This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Light signalRelease v3.1.0 adds many subcharts, generic workload defaults, projected volumes, new Istio and Vault Secret Operator templates, plus critical rendering fixes.
Why it matters: The update introduces 11 subcharts, generic workload defaults, projected volume support, and fixes severity‑40 Helm template evaluation in HTTPRoute specs and YAML document separation for jobs, hooks, and cronJobs.
Summary
AI summaryAdded many subcharts, generic workload defaults, projected volumes, Istio and Vault Secret Operator templates, GitHub CI config, contributor templates, and several samples.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Added subcharts: nuc-strimzi-kafka-operator, nuc-keycloak-operator, nuc-fluxcd, nuc-external-secrets, nuc-mongodb-percona-operator, nuc-envoy-gateway, nuc-cloudnativepg, nuc-mysql-percona-operator, nuc-elk, nuc-rabbitmq, nuc-clickhouse. Added subcharts: nuc-strimzi-kafka-operator, nuc-keycloak-operator, nuc-fluxcd, nuc-external-secrets, nuc-mongodb-percona-operator, nuc-envoy-gateway, nuc-cloudnativepg, nuc-mysql-percona-operator, nuc-elk, nuc-rabbitmq, nuc-clickhouse. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added shared generic defaults for workloads: nodeSelector, resources, podSecurityContext, containerSecurityContext, automountServiceAccountToken. Added shared generic defaults for workloads: nodeSelector, resources, podSecurityContext, containerSecurityContext, automountServiceAccountToken. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added servicesGeneral for common labels and annotations on rendered Service resources, including auto-generated governing Services. Added servicesGeneral for common labels and annotations on rendered Service resources, including auto-generated governing Services. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added typed projected volumes via volumes[].type: projected. Added typed projected volumes via volumes[].type: projected. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added ServiceAccount.imagePullSecrets support via serviceAccountDefaultImagePullSecretName, serviceAccountGeneral.imagePullSecrets, and per-ServiceAccount overrides. Added ServiceAccount.imagePullSecrets support via serviceAccountDefaultImagePullSecretName, serviceAccountGeneral.imagePullSecrets, and per-ServiceAccount overrides. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added new Istio templates: AuthorizationPolicy, DestinationRule, EnvoyFilter, Gateway, PeerAuthentication, ProxyConfig, RequestAuthentication, ServiceEntry, Sidecar, Telemetry, VirtualService, WasmPlugin, WorkloadEntry, WorkloadGroup. Added new Istio templates: AuthorizationPolicy, DestinationRule, EnvoyFilter, Gateway, PeerAuthentication, ProxyConfig, RequestAuthentication, ServiceEntry, Sidecar, Telemetry, VirtualService, WasmPlugin, WorkloadEntry, WorkloadGroup. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added new Vault Secret Operator templates: HCPAuth, HCPVaultSecretsApp, SecretTransformation, VaultAuthGlobal, VaultConnection, VaultDynamicSecret, VaultPKISecret. Added new Vault Secret Operator templates: HCPAuth, HCPVaultSecretsApp, SecretTransformation, VaultAuthGlobal, VaultConnection, VaultDynamicSecret, VaultPKISecret. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
Added stdin and tty support for containers and initContainers. Added stdin and tty support for containers and initContainers. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Dependency | Low |
Updated nuc-common dependency from 1.0.4 to 1.0.5. Updated nuc-common dependency from 1.0.4 to 1.0.5. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Dependency | Low |
Updated nuc-keycloak-operator dependency from 1.0.0 to 1.0.1. Updated nuc-keycloak-operator dependency from 1.0.0 to 1.0.1. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Dependency | Low |
Updated nuc-external-secrets dependency from 1.0.1 to 1.1.0. Updated nuc-external-secrets dependency from 1.0.1 to 1.1.0. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Medium |
Fixed nuc-native-gateway (1.0.6) so Helm template expressions in HTTPRoute spec are evaluated via tpl instead of toYaml. Fixed nuc-native-gateway (1.0.6) so Helm template expressions in HTTPRoute spec are evaluated via tpl instead of toYaml. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Bugfix | Medium |
Fixed YAML doc separator rendering between consecutive jobs, hooks, and cronJobs to emit each resource as a separate YAML document. Fixed YAML doc separator rendering between consecutive jobs, hooks, and cronJobs to emit each resource as a separate YAML document. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Bugfix | Low |
Fixed deprecated imagePullSecrets warnings in NOTES.txt so null entries inside deployments, cronJobs, jobs, and hooks do not fail template rendering. Fixed deprecated imagePullSecrets warnings in NOTES.txt so null entries inside deployments, cronJobs, jobs, and hooks do not fail template rendering. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed FluxCD dependency condition to use nuc-fluxcd.enabled. Fixed FluxCD dependency condition to use nuc-fluxcd.enabled. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Envoy Gateway dependency condition to use global.nuc-envoy-gateway.enabled, avoiding an enabled key rejected by the subchart schema. Fixed Envoy Gateway dependency condition to use global.nuc-envoy-gateway.enabled, avoiding an enabled key rejected by the subchart schema. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed cronJobsGeneral.suspend and cronJobsGeneral.singleOnly inheritance allowing per-CronJob overrides. Fixed cronJobsGeneral.suspend and cronJobsGeneral.singleOnly inheritance allowing per-CronJob overrides. