> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Astronomer Software release notes

This document contains release notes for each version of Astronomer Software.

Version 0.37 is the latest long-term support (LTS) version of Astronomer Software. To upgrade to version 0.37, see [Upgrade Astronomer](/docs/astro-private-cloud/v-0-37/upgrade-astronomer). For more information about Software release channels, see [Release and lifecycle policies](/docs/astro-private-cloud/v-0-37/release-lifecycle-policy). To read release notes specifically for the Astro CLI, see [Astro CLI release notes](/docs/cli/v1.43/release-notes).

<Info>
  Because Astronomer has separate [maintenance life cycles](/docs/astro-private-cloud/v-0-37/release-lifecycle-policy) for each minor version of Astronomer Software, the same change can be introduced multiple times across minor versions, resulting in multiple identical release notes. When a new minor version releases, such as version 0.33.0, all changes from previously released versions are included in the new minor version.

  If you're upgrading to receive a specific change, ensure the release note for the change appears either:

  * Within your target minor version.
  * In a patch version that was released before the first release of your target minor version. For example, a change in 0.32.5, which released 12/8/2023, is not guaranteed to appear in the 0.33 series, which released 9/8/2023, unless there is a release note for it in an 0.33 patch. However, all changes in 0.32.1, which released June 12, 2023, are guaranteed to be in the 0.33 series, because 0.32.1 was released before 0.33.0.
</Info>

<Update label="0.37.7" description="February 2, 2026">
  ### Additional improvements

  * Added Vector caching support to improve platform stability during high-throughput log ingestion.

  ### Security enhancements

  * Added support for Kerberos (GSSAPI) authentication for PgBouncer used by Airflow, enabling passwordless database authentication. See [Kerberos database setup guide](/docs/astro-private-cloud/v-0-37/kerberos-database-setup).
  * Astronomer platform images are now built on Chainguard hardened base images, reducing the container attack surface and improving vulnerability remediation timelines.
  * Labels can now be specified in the Astro Private Cloud helm chart, and propagated to every pod created by `airflow-chart`, including the apache airflow subchart.

  ### Bug fixes

  * Fixed an issue where dag-downloader containers emitted excessive log output before the first deploy, generating thousands of log lines per second.
  * Fixed an issue where the Flower UI was inaccessible for Deployments using the CeleryExecutor.
  * Fixed an issue where `paginatedWorkspaceUsers` returned all role bindings across workspaces when using inline arguments instead of filtering them to the requested workspace.
</Update>

<Update label="0.37.6" description="November 2, 2025">
  ### Additional improvements

  * Added support for Kubernetes version 1.34.
      <Warning>
        If you are upgrading your EKS cluster from Kubernetes version 1.32 to 1.33 or later, you need to ensure you upgrade from Amazon Linux 2 to Amazon Linux 2023 AMI. See [Upgrade from Amazon Linux 2 to Amazon Linux 2023](https://docs.aws.amazon.com/eks/latest/userguide/al2023.html) for more details.
      </Warning>
  * Optimized API performance, improving UI load times and responsiveness under heavy system load.
  * Improved Helm upgrade reliability. The database migration job now reads the latest Houston configuration and correctly updates Deployment configurations during migration, reducing upgrade-related issues.
  * Added `updateSystemServiceAccount` GraphQL mutation for system-level service accounts.
      <Warning>
        `updateServiceAccount` is now deprecated and should no longer be used.
      </Warning>

  ### Bug fixes

  * Fixed a version mismatch in the Blackbox Exporter image tag where it was tagged 0.25.0 but used 0.26.0. Tags now correctly reflect the upstream version.
  * Fixed an issue where environment variables were getting cleared out when using the `upsertDeployment` mutation.
  * Fixed an issue where existing Deployments still showed `LimitRanges` after setting `disableManageResourceQuotasAndLimitRanges=true`. Both `ResourceQuotas` and `LimitRanges` are now correctly skipped when this flag is enabled.
  * Fixed image upload failures with in-cluster registry by adding a default `fsGroup` to the registry Pod security context.
  * Fixed a DAG-only Deployment issue where the `dag-downloader` sidecar failed to watch updates (`HTTP 410: too old resourceVersion`), preventing DAG sync. Watch handling now updates from the latest resource version.
  * Fixed a connection pool leak in the `filesd` reloader service by ensuring database sessions are properly closed, eliminating frequent pool exceeded errors.
  * Fixed an issue where `paginatedWorkspaceUsers` returned all role bindings across workspaces when using inline arguments instead of filtering them to the requested workspace.

  ### Security updates

  * Hardened Houston permission checks to prevent overexposure of service account keys. Only keys at or below the caller’s permissions are returned, and the system key is never exposed without explicit system-level authorization.
</Update>

<Update label="0.37.5" description="August 12, 2025">
  ## Disable Setting Kubernetes Worker CPU/Memory via API or UI

  Previously, the KubernetesExecutor always set CPU and Memory limits for worker Pods via the Astronomer API and UI, with no option to disable this behaviour. **0.37.5** introduces a new configuration option, `workers.resources.enabled` for the KubernetesExecutor. When `workers.resources.enabled` is set to `false`, Astronomer ignores CPU and memory resource settings from the API/UI, allowing you to define them exclusively through other mechanisms such as Pod mutation hooks, Pod configuration files, or DAG code.

  You should use this feature when you need to manage worker resource configurations outside of Astronomer tools. For example, if your organization enforces CPU/memory limits by using admission controllers or custom Kubernetes policies.

  Avoid setting `workers.resources.enabled` to `false` if you want to manage worker CPU/memory requests and limits through the Astronomer API or UI.

  The default KubernetesExecutor configuration is now:

  ```expandable wrap theme={null}
  deployments:
    executors:
      - name: LocalExecutor
        enabled: true
        components:
          - scheduler
          - webserver
          - statsd
          - pgbouncer
          - triggerer
          - dagProcessor
        defaultExtraAu: 0
        defaultExtraCapacity:
          cpu: 0
          memory: 0
      - name: CeleryExecutor
        enabled: true
        components:
          - scheduler
          - webserver
          - statsd
          - pgbouncer
          - workers
          - flower
          - redis
          - triggerer
          - dagProcessor
        defaultExtraAu: 0
        defaultExtraCapacity:
          cpu: 0
          memory: 0
      - name: KubernetesExecutor
        enabled: true
        components:
          - scheduler
          - webserver
          - statsd
          - pgbouncer
          - triggerer
          - dagProcessor
        defaultExtraAu: 10
        defaultExtraCapacity:
          cpu: 1000
          memory: 3840
        workers:
          ephemeralStorage:
            disabled: true
          resources:
            enabled: true
  ```

  ### If you have already overridden the default worker resource configuration

  If you’ve configured your KubernetesExecutor so that CPU and memory requests/limits are set at the Deployment level through Houston (instead of at the DAG level), you only need to add the new `resources.enabled: false` flag to disable resource configuration via the API/UI. This ensures that worker resource settings are applied exclusively from your preferred source, such as Pod mutation hooks or Pod configuration files.

  ### If you use the default worker resource configuration

  If you use the default KubernetesExecutor worker resource configuration in your Deployments, you can disable automatically creating any worker resource requests and limits. The following configuration sets them as an empty `dict`.

  ```yaml wrap theme={null}
  deployments:
    executors:
      - name: KubernetesExecutor
        enabled: true
        components:
          - scheduler
          - webserver
          - statsd
          - pgbouncer
          - triggerer
          - dagProcessor
        defaultExtraAu: 10
        defaultExtraCapacity:
          cpu: 1000
          memory: 3840
        workers:
          ephemeralStorage:
            disabled: true
          resources:
            enabled: false
  ```

  ## Additional improvements

  * Added support for importing groups that include more than 200 users.
  * Added support for custom resource quotas per Deployment, allowing you to override default quota calculations by specifying your own CPU and memory limits and requests via the Create/Update/Upsert Deployment API:
    * If you don’t provide the quotas using the API, then Astronomer uses the platform-level default quota configuration.
    * Ensure the values that you set via the API are within permissible limits and not under capacity to the platform default quota values. The current default values for limit quotas:
      * CPU: 10 vCPU
      * Memory: 28,272 MiB / \~28 GiB

  ```json wrap theme={null}
  "quotas": {
       "requests": {
            "cpu": 10,
            "memory": "28272Mi"
        },
       "limits": {
            "cpu": 10,
            "memory": "28272Mi"
        }
  }
  ```

  * Added support for `nodeSelector`, `affinity`, and `tolerations` configuration for `dag-deploy` and `git-sync-relay` components to enable consistent Kubernetes scheduling across all Airflow components. If you have already provided component-specific  `nodeSelector`, `affinity`, and `tolerations`, in the Houston Deployment configurations, it takes precedence over the global configuration.

  ```text wrap theme={null}
  global:
    dagOnlyDeployment:
      enabled: true
      server:
        nodeSelector:
          # Your node selection criteria
        affinity:
          # Your affinity rules
        tolerations:
          # Your toleration configurations
  ```

  Component specific configuration for `git-sync-relay`:

  ```text wrap theme={null}
  houston:
    config:
      deployments:
        helm:
          gitSyncRelay:
            nodeSelector:
              # Your node selection criteria
            affinity:
              # Your affinity rules
            tolerations:
              # Your toleration configurations
  ```

  Airflow-wide configuration:

  ```text wrap theme={null}
  houston:
    config:
      deployments:
        helm:
          airflow:
            nodeSelector:
              # Your node selection criteria
            affinity:
              # Your affinity rules
            tolerations:
              # Your toleration configurations
  ```

  ## Behavior changes

  * Upgraded Prometheus from 2.53 LTS to 3.x due to end-of-life requirements, which may require updates to custom monitoring configurations and alerting rules.
  * Fixed an issue where `disableManageResourceQuotasAndLimitRanges=true` only disabled `ResourceQuotas` but not `LimitRanges`. Both are now properly skipped for consistent resource management behaviour.
    * **BEHAVIOR CHANGE:** In previous versions, `LimitRanges` were still applied even when `disableManageResourceQuotasAndLimitRanges=true`. Starting with this release, both `ResourceQuotas` and `LimitRanges` are skipped, ensuring consistent and complete disabling of resource constraint management when this flag is set.

