Allow exposing Cyberwatch via Gateway API with an HTTPRoute attached to an existing Gateway, configurable via httpRoute
A BackendTLSPolicy makes the Gateway validate the Nginx certificate
Requires the Gateway API CRDs in version 1.4 or later
The certificate presented by Nginx is now generated by Helm, signed by the internal certificate authority and with the Kubernetes service names in its SANs
A custom certificate can be provided via nginx.tls.existingSecret
Migration: the data-ssl volume is removed. A certificate manually placed in this volume must be provided via nginx.tls.existingSecret before the update
Allow setting the pods’ tolerations, globally via global.tolerations or per component (web.tolerations, etc.)
Add startup, liveness and readiness probes to all pods
Removed: the web.port variable is no longer used
Allow configuring the size of the database volume via database.storageSize (default 10Gi)
Migration: if the volume was manually expanded, fill in its current size
Restrict access to port 9222 of web-scanner to the sidekiq-master and sidekiq-node pods with a NetworkPolicy, configurable via webScanner.networkPolicy
Allow disabling privilege escalation for the sidekiq-node pod via sidekiqNode.allowPrivilegeEscalation (default true)
Disabling privilege escalation may alter the results of nmap scans
Create one cache volume per pod when container-scanner is deployed on several pods with global.storageClass
Add the standard Kubernetes app.kubernetes.io/* labels to resources
Fixed: volumes of disabled components are no longer created
Migration: disabling Elasticsearch deletes its volume during helm upgrade
Fixed startup of sidekiq-master with an external database or Redis without TLS
Fixed deletion of the cbw-root-ca-cert secret on every other upgrade on satellites
Fixed missing Redis volume in hostPath mode
0.6.9 (2026-06-19)
Allow setting the pods’ serviceAccountName, globally via global.serviceAccountName or per component (web.serviceAccountName, etc.)
Add the Kubernetes service names (nginx.<namespace>.svc and nginx.<namespace>.svc.<clusterDomain>) to the “Subject Alternative Names (SANs)” of the Nginx self-signed certificate for Gateway API compatibility
The cluster DNS suffix is configurable via internalCbw.nginx.tls.clusterDomain (default cluster.local)
Migration: an existing cbw-nginx-tls secret is not regenerated automatically. Delete it then run helm upgrade to obtain the new SANs
Change: use hostPort instead of Service.spec.externalIPs to expose the database and Redis to satellite nodes from a master node
The externalIPs field is deprecated since Kubernetes 1.36
Removed: the node.ip variable is no longer used
Fixed DNS discovery failures
Fixed DNS resolution in the web and sidekiq pods by lowering ndots to 1
Configurable via internalCbw.global.dns.ndots
Fixed mounting of the Redis data volume when TLS is not enabled
0.6.8 (2026-05-04)
Enable TLS for Nginx, Elasticsearch and Kibana
Enable user management in Kibana introduced in Cyberwatch 15.6
Change: Disable the web interface by default on satellite nodes
When nginx.limitToApi is not set, it defaults to true on satellite nodes and false on other nodes
nginx.limitToApi: false can still be set explicitly to re-enable the web interface on a satellite
Removed: the webScanner.web_scanner_api_key and webScanner.webScannerApiKeySecret variables are no longer used
0.6.7 (2026-03-23)
Add volume size configuration for elasticsearch with the elasticsearch.storageSize variable
Add environment variable configuration with *.env for the container-scanner and web-scanner pods
0.6.6 (2026-03-06)
Elasticsearch data is now persistent
0.6.5 (2026-02-24)
Added allowPrivilegeEscalation to the sidekiq-node pod to enable nmap scans
0.6.4 (2026-02-13)
Fixed volume permissions in container-scanner
0.6.3 (2026-01-26)
Removed the container-scanner volume cleanup service
Cleanup is now performed directly by the container-scanner service
Added a service to the nginx pod on satellite nodes
Added support for Kubernetes secrets for all secrets in the values.yml file
0.6.2 (2026-01-09)
Redis data is now persistent
Fixed warning message related to Elasticsearch pod
Fixed warning message for container-scanner cron job
0.6.1 (2025-12-12)
Added a service to clean up the container-scanner volume
The cleanup interval is configurable via containerScanner.cleanupIntervalHours
The Elasticsearch pod is now a StatefulSet
Added startupProbe and livenessProbe to cache and redis pods
Fixed data-uploads volume mounting when a node is offline
0.6.0 (2025-08-25)
Add NodeSelector capability to pods
Added the ability to scale container-scanner and web-scanner
Added the ability to configure a Horizontal Pod Autoscale (HPA) for web, sidekiq, sidekiq_node, container-scanner and web-scanner pods
Simplified use of certificates for ingress, DB and redis
It is now possible to enter certificates and keys directly in the Values.yml file.
Ingress secrets are not regenerated on each installation
Added support for multiple ingresses.
Added a new configuration for the ingress(es) via the ingress.hosts variable.
Deprecated: the variables ingress.host, ingress.tls, ingress.ingressClassName and ingress.annotations are now deprecated. The variables will be removed in a future update.
Added the ability to use a Persistent Volume (PV) et Persistent Volume Claim (PVC) for the container-scanner cache
Deprecated: the containerScanner.cache_size_limit variable is deprecated. You must now use containerScanner.cacheStorageSize or containerScanner.existingClaim. The variable will be removed in a future update.
Added the ability to specify the Deployments update strategy
DB and redis pods are now in StatefulSet
Add a NOTES.txt file to warn of deprecations after a Helm chart installation or update
Fixed annotation used to disable apparmor on container-scanner
Deprecated: *.extraEnvVars variables for all pods are now displayed as deprecated in the NOTES.txt. It is recommended to use *.env