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed envConfigmaps and envSecrets rendering to preserve multiple entries and skip null or empty items without rendering an empty envFrom block. Fixed envConfigmaps and envSecrets rendering to preserve multiple entries and skip null or empty items without rendering an empty envFrom block. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed automatic checksum reference collection for *General.envConfigmaps and *General.envSecrets. Fixed automatic checksum reference collection for *General.envConfigmaps and *General.envSecrets. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed ConfigMaps and Secrets annotated by default hooks preventing uninstall. Fixed ConfigMaps and Secrets annotated by default hooks preventing uninstall. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Bugfix | Low |
Fixed multi-env rendering error. Fixed multi-env rendering error. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Refactor | Low |
autoRolloutChecksums now generates checksum annotations only for referenced ConfigMaps, Secrets, and SealedSecrets per workload. autoRolloutChecksums now generates checksum annotations only for referenced ConfigMaps, Secrets, and SealedSecrets per workload. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
Full changelog
What's Changed
Added
- added
nuc-strimzi-kafka-operator,nuc-keycloak-operator,nuc-fluxcd,nuc-external-secrets,nuc-mongodb-percona-operator,nuc-envoy-gateway,nuc-cloudnativepg,nuc-mysql-percona-operator,nuc-elk,nuc-rabbitmq, andnuc-clickhousesubcharts to the dependency list. - added shared
genericdefaults for workloads:nodeSelector,resources,podSecurityContext,containerSecurityContext, andautomountServiceAccountToken. - added
servicesGeneralfor common labels and annotations on renderedServiceresources, including auto-generated governing Services. - added typed
projectedvolumes viavolumes[].type: projected. - added
ServiceAccount.imagePullSecretssupport viaserviceAccountDefaultImagePullSecretName,serviceAccountGeneral.imagePullSecrets, and per-ServiceAccount overrides. - added new Istio templates:
AuthorizationPolicy,DestinationRule,EnvoyFilter,Gateway,PeerAuthentication,ProxyConfig,RequestAuthentication,ServiceEntry,Sidecar,Telemetry,VirtualService,WasmPlugin,WorkloadEntry,WorkloadGroup. - added new Vault Secret Operator templates:
HCPAuth,HCPVaultSecretsApp,SecretTransformation,VaultAuthGlobal,VaultConnection,VaultDynamicSecret,VaultPKISecret. - added
stdinandttysupport for containers and initContainers. - added GitHub chart-testing and CI configuration under
.github/, including lint, security, smoke, unit, and e2e workflows. - added contributor templates:
docs/PULL_REQUEST_TEMPLATE.md,docs/ISSUE_TEMPLATE/bug_report.yml,docs/ISSUE_TEMPLATE/feature_request.yml. - added samples catalog:
nuc-fluxcd,nuc-external-secrets,nuc-mongodb-percona-operator,nuc-envoy-gateway,nuc-valkey,wordpress, andwordpress-vault(WordPress + Vault Secret Operator) deployment examples.
Fixed
- fixed
nuc-native-gateway(1.0.6):specof HTTPRoute (and all other Gateway API resources) was rendered as-is viatoYaml, so Helm template expressions in string values — e.g.'{{ printf "%s-%s" .Release.Name "frontend" }}'or'{{ include "helpers.app.fullname" … }}'— were not evaluated.specandstatusare now rendered throughtpl, making release-name-awarebackendRefswork out of the box. - fixed YAML doc separator rendering between consecutive
jobs,hooks, andcronJobsso each resource is emitted as a separate YAML document. - fixed deprecated
imagePullSecretswarnings inNOTES.txtsonullentries insidedeployments,cronJobs,jobs, andhooksdo not fail template rendering. - fixed FluxCD dependency condition to use
nuc-fluxcd.enabled. - fixed Envoy Gateway dependency condition to use
global.nuc-envoy-gateway.enabled, avoiding anenabledkey rejected by the subchart schema. - fixed
cronJobsGeneral.suspendandcronJobsGeneral.singleOnlyso CronJobs inherit the general defaults while still allowing per-CronJobfalseornulloverrides. - fixed
envConfigmapsandenvSecretsrendering to preserve multiple entries and skipnullor empty items without rendering an emptyenvFromblock. - fixed automatic checksum reference collection for
*General.envConfigmapsand*General.envSecrets. - fixed ConfigMaps and Secrets annotated by default hooks preventing uninstall.
- fixed multi-env rendering error.
- fixed CronJob general settings (
cronJobsGeneral) inheritance.
Changed
autoRolloutChecksumsnow generates checksum annotations only for ConfigMaps, Secrets, and SealedSecrets actually referenced by a given workload, instead of checksumming every resource in the release.- updated
nuc-commondependency from1.0.4to1.0.5. - updated
nuc-keycloak-operatordependency from1.0.0to1.0.1. - updated
nuc-external-secretsdependency from1.0.1to1.1.0. - completed Dependency Subcharts documentation for all dependencies declared in
Chart.yaml. - documented
deploymentsGeneralandcronJobsGeneralenvironment source defaults, including empty-value handling and override behavior.
Testing
- added unit and smoke coverage for all new features and bug fixes introduced across the 3.0.x series.
New Contributors
- @apberdnikov made their first contribution in https://github.com/nixys/nxs-universal-chart/pull/99
- @Gekter made their first contribution in https://github.com/nixys/nxs-universal-chart/pull/104
- @edvegas made their first contribution in https://github.com/nixys/nxs-universal-chart/pull/112
Full Changelog: https://github.com/nixys/nxs-universal-chart/compare/v3.0.21...v3.1.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Nxs Universal Chart
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]