  ## Bug Fixes

  * Fixed duplicate `securityContext` blocks in `houston-cleanup-deploy-revisions-cronjob.yaml` manifest that caused Helm validation failures in strict linting environments.
  * Fixed validations around secret token that were causing Git-sync webhook based deployments to error

  ## Security Updates

  * Made security improvements to authentication and authorization mechanisms.
  * Improved exception handling and logging for vector sidecar and dag-only deploy capabilities

  ### Resolved CVE list:

  * [CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110)
  * [CVE-2025-6965](https://nvd.nist.gov/vuln/detail/CVE-2025-6965)
</Update>

<Update label="0.37.4" description="July 7, 2025">
  ### Configure the Airflow metadata database cleanup Pod attributes

  You can now configure the resources and storage provider secret for Airflow database cleanup with new `cleanupAirflowDb` configuration options, including adding secret environment variables. These configurations improve the previous implementation, which required you to configure Storage provider secrets and other attributes with the Scheduler configuration. See [Airflow database cleanup](https://www.astronomer.io/docs/software/clean-up-task-metadata) for more details.

  <Warning>
    **Deprecated Configuration**

    In v0.37.0-0.37.3, you defined your Airflow metadata database cleanup job with a combination of `scheduler` and `cleanupAirflowDb` configurations. While Software can still accept and successfully complete cleanup jobs using the `scheduler` configuration, this is now deprecated in favor of using `cleanupAirflowDb`.
  </Warning>

  The following parameters allow you to configure your Storage provider secret:

  * `extraVolumes`
  * `extraVolumeMounts`

  <Tabs>
    <Tab title="Google Cloud Storage">
      ```yaml wrap theme={null}
      cleanupAirflowDb:
        extraVolumes:
          - name: dbcleanup
            secret:
              defaultMode: 420
              optional: true
              secretName: astronomer-gcs-keyfile
        extraVolumeMounts:
          - mountPath: /tmp/creds/astronomer-gcs-keyfile
            name: dbcleanup
            readOnly: false
            subPath: astronomer-gcs-keyfile
        extraEnv:
          - name: GCP_PASS
            value: /tmp/creds/astronomer-gcs-keyfile

      ```
    </Tab>

    <Tab title="AWS">
      ```yaml wrap theme={null}
      cleanupAirflowDb:
        extraVolumes:
          - name: dbcleanup
            secret:
              defaultMode: 420
              optional: true
              secretName: aws-secret
        extraVolumeMounts:
          - mountPath: /tmp/creds/aws-secret
            name: dbcleanup
            subPath: aws-secret
        extraEnv:
          - name: AWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                key: aws_access_key
                name: aws-secret
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                key: aws_secret_key
                name: aws-secret

      ```
    </Tab>
  </Tabs>

  The following new configurations allow you to define the CPU and memory resources and limits you want to allocate to the cleanup job, instead of inheriting default values from the Scheduler configuration:

  * `resources.limits`
  * `resources.requests`

  These configurations become the new defaults for your cleanup job if you do not pass any additional configurations in your GraphQL mutation. Additionally, if you don't use the manual trigger and instead use the cleanup cronjob, these resources also become the new default used when scheduling cleanup jobs. You can use a [Houston API query](https://www.astronomer.io/docs/software/clean-up-task-metadata#scenario-4-configure-custom-pod-resources) to override these values.

  ```yaml wrap theme={null}
  cleanupAirflowDb:
    resources:
      requests:
        cpu: 200m
        memory: 768Mi
      limits:
          cpu: 500m
          memory: 1536Mi
  ```

  You can also now configure environment variables for your cleanup job with `extraEnv`:

  ```yaml wrap theme={null}
  cleanupAirflowDb:
      extraEnv:
      - name: key
        value: value
  ```

  ### Changes to KubernetesExecutor ephemeral storage

  <Danger>
    **Breaking Change**

    Changes were introduced in versions 0.37.0 to 0.37.3 that resulted in every KubernetesExecutor task getting ephemeral storage, whether explicitly requested in the dag code or not. Prior to 0.37.0, any task Pod created by the KubernetesExecutor without defined resource quotas fell back to default quota limits of 1AU. See [0.37 Upgrade Considerations](https://www.astronomer.io/docs/software/upgrade-astronomer/#upgrade-to-astronomer-software-037) for upgrade steps and remediation recommendations.

    The new configuration, `houston.deployments.executors.workers.ephemeralstorage.disabled`, default `True`, reverts this behavior so that only tasks that explicitly request ephemeral storage receive it, and there is no fallback behavior if dag code does not explicitly request ephemeral storage.

    If you have not set ephemeral storage amounts for KubernetesExecutor in your dag, relying instead on the fallback ephemeral storage assignment, you must either update your dag to request ephemeral storage or change `houston.deployments.executors.workers.ephemeralstorage.disabled`, to `False`.
  </Danger>

  Astronomer no longer configures ephemeral storage resources for Deployments using the `kubernetesExecutor` by default. In 0.37.0-0.37.3, when using Kubernetes Executor, task Pods inherited certain default resource values like ephemeral storage requests and limits from the Celery Worker configuration if specific Kubernetes `executor-task-pod` values were not explicitly set, even though the KubernetesExecutor and Celery Executor should operate independently. Now, `houston.deployments.executors.workers.ephemeralstorage.disabled` is set to `true` by default. This means that Astronomer does not configure any ephemeral storage capacity for Deployments running the KubernetesExecutor, but you can configure ephemeral storage capacity at the dag-level by using Pod overrides.

  If you want to define ephemeral storage configurations for Deployments via the Houston API, you must change `ephemeralStorage.disabled` to `false`. This allows Kubernetes to apply namespace-level defaults from the Houston API, See [Run the Kubernetes executor](https://www.astronomer.io/docs/software/kubernetes-executor) for more information.

  ```yaml wrap theme={null}
  houston:
    deployments:
        executors:
          - name: KubernetesExecutor
            workers:
              ephemeralStorage:
                disabled: false
  ```

  ### Additional improvements

  * When defining custom service account names using `template` or `tpl()` strings for dynamic generation, Houston could not correctly parse and render the template. As a result, Houston did not correctly translate the generated name into the corresponding Airflow service account name. This lead to failures during deploys due to invalid Kubernetes resource names, that violate Kubernetes naming conventions. Now, you can use templates for custom service accounts.

  ### Behavior changes

  * The `nats-exporter` has been removed from the new v0.17.3 `nats-streaming` image. For `nats-streaming` v0.17.3 and above, the `nats-exporter` is no longer supported or shipped.
  * Added a readiness probe for the `dagProcessor` and added both liveness and readiness probes for the `logGroomerSidecar`. See [Deployment Resources: Dag Processor](https://www.astronomer.io/docs/software/deployment-resources/#dag-processor) and [Configure probes: Airflow](https://www.astronomer.io/docs/software/configure-probes/#airflow) for more information about how to set up the Dag Processor and configure probes.

  ### Bug fixes

  * Fixed a bug where using a custom URL configuration for `astronomer.houston.updateRuntimeCheck.url` would cause outbound connections for the Runtime check to fail when a proxy config is set. This bug was because the `houston-check-runtime-updates.yaml` cronjob did not honor the proxy configuration, `GLOBAL_AGENT_HTTPS_PROXY`. Now, you can add custom URL configurations for the update Runtime Check cronjob with proxy connections enabled.
  * Added omitted information about `ap-kuiper-reloader` to the 0.37.3 Release Notes.
  * Fixed a bug after upgrading the Software Platform version to 0.37 where attempting to upgrade Deployments that did not have Dag Processors or Triggerers enabled would cause a Runtime error.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337)
  * [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869)
  * [CVE-2025-22874](https://nvd.nist.gov/vuln/detail/CVE-2025-22874)
  * [CVE-2025-30204](https://nvd.nist.gov/vuln/detail/CVE-2025-30204)
</Update>

<Update label="0.37.3" description="June 3, 2025">
  ### Additional improvements

  * You can now configure `podSecurityContext` for all Pods deployed by the Astronomer Software Helm chart. See [Configure security context](https://www.astronomer.io/docs/software/configure-securitycontext) for more information about how Astronomer Software uses security contexts, and how to enable them.
  * You can now set the global config, `global.podLabels`, to configure Pod labels across all Pods created by the Astronomer chart, including Deployments, statefulsets, cronjobs, jobs, daemonsets, and Helm hooks. This allows you to label Pods created by Astronomer Software and easily search for them using the `kubectl get pods` command. See [Add Pod labels](https://www.astronomer.io/docs/software/add-podlabels/) for more information.
  * You can now configure liveness and readiness probes for Software components, jobs, Pods, and cronjobs. See [Configure Liveness and Readiness probes](https://www.astronomer.io/docs/software/configure-probes/) for more information.
  * Astronomer Software now supports auto-generating stricter passwords when auto-generating databases using the Houston API. You can now use the Houston config, `passwordPolicy`, to define the length and number of uppercase, lowercase, number, and special characters required. See the [Astronomer Trust Center](https://trust.astronomer.io/?itemName=access_control\&source=click\&itemUid=af119565-5dc2-4aec-bab6-21f9cf5ae315) for documentation of how to set up this configuration.
  * Added support for the Software UI to resolve and use the SHA256 digest of the selected Astro Runtime image tag when `customImageShaEnabled` is set to `true`.  See [Create a Deployment](https://www.astronomer.io/docs/software/create-deployment/#create-deployments-using-astro-runtime-SHA256-digest) to learn more about how to create Deployments using a specific Runtime release by specifying its `sha256` value.
  * Added a new component, `ap-kuiper-reloader`. This utility generates targets for `statsd` and the `pgbouncer` exporter, which allows Prometheus to use a [file-based service discovery mechanism](https://prometheus.io/docs/guides/file-sd/). This removes the need for a cluster role that was previously required when using HTTP-based service discovery. This component is not configurable.

