller #1842, sveltos #753

Workload Identity Support
SveltosCluster now supports authenticating to a managed cluster using the cloud provider's native workload identity instead of a stored kubeconfig Secret: AWS (IRSA / EKS Pod Identity), GCP (Workload Identity Federation), and Azure (Azure Workload Identity). When configured, Sveltos obtains short-lived credentials directly from the cloud provider, caching them in-process and refreshing proactively before expiry. sveltosctl register cluster has been extended to configure workload identity when registering a cluster.
PRs: libsveltos #636, sveltosctl #434

OCI Support in PolicyRef
RemoteURL in PolicyRef now accepts oci:// URLs in addition to http:// and https://. Sveltos pulls the OCI artifact from the registry on each reconciliation at the configured interval, computes a content hash, and redeploys when the content changes, identical to the existing HTTP polling behavior. Authentication uses the same secretRef field, supporting a bearer token, basic auth, or a custom CA certificate. Both a tar archive (the standard ORAS/Flux format) and a raw YAML/JSON blob are supported as artifact layouts.
PR: addon-controller #1851

Classify Clusters from Management Cluster Resources
Classifier evaluates rules against resources inside each managed cluster, which leaves a gap when the classification signal instead lives on the management cluster itself, such as a Crossplane Composite Resource created when a team orders an addon on an Internal Developer Platform. A new ManagementClusterClassifier resource closes that gap: it watches resources on the management cluster and runs a Lua function that receives the full set of matched resources and returns which managed clusters should be labeled. A ManagementClusterClassifierReport tracks label ownership per classifier/cluster pair, giving the same conflict detection the existing Classifier provides.
PR: classifier #482

sveltosctl: show classifier-labels
A new sveltosctl show classifier-labels command displays the labels that Classifier and ManagementClusterClassifier instances are actively managing on each cluster, along with the name of the instance that owns each label.
PR: sveltosctl #437

---

⚙️ Improvements

sveltos-agent: Reduced Memory Usage in Agentless Mode
In agentless mode, each sveltos-agent instance runs in the management cluster and is responsible for a single managed cluster, but its controller-runtime cache had no namespace or label restrictions, so every agent's informer held HealthCheckReport, EventReport, and ConfigMap objects for all managed clusters, causing O(N) memory per agent and O(N²) total. The cache is now scoped per agent: HealthCheckReport and EventReport are restricted with a label selector matching the agent's cluster name and type, and the per-cluster ConfigMap is restricted with a field selector on its name.
PR: sveltos-agent #493

addon-controller: Condition-Based Wait for CRD Reapply
When a Helm chart is deployed with UpgradeCRDs: true, the controller used to sleep for 30 seconds after applying the chart's CRD files on every reconcile, regardless of whether the CRDs had actually changed, which was especially costly in ContinuousWithDriftDetection sync mode. The sleep is replaced with a poll against the destination cluster's CRD status, returning as soon as each CRD's Established and NamesAccepted conditions are true, effectively zero delay when CRDs are already established and no more than necessary for a genuine upgrade.
PR: addon-controller #1844

---

🐞 Bug Fixes

sveltos-agent: Reloader Feature Broken in Agentless Mode
In agentless mode, sveltos-agent watched every Reloader instance in the management cluster instead of only the subset belonging to its own managed cluster, and watched ConfigMap/Secret objects in the management cluster instead of the managed cluster. Both are now scoped correctly.
PR: sveltos-agent #494

addon-controller: Tier Change Not Triggering Takeover
Once a ClusterProfile was managing a chart, its tier was never compared against other conflicting profiles on later reconciliations, so raising a profile's tier above a challenger stuck in FailedNonRetriable never woke the challenger up. Tier comparison now runs on every reconcile even for the profile currently managing the chart, so a higher-tier challenger correctly reclaims it.
PR: addon-controller #1837

access-manager: Configurable Namespace
The Sveltos namespace was hardcoded to projectsveltos; this closes a gap missed in the previous release by allowing it to be configurable, part of the broader effort to remove that limitation across components.
PR: access-manager #348

classifier: Upgrade Blocked by Deleted Clusters
The migration init container that upgrades deprecated ClusterInfo entries into ClassifierReport objects would crash-loop and block the upgrade entirely if a managed cluster had been deleted before the upgrade, since its namespace no longer existed. Entries whose cluster namespace is gone are now logged at debug level and skipped, while all other entries migrate normally.
PR: classifier #480

sveltos-agent: Wait for Informer to Be Synced
In agentless mode, sveltos-agent can restart its internal controller-manager without a pod restart, for example when a managed cluster's kubeconfig token expires or a CRD change is detected. If an EventSource was evaluated in the window before the new informers had synced, it returned an empty result that was misread as zero matching resources, causing event-manager to delete previously created ClusterProfiles. An unsynced informer is now treated as a transient error and the evaluation is retried once the informers have synced.
PR: sveltos-agent #495

🔧 Maintenance

• All components advanced to Cluster API v1.13.3
• All components advanced to Kubernetes client-go v1.36.2