  ### Bug fixes

  * Fixed a bug where db-bootstrapper created the `astronomer-bootstrap-secret` with the wrong component label value if the db-bootstrapper component secret name was customized. Now, Astronomer creates the label as `component=astronomer-houston-backend`, as expected.
  * Fixed a bug where workers did not terminate gracefully in response to `TERM` signals. Now, `tini --` correctly handles `args` to initiate termination as expected.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2023-52428](https://nvd.nist.gov/vuln/detail/CVE-2023-52428)
  * [CVE-2024-4367](https://nvd.nist.gov/vuln/detail/CVE-2024-4367)
  * [CVE-2024-12905](https://nvd.nist.gov/vuln/detail/CVE-2024-12905)
  * [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-56406](https://nvd.nist.gov/vuln/detail/CVE-2024-56406)
  * [CVE-2025-27152](https://nvd.nist.gov/vuln/detail/CVE-2025-27152)
  * [CVE-2025-30215](https://nvd.nist.gov/vuln/detail/CVE-2025-30215)
  * [CVE-2025-31115](https://nvd.nist.gov/vuln/detail/CVE-2025-31115)
  * [CVE-2025-31498](https://nvd.nist.gov/vuln/detail/CVE-2025-31498)
</Update>

<Update label="0.37.2" description="May 7, 2025">
  ### End of support for Kubernetes versions 1.27 and 1.28

  Kubernetes versions 1.27 and 1.28 are not maintained in Software version 0.37.2 and future versions. See [Kubernetes version support table and policy](https://www.astronomer.io/docs/software/version-compatibility-reference#kubernetes-version-support-table-and-policy) for a full list of supported Kubernetes versions and the Software versions they correspond to.

  ### Additional improvements

  * System admins can now remove the last remaining Deployment or Workspace admin.
  * Improved error handling when creating databases.
  * You can now configure CPU and memory resource requests and limits for the `loggingSidecar` container with `values.yaml`.

  ### Bug fixes

  * Fixed an issue where users removed from an organization in Entra ID (without SCIM) were not automatically removed from Astronomer teams. System Admins can now clean up these inactive IDP-managed users, including those with attached teams, if they have the `system.user.forceDelete` permission.
  * Fixed a bug where local users could not be added to groups if `manageSystemPermissionsViaIdpGroups.enabled` was `true`.
  * Added an alert in Astronomer Deployment UI for variable inputs that have whitespace at the beginning or end, which alerts the user for potentially incorrect inputs.
  * Fixed a bug where disabling `global.networkPolicy` did not disable network policies for DAG server and Git Sync Relay components. Now, the Airflow network policy configuration covers these components.
  * Fixed an issue where disabling `disableManageResourceQuotasAndLimitRanges` prevented the Extra Capacity value from getting calculated, leading to severely undersized PgBouncer pool configurations and degraded UI performance. PgBouncer sizing now correctly uses fallback capacity calculations.
  * Fixed a bug where you could not set a resources block for PgBouncer.
  * Fixed a bug where `dag-processor` extra container logic was not working. You can now [configure extra sidecar containers](https://www.astronomer.io/docs/software/customize-resource-usage/#airflow-dag-processor) for `dag-processor`.
  * Fixed a bug where Deployment updates failed due to unintended `ResourceQuota` creation, even when `disableManageResourceQuotasAndLimitRanges` was set to `true`. Deployment updates now correctly respect the config flag.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2023-42366](https://nvd.nist.gov/vuln/detail/CVE-2023-42366)
  * [CVE-2023-45143](https://nvd.nist.gov/vuln/detail/CVE-2023-45143)
  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727)
  * [CVE-2024-12133](https://nvd.nist.gov/vuln/detail/CVE-2024-12133)
  * [CVE-2024-12797](https://nvd.nist.gov/vuln/detail/CVE-2024-12797)
  * [CVE-2024-12905](https://nvd.nist.gov/vuln/detail/CVE-2024-12905)
  * [CVE-2024-21538](https://nvd.nist.gov/vuln/detail/CVE-2024-21538)
  * [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-28863](https://nvd.nist.gov/vuln/detail/CVE-2024-28863)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-37890](https://nvd.nist.gov/vuln/detail/CVE-2024-37890)
  * [CVE-2024-4068](https://nvd.nist.gov/vuln/detail/CVE-2024-4068)
  * [CVE-2024-52798](https://nvd.nist.gov/vuln/detail/CVE-2024-52798)
  * [CVE-2024-55565](https://nvd.nist.gov/vuln/detail/CVE-2024-55565)
  * [CVE-2024-56406](https://nvd.nist.gov/vuln/detail/CVE-2024-56406)
  * [CVE-2024-9143](https://nvd.nist.gov/vuln/detail/CVE-2024-9143)
  * [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395)
  * [CVE-2025-1094](https://nvd.nist.gov/vuln/detail/CVE-2025-1094)
  * [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869)
  * [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870)
  * [CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872)
  * [CVE-2025-24528](https://nvd.nist.gov/vuln/detail/CVE-2025-24528)
  * [CVE-2025-27152](https://nvd.nist.gov/vuln/detail/CVE-2025-27152)
  * [CVE-2025-27789](https://nvd.nist.gov/vuln/detail/CVE-2025-27789)
  * [CVE-2025-29087](https://nvd.nist.gov/vuln/detail/CVE-2025-29087)
  * [CVE-2025-30204](https://nvd.nist.gov/vuln/detail/CVE-2025-30204)
  * [CVE-2025-30215](https://nvd.nist.gov/vuln/detail/CVE-2025-30215)
  * [CVE-2025-30258](https://nvd.nist.gov/vuln/detail/CVE-2025-30258)
  * [CVE-2025-31115](https://nvd.nist.gov/vuln/detail/CVE-2025-31115)
  * [CVE-2025-31498](https://nvd.nist.gov/vuln/detail/CVE-2025-31498)
  * [CVE-2025-32387](https://nvd.nist.gov/vuln/detail/CVE-2025-32387)
  * [CVE-2025-32414](https://nvd.nist.gov/vuln/detail/CVE-2025-32414)
</Update>

<Update label="0.37.1" description="April 18, 2025">
  ### Standalone DAG processor

  As your team and Airflow use cases grow, scaling up your Airflow environment reliably can be a challenge. Complex, dynamically-generated DAGs, sub-optimal DAG parsing practices, or a growing business that requires a larger data pipeline can strain DAG processing and threaten your Airflow scheduler’s availability. Deployments now support high-scale environments more reliably by separating the DAG processor from the scheduler. You can now configure the number of DAG processors for the Deployment from the UI and the Houston API.

  This feature is enabled by default. To disable standalone DAG processors for Deployments, set the `dagProcessorEnabled` feature flag to `false` in your Houston API configuration in the `config.yaml` file:

  ```yaml wrap theme={null}
  astronomer:
    houston:
      config:
        deployments:
          dagProcessorEnabled: false
  ```

  ### PostgreSQL 17

  Astronomer Software version 0.37.1 upgrades PostgreSQL from 15 to 17. If you use in-cluster PostgreSQL for your workflows, upgrading to Software 0.37.1 without pinning your PostgreSQL version can impact your workflows. See the [Upgrade to Postgres 17 in Astronomer Software 0.37.1](https://www.astronomer.io/docs/software/upgrade-astronomer/#upgrade-to-astronomer-software-037) for upgrade considerations and steps.

  ### Additional improvements

  * Added support for configurable `priorityClassName` in the Prometheus StatefulSet, allowing you to set a higher priority for Prometheus during restarts, similar to blackbox exporter and node-exporter. This can be configured in the `values.yaml` file:

  ```yaml wrap theme={null}
  prometheus:
    priorityClassName: <valid-class-name>
  ```

  ### Bug fixes

  * Fixed an issue where Kubernetes Executor and Celery workers shared the same default resource values in 0.37.0, leading to potential overprovisioning or out-of-memory errors. Kubernetes Executor workers now use their own defaults, and the UI has been updated accordingly.
  * Fixed a bug where it was assumed all users not using Astronomer's ingress controller were on OpenShift. Users can now override the default `network.openshift.io/policy-group: ingress` label for ingress resources with the `ingressAllowedNamespaces` config option in the `values.yaml` file. `ingressAllowedNamespaces` will allow users to whitelist the namespaces from which ingress traffic will be allowed to `auth-sidecar`.

  ```yaml wrap theme={null}
  global:
    authSidecar:
      ingressAllowedNamespaces: [<namespace1>, <namespace2>]
  ```

  * Fixed an issue where Deployment rollbacks didn’t complete because the Airflow database downgrade job failed to start.
  * Fixed an issue where adding a new user to an existing local team unintentionally deselected an existing user if the team member lacked a fullName key.
  * Fixed an issue where the Elasticsearch exporter used the incorrect endpoint for readiness and liveness probes. This has been updated to align with version 1.9.0.
  * Fixed a bug that caused git-sync not to work with OpenShift clusters. Now, you can use git-sync with OpenShift clusters.
  * Fixed an issue where changing a GitSync deployment from polling to webhook mode in the UI showed an error instead of completing successfully.
  * Fixed an issue where running a pod with KubernetesPodOperator with XCom push enabled automatically pulled an image from an external repository. Now, the XCom sidecar container uses images from internal repositories by default, in line with our commitment to avoid external sources.
  * Fixed an issue where workspaceDeployment queries would return `"executor": null` incorrectly.
  * Fixed an issue where setting runAsUser or fsGroup to null in the podTemplate would break the KubeExecutor on OpenShift. Added support for configurable security context overrides in Pod templates.
  * Fixed an issue for OpenShift customers where the reworked GitSync relay component introduced a conflict with SCC privileges. GitSync would fail due to the default service account not falling within the required UID range when `global.sccEnabled` is set.
  * Fixed an issue where default quota calculations were too restrictive, causing Deployment updates to fail. The default quota is now adjusted for Deployments with `auth-sidecar`, `logging-sidecar`, and `dag-sync` enabled so that Deployments can update with default resources without any insufficient quota issues.
  * Fixed an issue where Deployments failed when namespacePools.enabled and sccEnabled were true.
  * Fixed a bug where `git-sync` containers were removed from Airflow Pods if you upgrade to 0.37.0 and then updated a pre-existing Git-sync Deployment.
  * Fixed an issue where Helm upgrades attempted to create a `ResourceQuota` even when `disableManageResourceQuotasAndLimitRanges: true` was set. Updates now correctly skip quota and limit management when the flag is enabled.
  * Fixed an issue where `dag-server` logs were not visible in the UI when using the Vector sidecar.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
  * [CVE-2021-39293](https://nvd.nist.gov/vuln/detail/CVE-2021-39293)
  * [CVE-2021-41771](https://nvd.nist.gov/vuln/detail/CVE-2021-41771)
  * [CVE-2021-41772](https://nvd.nist.gov/vuln/detail/CVE-2021-41772)
  * [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772)
  * [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806)
  * [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675)
  * [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921)
  * [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664)
  * [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131)
  * [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327)
  * [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879)
  * [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880)
  * [CVE-2022-29804](https://nvd.nist.gov/vuln/detail/CVE-2022-29804)
  * [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580)
  * [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630)
  * [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631)
  * [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632)
  * [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633)
  * [CVE-2022-30634](https://nvd.nist.gov/vuln/detail/CVE-2022-30634)
  * [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635)
  * [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149)
  * [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189)
  * [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715)
  * [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716)
  * [CVE-2022-41720](https://nvd.nist.gov/vuln/detail/CVE-2022-41720)
  * [CVE-2022-41722](https://nvd.nist.gov/vuln/detail/CVE-2022-41722)
  * [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723)
  * [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724)
  * [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725)
  * [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534)
  * [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536)
  * [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537)
  * [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538)
  * [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539)
  * [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540)
  * [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400)
  * [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403)
  * [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
  * [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
  * [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287)
  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
</Update>

<Update label="0.37.0" description="February 28, 2025">
  ### New astro deploy command options

  With the Astro CLI version 1.33 release, you can now use additional flags to deploy pre-built docker images from local or remote repositories. These flags include:

  * Use `--image-name` to specify a prebuilt docker image to deploy. This `image-name` can include a sha.
  * Specify a remote repository to deploy a specific image from using the `--remote` flag.
  * Declare a specific Astro Runtime version with `--runtime-version`.

  See [Deploy a prebuilt image](https://www.astronomer.io/docs/software/deploy-prebuilt) for more information about prebuilt images and [astro deploy](/docs/cli/v1.43/astro-deploy) for deploy options.

  ### New git-sync configuration options

  The [git-sync](https://github.com/kubernetes/git-sync) feature allows you to deploy DAGs to your Airflow Deployments directly from your GitHub repos, without additional CI/CD configuration. Previously, Astronomer Software had one possible configuration for git-sync, and it only supported DAG deploys and DAG deploy rollbacks. Now, you can customize your git-sync configuration to choose how to fetch changes from the git repo and how that code is stored and shared within the Airflow Deployment with the new flags, `repoShareMode` and `repoFetchMode`.

  * **Repo fetch mode:** How the git-sync relay retrieves changes from the configured GitHub repository. You can now choose between `poll` and `webhook`.
  * **Repo share mode:** How the git-sync relay propagates changes within the Airflow Deployment, from the git-sync relay Pod in the namespace to DAG directories. You can now choose between `git-daemon` and `shared-volumes`.

  Additionally, you can now roll back images only for git-sync deploy revisions through the UI and with the Houston API, allowing you to revert to previous stable images in case of deploy issues or failures. This does not roll back the git configurations.

  See [Configure git-sync code deploys](https://www.astronomer.io/docs/software/deploy-git-sync) for more information.

  ### Updated the Airflow DB Cleanup utility

  * Updated the Airflow DB Cleanup function so that it no longer requires a plugin installation to run.
  * The `purgeArchive` parameter has been replaced with the new parameter, `dropArchives`.
  * Changed the invoke method for the cleanup job from REST API to GraphQL.

  See [Clean up and delete task metadata from Airflow DB](https://www.astronomer.io/docs/software/clean-up-task-metadata).

  ### Define the defaults and limits for Custom Resources with Houston API

  You can now enable setting default, minimum, and independent limits for CPU and memory using Custom Resources with the Houston API, moving beyond the constraints of Astro Units (AUs). This improves flexibility and control over resource allocation. See [Use the Houston API on Astronomer Software](https://www.astronomer.io/docs/software/houston-api) and [Customize resource limits](https://www.astronomer.io/docs/software/customize-resource-usage).

  * `houston.config.deployments.componentsCustomDefaultsEnabled`
  * `houston.config.deployments.maxExtraCapacity.cpu`
  * `houston.config.deployments.maxExtraCapacity.memory`
  * `houston.config.deployments.maxPodCapacity.cpu`
  * `houston.config.deployments.maxPodCapacity.memory`

  You must enable Custom Defaults in the Houston `values.yaml` file. For best performance, [disable AUs](https://www.astronomer.io/docs/software/customize-resource-usage#disable-astronomer-units-aus-from-deployment-resource-configurations).

  ```yaml wrap theme={null}
  astronomer:
    houston:
      config:
        deployments:
          resourceProvisioningStrategy:
            astroUnitsEnabled: false
          componentsCustomDefaultsEnabled: true
  ```

  Then, configure your custom default values. The following example shows a custom definition for the Airflow Scheduler component.

  ```yaml wrap theme={null}
  components:
  - name: scheduler
    custom:
      default:
        cpu: 500
        memory: 1920
      minimum:
        cpu: 500
        memory: 1920
      limit:
        cpu: 3000
        memory: 11520
  ```

  See [Bring your own service accounts](https://www.astronomer.io/docs/software/byo-service-accounts) for more information about the `rbacEnabled` flag and the [Helm Chart Configuration reference](https://www.astronomer.io/docs/software/config-reference) for other options.

  ### Additional improvements

  * Improved the Airgapped Installation process by simplifying how Astronomer Software finds locally stored Runtime Release information with the new Houston configurations, `config.airgapped.enabled` and `runtimeReleasesConfigMapName`. Set the following configuration following [Install Astronomer Software in an Airgapped Environment](https://www.astronomer.io/docs/software/install-airgapped#fetch-airflow-updates) instructions:

  ```yaml wrap theme={null}
  astronomer:
    houston:
      runtimeReleasesConfigMapName: astro-runtime-base-images
      config:
        airgapped:
          enabled: true
  ```

  * Added the ability to disable Houston from passing `extra_au` and `extra_capacity` when creating a Deployment with the new parameter, `disableManageResourceQuotasAndLimitRanges`. When set to `true`, you can install Astronomer Software in environments with strict controls over resource quotas and limit ranges. Set to `false` by default. See [Disable management of quotas and limitranges](https://www.astronomer.io/docs/software/install-airgapped#disable-management-of-quotas-and-limitranges). Use the following configuration:

  ```yaml wrap theme={null}
  astronomer:
    houston:
      config:
        deployments:
          disableManageResourceQuotasAndLimitRanges: true
  ```

  <Warning>When setting `disableManageResourceQuotasAndLimitRanges: true`, all Pods running in the Astronomer Software application will be able to consume unlimited resources on the nodes that they are scheduled on, which can lead to cluster-wide instability. It is strongly advised that users manage their own resourceQuotas and limitRanges when setting `disableManageResourceQuotasAndLimitRanges: true`.</Warning>

  * To enhance security, extended default liveness and readiness probe behavior to additional components. See the complete list and information about configuring custom liveness and readiness probes in [Configure probes](https://www.astronomer.io/docs/software/configure-probes/).
  * Added the ability to define a service account name to all Pods, whether or not you use custom service accounts defined in your Service Account template or default values. See [Bring your own service accounts](https://www.astronomer.io/docs/software/byo-service-accounts) and [Astronomer Software Helm Chart Configuration reference](https://www.astronomer.io/docs/software/config-reference) for more details.
  * Added a more granular permission model for rollbacks, allowing users to roll back specific components, DAG or image, based on their assigned permissions. See [Granular rollback permissions](https://www.astronomer.io/docs/software/deploy-rollbacks) for more information.
  * Improved the `upsertDeployment` behavior so that it defaults to the latest available Runtime version when Runtime is enabled, and no Runtime or Airflow version is included.
  * Added the ability to configure extra annotations that get added to all Airflow ingresses by defining them with `global.extraAnnotations`.
  * Added the ability to set global and per-component Pod annotations in the `values.yaml` chart with the new configuration variable, `podAnnotations`. See [Helm chart config reference](https://www.astronomer.io/docs/software/config-reference) for more details.
  * Added the ability to use the UI to configure the `request` and `limit` for CPU and memory used by default for KubernetesExecutor Pods. See more about [configuring custom resources in the UI](https://www.astronomer.io/docs/software/customize-resource-usage/#set-custom-resource-usage-in-the-software-ui).
  * Added the ability to disable the Prometheus self-scrape functionality, which can consume an outsized amount of memory when enabled. If you want to disable the self-scrape functionality, set the `enableSelfScrape` parameter to `false` in your Prometheus `values.yaml` file. This parameter is set to `true` by default:

  ```yaml wrap theme={null}
  prometheus:
      config:
          enableSelfScrape: false
  ```

  * Added the ability to install Astronomer Software without granting Prometheus a cluster-level access role. You can set `prometheus.rbac.role.kind` and `prometheus.rbac.role.create` to scope Prometheus-specific roles that can override a global configuration that permits creating other components with cluster-level roles. Use the following configuration:

  ```yaml wrap theme={null}
  global:
    rbacEnabled: true
    clusterRoles: true
  prometheus:
    rbac:
      role:
        kind: Role
        create: true
  ```

  Or, you can disable creating any components with cluster roles, and configure the Prometheus RBAC role specifically.

  ```yaml wrap theme={null}
  global:
    rbacEnabled: false
    clusterRoles: false
  prometheus:
    rbac:
      role:
        kind: Role
        create: true
  ```

  * Added a new docs page, [Astronomer Software Helm Chart Configuration reference](https://www.astronomer.io/docs/software/config-reference), that contains descriptions of all flag options for a particular version of Software, starting with version 0.36.
  * git-sync now sets the modify time of each file to its last git commit date.

  ### Behavior changes

  <Danger>
    Astronomer Certified (AC) is no longer supported by Astronomer Software starting in Software v0.37. You must upgrade all existing Deployments from AC to Runtime to upgrade to Software 0.37.

    See [Migrate to Runtime](https://www.astronomer.io/docs/software/migrate-to-runtime) for migration instructions.
  </Danger>

  * The Astronomer Software package, `cli-install` has been deprecated. Use the instructions at [Install the CLI](/docs/cli/v1.43/install-cli) to install the Astro CLI instead.
  * Removed unused Commander permissions that are not needed for deploys or namespace pool management.
  * You can now deploy Airflow images that end in `@sha256` when using the Astro CLI or Houston API.
  * As of OpenShift 4.11, only Ingress objects annotated with `route.openshift.io/termination: "edge"` are supported for generating routes. You must update your Ingress configurations to use Edge termination for route generation to function properly. If you're on an older version of OpenShift, route creation should be done manually. See [Required Environment Configuration for OpenShift](/docs/astro-private-cloud/v-0-37/third-party-ingress-controllers#required-environment-configuration-openshift).
  * The image tags for `statsd`, `redis`, `pgbouncer`, `pgbouncerExporter`, and `gitSync` are now specified in `global.airflow.images`. If you have configured custom image values for these components, you will now need to update those configurations under `global.airflow.images` to ensure they are properly applied.
  * Removed the need to set the Runtime version on the Astronomer Software UI prior to performing a Runtime upgrade. You can now skip this extra step and can directly perform the upgrade via the CLI or Houston API with the new Runtime version. See [Upgrade Astro Runtime](/docs/runtime/manage-airflow-versions) for more information. If you want to follow the legacy workflow, you must change the feature flag, `disableDesiredRuntimeVersion`, in your Houston API `values.yaml` configuration to `false`:

  ```yaml wrap theme={null}
  astronomer:
      houston:
          config:
              deployments:
                  disableDesiredRuntimeVersion: false
  ```

  ### Bug fixes

  * Fixed a bug with the PostgreSQL service pod that caused inefficient resource utilization or conflicts with other services running on the same nodes. Now, the PostgreSQL service pod has a dedicated node pool to enable administrators to assign the database to a dedicated or optimized set of nodes.
  * Fixed a bug where the PostgreSQL service did not adopt the existing service account model convention, causing inconsistencies in service account configurations.
  * Fixed a bug where if `global.storageClass` was configured, you could not override it by configuring specific components. Now, you can set a global `storageClass` configuration, and modify it with specific component definitions, such as `prometheus.storageClass`.
  * Fixed a bug with the Software UI that prevented teams with hyphens in the name from being added with IDP.
  * Fixed a bug where the UI would only display defaultExtraAu and defaultExtraCapacity settings for the KubernetesExecutor, when it was configured for all executorsfor.
  * Fixed a bug where Service Accounts were created using the default template, when they should be using custom configurations.
  * Fixed a whitespace related shell bug that caused Airflow to fail to run DAG files that contained spaces in their filenames when sidecar logging was enabled.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-37370](https://nvd.nist.gov/vuln/detail/CVE-2024-37370)
  * [CVE-2024-37371](https://nvd.nist.gov/vuln/detail/CVE-2024-37371)
  * [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337)
  * [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535)
</Update>

<Update label="0.36.1" description="March 18, 2025">
  ### Add custom annotations to the Kibana ingress controller chart

  You can now define custom ingress annotations in the Kibana `values.yaml` chart with the new configuration, `ingressAnnotations`. Customizing annotations allows you to extend ingress functionality and enable integration with third-party tools, such as monitoring systems, security services, or cloud provider-specific features.

  To add custom annotations, you must add `ingressAnnotations` to your Kibana controller chart, using annotations compatible for any controller.

  For example, you can choose one of the [nginx annotations](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md) to customize its behavior. The following example shows an example of how you can configure your whether or not your Kibana instance receives nginx opentelemetry data with the [`nginx.ingress.kubernetes.io/enable-opentelemetry` annotation](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#configuration-snippet).

  ```yaml wrap theme={null}
  kibana:
    ingressAnnotations:
      nginx.ingress.kubernetes.io/enable-opentelemetry: "true"
  ```

  For more detail about related functionality, see:

  * [Use a third-party ingress controllers](https://www.astronomer.io/docs/software/0.36/third-party-ingress-controllers)

  ### New feature flag to disable Apollo GraphQL Playground

  If you prefer to allow users to only access the new GraphQL IDE, you can disable access to the original Apollo GraphQL Playground, with a new feature flag. The Apollo GraphQL Playground makes external requests to load assets like JavaScript, CSS, and other resources from external URLs, which means it cannot be used in an airgapped environment or in cases where strict security requirements apply.

  To disable the Apollo GraphQL Playground, set the `graphqlPlaygroundEnabled` feature flag to `false` in your Houston API configuration in the `config.yaml` file:

  ```yaml wrap theme={null}
  astronomer:
    houston:
      config:
        graphqlPlaygroundEnabled: false

  ```

  ### Additional improvements

  * Improved the `upsertDeployment` behavior so that it defaults to the latest available Runtime version when Runtime is enabled, and no runtime or Airflow version is included.
  * System admins can now remove the last remaining Deployment or Workspace admin.
  * Added support for deploying Airflow in namespaces with the Pod Security Standard set to restricted mode when using Namespace Pools. All containers will have `runAsNonRoot: true` by default.

  ### Behavior changes

  * The image tags for `statsd`, `redis`, `pgbouncer`, `pgbouncerExporter`, and `gitSync` are now specified in `global.airflow.images`. If you have configured custom image values for these components, you will now need to update those configurations under `global.airflow.images` to ensure they are properly applied.

  ### Bug fixes

  * Fixed a bug where if `global.storageClass` was configured, you could not override it by configuring specific components. Now, you can set a global `storageClass` configuration, and modify it with specific component definitions, such as `prometheus.storageClass`.
  * Fixed a whitespace related shell bug that caused airflow to fail to run dag files that contained spaces in their filenames when sidecar logging was enabled.
  * Fixed a bug where the PostgreSQL service did not adopt the existing service account model convention, causing inconsistencies in service account configurations.
  * Fixed an issue where outdated values persisted in the Airflow subchart after redeployment. The fix ensures that absent values are removed, preventing stuck image versions.
  * Fixed a bug where `KubernetesPodOperator` Pods with `xcom_push` enabled pulled an external image for the XCom sidecar. It now uses the configured private repository.
  * Fixed a bug where local users could not be added to groups if `manageSystemPermissionsViaIdpGroups.enabled` was `true`.
  * Fixed an issue in the Astronomer Deployment UI where variable section inputs were not trimmed for leading or trailing whitespaces.
  * Fixed an issue where users removed from an organization in Entra ID (without SCIM) were not automatically removed from Astronomer teams. System Admins can now clean up these inactive IDP-managed users, including those with attached teams, if they have the `system.user.forceDelete` permission.
  * Fixed a bug with the Software UI that prevented teams with hyphens in the name from being added with IDP.
  * Fixed a bug where the `deploymentRemoveTeamRole` mutation did not delete the specified team ID from the specified Deployment. Now, the delete team function works as expected.
  * Fixed an issue where adding a new user to an existing local team unintentionally deselected an existing user if the team member lacked a `fullName` key.
  * Fixed an issue where the CLI incorrectly called an API requiring a Workspace ID when fetching all Deployments. The CLI now uses the correct API to return all Deployments across Workspaces.
  * Fixed an issue where `global.loggingSidecar.repository` was ignored, and the DAG server continued to pull the sidecar logging image from the default `quay.io/astronomer`. The DAG server now correctly pulls the image from the specified custom repository.
  * Fixed an issue where `workspaceDeployment` queries would return `"executor": null` incorrectly.
  * Fixed a bug with the Okta Scim GET API where the `name_provider` query filter was not working as expected.
  * Fixed an issue where default quota calculations were too restrictive, causing Deployment updates to fail. The default quota is now adjusted for Deployments with `auth-sidecar`, `logging-sidecar`, and `dag-sync` enabled so that Deployments can update with default resources without any insufficient quota issues.
  * Fixed a bug that caused git-sync not to work with OpenShift clusters. Now, you can use git-sync with OpenShift clusters.
  * Fixed an issue where setting `runAsUser` or `fsGroup` to `null` in the podTemplate would break the KubeExecutor on OpenShift. Added support for configurable security context overrides in Pod templates.
  * Fixed an issue where Deployments failed when `namespacePools.enabled` and `sccEnabled` were `true`.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-12797](https://nvd.nist.gov/vuln/detail/CVE-2024-12797)
  * [CVE-2024-21538](https://nvd.nist.gov/vuln/detail/CVE-2024-21538)
  * [CVE-2024-24788](https://nvd.nist.gov/vuln/detail/CVE-2024-24788)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-25710](https://nvd.nist.gov/vuln/detail/CVE-2024-25710)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-37370](https://nvd.nist.gov/vuln/detail/CVE-2024-37370)
  * [CVE-2024-37371](https://nvd.nist.gov/vuln/detail/CVE-2024-37371)
  * [CVE-2024-37890](https://nvd.nist.gov/vuln/detail/CVE-2024-37890)
  * [CVE-2024-39338](https://nvd.nist.gov/vuln/detail/CVE-2024-39338)
  * [CVE-2024-4068](https://nvd.nist.gov/vuln/detail/CVE-2024-4068)
  * [CVE-2024-4367](https://nvd.nist.gov/vuln/detail/CVE-2024-4367)
  * [CVE-2024-45296](https://nvd.nist.gov/vuln/detail/CVE-2024-45296)
  * [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337)
  * [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338)
  * [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554)
  * [CVE-2024-55549](https://nvd.nist.gov/vuln/detail/CVE-2024-55549)
  * [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254)
  * [CVE-2024-8176](https://nvd.nist.gov/vuln/detail/CVE-2024-8176)
  * [CVE-2025-24855](https://nvd.nist.gov/vuln/detail/CVE-2025-24855)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
</Update>

<Update label="0.36.0" description="November 13, 2024">
  ### Set resource requests and limits to Pods in the Astronomer namespace

  You can now set resource requests and limits for all Pods in the Astronomer namespace, which provides more granular control over resource allocation. This helps to ensure that applications have adequate CPU and memory resources, without over-provisioning or under-provisioning.

  ### Use a MySQL or PostgreSQL database as a metadata or results backend database

  When you create, update, or upsert a Deployment with the Houston API, you can now use the new parameters, `metadataConnectionJson` and `resultBackendConnectionJson` to configure Airflow to use an external database. If you disable the default `pgbouncer` proxy, use `metadataConnection` and `resultBackendConnection` for your external database. See [Use a MySQL or PostgreSQL database for metadata or storage](https://www.astronomer.io/docs/software/multi-db) for setup information.

  ### Bring your own service accounts

  You can now configure pre-created Service Accounts (SAs) for all Astronomer and Airflow components or choose to use the default service account configuration. You can also use the [registry template](https://github.com/astronomer/astronomer/blob/master/charts/astronomer/templates/registry/registry-serviceaccount.yaml) to create your custom SAs.

  Additionally, this feature allows you to disable Astronomer from creating Roles, RoleBindings, and other SAs in the namespace by setting the global config `rbacEnabled` to `false`.

  ```yaml wrap theme={null}
  global:
    rbacEnabled: false
  ```

  ### New Astronomer Software GraphQL IDE available

  A new IDE is available at `/v1/playground` as part of the latest update at `https://houston.<your-base-domain>/v1/playground`. Please note that [the default GraphQL Playground](https://www.astronomer.io/docs/software/houston-api/#develop-and-test-houston-api-queries) remains accessible at `https://houston.<your-base-domain>/v1`. This new IDE provides enhanced features for a better development experience, while maintaining access to the existing playground for continuity. To learn more about the GraphQL playground, see [Develop and test Houston API queries](https://www.astronomer.io/docs/software/houston-api/#develop-and-test-houston-api-queries).

  ### Additional improvements

  * You can now configure the resource sizes and limits for the triggerer through the UI or programmatically.

  * Enhanced the automatically generated description that appears in the **Deploy History**, providing you with improved metadata about your code deploys.

  * Added the `fluent-plugin-datadog` gem to fluentd and upgraded the fluentd version to version 0.14.4.

  * Included the ability to disable creation of service accounts and rolebindings for the `dag-deploy` server. Use the following configuration:
    ```yaml wrap theme={null}
    global:
      dagOnlyDeployment:
        enabled: true
        serviceAccount:
          create: false
    ```

  * You can now create an IdP group by selecting the source type from the full list of sources that are supported by Astronomer Software, including **Local**, **Okta**, and **Microsoft**. This means you do not need a user to log in to the IdP provider to be able to create new Teams. See [Import Identity Provider Groups](https://www.astronomer.io/docs/software/import-idp-groups).

  * Added the ability for ingress-nginx to run with the `CAPABILITY_DROP ALL` option. This configuration ensures that the NGINX pods run with no Linux capabilities, providing a more secure environment by reducing privileges.

  * Removed some environment variables used for UI error reporting to Astronomer.

  * You can now globally configure the `cpu` and `memory` limits and requests for auth-sidecar. The following shows an example configuration for your `config.yaml`:

    ```yaml wrap theme={null}
    global:
      authSidecar:
        enabled: true
        resources:
          requests:
            cpu: "100m"
            memory: "256Mi"
          limits:
            cpu: "1000m"
            memory: "256Mi"
    ```

  * You can now set the DAG-deploy security context for containers and pods individually using the following code.
    For container security contexts:

    ```yaml wrap theme={null}
    securityContexts:
      container:
        fsGroup: 50000
    ```

    For pod security contexts:

    ```yaml wrap theme={null}
    securityContexts:
      pod:
        fsGroup: 50000
    ```

  ### Behavior changes

  <Danger>
    **Breaking change**

    Astronomer Software v0.36 introduces new behavior when defining customizations for liveness and readiness probes for each component.

    If you have previously customized liveness and readiness probes, you must now define the full probe in your `values.yaml` file. See [Configure liveness and readiness probes](https://www.astronomer.io/docs/software/configure-probes).
  </Danger>

  * The configuration for `global.dagOnlyDeployment.image` is now deprecated. To use global configs for DAG-only deploys, use the `global.dagOnlyDeployment.repository` and `tag` parameters instead. For example, use:

    ```yaml wrap theme={null}
    global:
      dagOnlyDeployment:
        enabled: false
        repository: quay.io/astronomer/ap-dag-deploy
        tag: 0.5.3
    ```
  * The configuration for `global.loggingSidecar.image` is now deprecated. To use global configs for sidecar logging, use the `global.loggingSidecar.repository` and `tag` parameters instead. For example, use:

    ```yaml wrap theme={null}
    global:
      loggingSidecar:
        enabled: false
        repository: quay.io/astronomer/ap-vector
        tag: 0.40.2-1
    ```
  * Now, you can create a custom tls secret name by defining the `tlsSecret` value. Previously, the configuration for `global.tlsSecret` was defined as `astronomer-tls` by default, and could not be changed. The following example shows how to define the custom name as `astronomer-secret`:

    ```yaml wrap theme={null}
    global:
      tlsSecret: "astronomer-secret"
    ```
  * By default, the Astronomer Software install does not require elevated privileges. This means that the Software container ports are limited to `1024` or greater by default. If you need your install to have exceptions for privileged access, you can update the `controller` settings in the Helm configs.yaml file by using the following:

    ```yaml wrap theme={null}
      nginx:
        securityContext:
          capabilities:
            drop:
              - ALL
            add:
              - NET_BIND_SERVICE
        allowPrivilegeEscalation: true
    ```
  * The OSS Airflow chart version has been updated to 1.13.5.

  ### Bug fixes

  * Fixed a bug where the DAG server `securityContext` caused Deployment issues.
  * Fixed a problem during the installation process where sometimes a DNS record was required before it could be created.
  * Fixed a bug where elasticsearch did not work with tags that are not a semver.
  * Resolved an issue where a Deployment rollback failed when rolling back to a version used in a Deployment created by a `dag-only` code deploy.
  * Fixed a bug where Pods would sometimes run on Nodes that did not match the nodeSelector criteria.
  * Resolved a bug where if you enabled `MANUAL_NAMESPACES_MODE` to prevent Commander from creating namespaces automatically, they might still be created. Now, if you enable manual namespace creation, Astronomer Software does not create or edit namespace labels.

  ### Security fixes

  Resolved the following vulnerability:

  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
</Update>

<Update label="0.35.4" description="October 14, 2024">
  ### Bug fixes

  * Fixed a bug involving user profile permissions for DAG-only deploys.
</Update>

<Update label="0.35.3" description="October 4, 2024">
  ### Additional improvements

  * Improved the Deployment Rollbacks user experience by alerting you when you enable or disable rollbacks.
  * Added a new tab, **AirflowDowngrade**, to the **Logging** UI to show Deployment rollback status logs.
  * Added a new tab, **DagServer**, to the **Logging** UI to show DAG server events, without requiring you to log in to the kubernetes cluster.
  * You can now configure [K8s tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) to the containerd DaemonSet. The following example shows a configuration to enable this functionality. Your specific configuration values might be different:

    ```yaml wrap theme={null}
    global:
      privateCaCertsAddToHost:
        addToContainerd: true
        containerdTolerations:
        - effect: NoExecute
          key: special-purpose
          operator: Equal
          value: workers-spot-vms
        enabled: true
    ```

  ### Behavior changes

  * Removed PSP features.

  ### Bug fixes

  * Fixed a bug with fluentd liveness probes where `periodSeconds` was erroneously called `periodSeconds5`. You can now set `periodSeconds` with `periodSeconds`, as expected.
  * Resolved an issue which created two entries in the deploy revision history when you executed the `astro deploy` command for Deployments with DAG-only deploys enabled. Now, this type of deploy scenario creates a single entry in Deploy History page. Requires [Astro CLI version 1.29](/docs/cli/v1.43/release-notes#astro-cli-1-29-0) or higher.
  * Fixed a bug where switching between Image and DAG-only deploys would cause the scheduler to disappear. Now you can switch between deploy types without affecting the scheduler.
  * Fixed a bug where users with insufficient permissions could edit service accounts. See [See System permissions on Software](/docs/astro-private-cloud/v-0-37/manage-platform-users#system-permissions-on-software) for more information about user permissions.
  * Fixed a bug where HA scheduler pods were all taken down simultaneously when doing a deploy.
  * Resolved an issue that sometimes caused out of memory errors during db migration.
  * Fixed a bug when Workspace Admins search for Deployments in a Workspace, they would not see results for the Deployments they didn't directly belong to.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-2398](https://nvd.nist.gov/vuln/detail/CVE-2024-2398)
  * [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-26147](https://nvd.nist.gov/vuln/detail/CVE-2024-26147)
  * [CVE-2024-26308](https://nvd.nist.gov/vuln/detail/CVE-2024-26308)
  * [CVE-2024-28757](https://nvd.nist.gov/vuln/detail/CVE-2024-28757)
  * [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156)
  * [CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110)
</Update>

<Update label="0.35.2" description="August 1, 2024">
  ### End of support for Kubernetes versions 1.25 and 1.26

  Kubernetes versions 1.25 and 1.26 are not supported in Software version 0.35.2 and future versions. See [Kubernetes version support table and policy](https://www.astronomer.io/docs/software/version-compatibility-reference#kubernetes-version-support-table-and-policy) for a full list of supported Kubernetes versions and the Software versions they correspond to.

  ### Additional improvements

  * The Astronomer Software UI now lists yanked versions of the Astro Runtime. These versions contain potential bugs and are to be used as per user discretion. See [Restricted Runtime versions](/docs/runtime/runtime-version-lifecycle-policy#restricted-runtime-versions) for more information about yanked versions.
  * Added `priorityClass` support for `fluentd` and `prometheus-node-exporter` daemonsets. Include the following configuration to use this functionality.

    ```yaml wrap theme={null}
    fluentd:
      priorityClassName: <valid-class-name>
    prometheus-node-exporter:
      priorityClassName: <valid-class-name>
    ```
  * Added support for `extraEnv` to `fluentd` so that you can pass custom variables. You can use the following configuration for this functionality:

    ```yaml wrap theme={null}
    fluentd:
      extraEnv:
        RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR: 1
    ```
  * Added persistence section to the DAG server config, which can be passed to the Airflow Helm chart.

    ```yaml wrap theme={null}
    global:
      dagOnlyDeployment:
        enabled: true
        persistence:
          persistentVolumeClaimRetentionPolicy:
            whenDeleted: Delete
            whenScaled: Retain
    ```

  ### Behavior changes

  * When [migrating to an Astro Runtime from Astronomer Certified (AC)](https://www.astronomer.io/docs/software/migrate-to-runtime#differences-between-astro-runtime-and-astronomer-certified), only AC Versions that are 2.2.5 and greater have equivalent Runtime versions. Previously, you could see equivalent versions of the Astro Runtime you could choose to migrate to in the UI. Now, to see the equivalent version of Astro Runtime for a Deployment running AC in the **Deployment Settings** page, you need to set the following configuration:

    ```yaml wrap theme={null}
    astronomer:
      houston:
        config:
          deployments:
            enableListAllRuntimeVersions: true
    ```

  ### Bug fixes

  * Fixed a bug where the DAG server on Openshift platform failed to replace default security context Helm values.
  * Fixed a bug that causes DAG-only deploys to fail when rollbacks were disabled.
  * Fixed a bug in DAG-only deploys that were causing unhandled exceptions.
  * Fixed a bug that caused the DAG folder PVC to be depleted when a user switches from DAG-only deploys to any other code deploy type.
  * Fixed a bug in the deploy revision history page in the Astronomer Software UI that caused the date range query to fail if you set it to less than 90 days for the cleanup policy.
</Update>

<Update label="0.35.1" description="July 15, 2024">
  ### Security fix for DAG-only deploys

  Fixed an issue where if you had a DAG-only deploy, it was possible for users to access its dag-server from any other kubernetes namespace. See [Upgrade considerations for 0.35](https://www.astronomer.io/docs/software/upgrade-astronomer#upgrade-to-astronomer-software-035) for more details about the security fix.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45283](https://github.com/advisories/GHSA-vvjp-q62m-2vph)
  * [CVE-2023-45288](https://github.com/advisories/GHSA-4v7x-pqxf-cx7m)
  * [CVE-2024-24790](https://github.com/advisories/GHSA-49gw-vxvf-fc2g)
  * [CVE-2023-39325](https://github.com/advisories/GHSA-4374-p667-p6c8)
</Update>

<Update label="0.35.0" description="July 1, 2024">
  ### Use deploy rollbacks to run previous versions of your code

  Deploy rollbacks are a new way to ensure that your Deployments can keep running after a broken code deploy or upgrade. When you trigger a rollback to a past deploy, your previous image and/or DAG code are redeployed and start running.

  To configure deploy rollbacks, see [Deploy rollbacks](/docs/astro-private-cloud/v-0-37/deploy-rollbacks).

  ### Support for MySQL

  You can now configure Astronomer Software to use a MySQL database as the backend for both Houston and your Airflow Deployments. To connect your Astronomer Software installation to a MySQL database, you update the `astronomer-bootstrap` secret in your cluster to point to your database:

  ```sh wrap theme={null}
  kubectl create secret generic astronomer-bootstrap \
    --from-literal connection="jdbc:mysql://host1:33060/mydb" \
    --namespace astronomer
  ```

  ### Create Teams without using an IdP

  Astronomer [Teams](/docs/astro-private-cloud/v-0-37/import-idp-groups) can now be created without associating the team to an existing identity provider (IdP) group. Use local Teams to efficiently manage permissions for groups that might not exist in your identity provider.

  ### Additional improvements

  * DAG-only deploys are now fully compatible with OpenShift clusters.
  * You can now set a `priorityClass` to pods created by `templates/trust-private-ca-on-all-nodes/containerd-daemonset.yaml`. This allows you to set a high priority class for certain pods to force an evication for important processes.

  ### Bug fixes

  * The Astro CLI now shows an error if you attempt to deploy code to a Software installation where `astronomer.houston.config.deployments.registry.protectedCustomRegistry.updateRegistry.host` is not set.
  * Fixed an issue where Jetstream resources were being created even when `global.nats.jetStream.enabled = false` in the Software platform configuration.
  * Fixed an issue where the default `astroUnitsEnabled` value in `values.yaml` was not respected when creating Deployments via the Houston API, resulting in Deployment creation failing when the resource strategy is not explicitly specified.
  * Fixed an issue where Houston could produce errors if the password for a Postgres database included special characters.
  * Fixed an issue where pagination on specific Software UI screens did not behave as expected.
  * Fixed an issue where the `lastUsedAt` data for a service account was not updated when the service account deployed an Airflow image.
  * Fixed a bug causing disruption to retrieval of logs for users with External Elasticsearch.
  * Fixed a bug where a blank page is displayed when navigating to the user detail of a user who has been invited to a Workspace, but have not yet accepted an invitation.
  * Fixed an issue where a pod limit was enforced for a custom resource based Deployment with the K8s executor.
  * Fixed a bug where the pgbouncer calculator failed to provision Deployment resources.
  * Resolved an issue where switching from DAG deploy to image deploy caused an error state.
  * Fixed an issue where the Astro Runtime 11.2.0 wouldn't load the webserver when creating a Deployment.
  * Fixed a bug where containerd images failed to load for some cloud providers.
  * Fixed an issue where a patch error occurred during an Astro Runtime upgrade when Pod Disruption Budget (PDB) was enabled.
  * Resolved an issue where custom based resource Deployments were converted to AU-based after a platform upgrade.
  * Fixed a bug where the dag-deploy server pod failed in OpenShift due to an fsGroup error.
  * Fixed a bug that sometimes prevented `dagDeployment` server and client resources from being configurable.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
  * [GHSA-9763-4f94-gfch](https://github.com/advisories/GHSA-9763-4f94-gfch)
  * [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
  * [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626)
  * [CVE-2024-25710](https://nvd.nist.gov/vuln/detail/CVE-2024-25710)
  * [CVE-2024-26147](https://nvd.nist.gov/vuln/detail/CVE-2024-26147)
  * [CVE-2024-26308](https://nvd.nist.gov/vuln/detail/CVE-2024-26308)
  * [CVE-2024-28757](https://nvd.nist.gov/vuln/detail/CVE-2024-28757)
  * [CVE-2024-36361](https://nvd.nist.gov/vuln/detail/CVE-2024-36361)
</Update>

<Update label="0.34.5" description="November 26, 2024">
  ### New Astronomer Software GraphQL IDE improvements

  A new IDE is available at `/v1/playground` as part of the latest update at `https://houston.<your-base-domain>/v1/playground`. Please note that [the default GraphQL Playground](/docs/astro-private-cloud/v-0-37/houston-api#develop-and-test-houston-api-queries) remains accessible at `https://houston.<your-base-domain>/v1`. This new IDE provides enhanced features for a better development experience, while maintaining access to the existing playground for continuity.

  If you prefer to allow users to only access the new GraphQL IDE, you can disable access to the original Apollo GraphQL Playground, with a new feature flag. The Apollo GraphQL Playground makes external requests to load assets like JavaScript, CSS, and other resources from external URLs, which means it cannot be used in an airgapped environment or in cases where strict security requirements apply.

  To disable the Apollo GraphQL Playground, set the `graphqlPlaygroundEnabled` feature flag to `false` in your Houston API configuration in the`config.yaml` file:

  ```yaml wrap theme={null}
  astronomer:
    houston:
      config:
        graphqlPlaygroundEnabled: false

  ```

  To learn more about the GraphQL IDE, see [Develop and test Houston API queries](/docs/astro-private-cloud/v-0-34/houston-api).

  ### Add custom annotations to the Kibana ingress controller chart

  You can now define custom ingress annotations in the Kibana `values.yaml` chart with the new configuration, `ingressAnnotations`. Customizing annotations allow you to extend ingress functionality and enable integration with third-party tools, such as monitoring systems, security services, or cloud provider-specific features.

  To add custom annotations, you must add `ingressAnnotations` to your Kibana controller chart, using annotations compatible for any controller.

  For example, you can choose one of the [nginx annotations](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md) to customize its behavior. The following example shows an example of how you can configure your whether or not your Kibana instance receives nginx opentelemetry data with the [`nginx.ingress.kubernetes.io/enable-opentelemetry` annotation](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#configuration-snippet).

  ```yaml wrap theme={null}
  kibana:
    ingressAnnotations:
      nginx.ingress.kubernetes.io/enable-opentelemetry: "true"
  ```

  For more detail about related functionality, see:

  * [Use a third-party ingress controllers](https://www.astronomer.io/docs/software/0.34/third-party-ingress-controllers)

  ### Additional improvements

  * You can now globally configure the `cpu` and `memory` limits and requests for auth-sidecar. The following shows an example configuration for your `config.yaml`:

  ```yaml wrap theme={null}
  global:
    authSidecar:
      enabled: true
      resources:
        requests:
          cpu: "100m"
          memory: "256Mi"
        limits:
          cpu: "1000m"
          memory: "256Mi"
  ```

  * Updated `kube-state-metrics` to [v2.14.0](https://github.com/kubernetes/kube-state-metrics/releases/tag/v2.14.0)
  * Updated `fluentd` to [v1.17.1](https://www.fluentd.org/blog/fluentd-v1.17.1-has-been-released)

  ### Bug fixes

  * Fixed a bug where Google Chrome users could not access a GraphQL playground. Chrome users can now access the new playground at `https://houston.<your-base-domain>/v1/playground`. See [Develop and test Houston API queries](/docs/astro-private-cloud/v-0-34/houston-api) for more information.
  * Fixed a bug where the `deploymentRemoveTeamRole` mutation did not delete the specified team ID from the specified Deployment. Now, the delete team function works as expected.
  * Fixed a bug in the UI where a Kibana configuration recommendation would erroneously appear.

  ### Security fixes

  * [CVE-2024-7646](https://nvd.nist.gov/vuln/detail/CVE-2024-7646)
  * [CVE-2024-21538](https://nvd.nist.gov/vuln/detail/CVE-2024-21538)
  * [CVE-2024-37370](https://nvd.nist.gov/vuln/detail/CVE-2024-37370)
  * [CVE-2024-37371](https://nvd.nist.gov/vuln/detail/CVE-2024-37371)
  * [CVE-2024-45296](https://nvd.nist.gov/vuln/detail/CVE-2024-45296)
</Update>

<Update label="0.34.4" description="October 14, 2024">
  ### Additional improvements

  * For Deployments with DAG-only deploys, added a new tab, **DagServer**, to the **Logging** UI to show DAG server events, without requiring you to log in to the Kubernetes cluster.
  * You can now configure [K8s tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) to the containerd DaemonSet. The following example shows a configuration to enable this functionality. Your specific configuration values might be different:

    ```yaml wrap theme={null}
    global:
      privateCaCertsAddToHost:
        addToContainerd: true
        containerdTolerations:
        - effect: NoExecute
          key: special-purpose
          operator: Equal
          value: workers-spot-vms
        enabled: true
    ```

  ### Bug fixes

  * Fixed a bug with Fluentd liveness probes where `periodSeconds` was erroneously called `periodSeconds5`. You can now set `periodSeconds` with `periodSeconds`, as expected.
  * Fixed a bug where switching between Image and DAG-only deploys would cause the scheduler to disappear. Now you can switch between deploy types without affecting the scheduler.
  * Fixed a bug where users with insufficient permissions could edit service accounts. See [See System permissions on Software](/docs/astro-private-cloud/v-0-37/manage-platform-users#system-permissions-on-software) for more information about user permissions.
  * Fixed a bug where HA scheduler Pods were all taken down simultaneously when doing a deploy.
  * Resolved an issue that sometimes caused out of memory errors during db migration.
  * Fixed a bug involving user profile permissions for DAG-only deploys.
  * Fixed a bug when Workspace Admins search for Deployments in a Workspace, they would not see results for the Deployments they didn't directly belong to.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
  * [CVE-2023-50387](https://nvd.nist.gov/vuln/detail/CVE-2023-50387)
  * [CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)
  * [CVE-2024-2961](https://nvd.nist.gov/vuln/detail/CVE-2024-2961)
  * [CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626)
  * [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790)
  * [CVE-2024-28757](https://nvd.nist.gov/vuln/detail/CVE-2024-28757)
  * [CVE-2024-33599](https://nvd.nist.gov/vuln/detail/CVE-2024-33599)
</Update>

<Update label="0.34.3" description="July 17, 2024">
  ### Security fix for DAG-only deploys

  Fixed an issue where if you had a DAG-only deploy, it was possible for users to access its dag-server from any other kubernetes namespace. See [Upgrade considerations for 0.34](https://www.astronomer.io/docs/software/upgrade-astronomer#upgrade-to-astronomer-software-034) for more details about the security fix.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-45283](https://github.com/advisories/GHSA-vvjp-q62m-2vph)
  * [CVE-2023-45288](https://github.com/advisories/GHSA-4v7x-pqxf-cx7m)
  * [CVE-2024-24790](https://github.com/advisories/GHSA-49gw-vxvf-fc2g)
  * [CVE-2023-39325](https://github.com/advisories/GHSA-4374-p667-p6c8)
</Update>

<Update label="0.34.2" description="May 31, 2024">
  ### Additional improvements

  * DAG-only deploys are now fully compatible with OpenShift clusters.

  * You can now configure resource usage for the DAG-only deploy server in your `values.yaml` file like in the following example:

    ```yaml wrap theme={null}
    global:
      dagOnlyDeployment:
        enabled: true
        resources:
          limits:
            cpu: 100m
            memory: 400Mi
          requests:
            cpu: 100m
            memory: 400Mi
    ```

  * You can now configure a priorityClass for all Pods created by the Containerd daemonset. This ensures that Pods generated by the daemonset can be reliably spun up on new nodes whenever they're removed from an existing node. To configure this, add the following lines to your `values.yaml` file and apply the configuration to your platform:

    ```yaml wrap theme={null}
    global:
      privateCaCertsAddToHost:
        enabled: true
        addToContainerd: true
        priorityClassName: <priority-class-name>
    ```

  ### Bug fixes

  * Fixed an issue where larger DAG deploys had significant performance issues.
  * Fixed an issue where Deployments using custom resources would be reverted to using AUs when you upgraded the Astronomer Software platform using Helm.
  * Fixed an issue where the default `astroUnitsEnabled` value in `values.yaml` was not respected when creating Deployments via the Houston API, resulting in Deployment creation failing when the resource strategy is not explicitly specified.
  * Fixed an issue where using a service account to deploy DAGs without the Astro CLI would result in the service account's `lastUsedAt` value not updating as expected.
  * Fixed an issue where creating Deployments would fail when using the `airflowStratV2` PGBouncer calculation strategy.
  * Fixed an issue where upgrading within the 0.34 series could disrupt external Elasticsearch configurations.
  * Fixed an issue where tasks on a Deployment could start to fail if the Deployment used a custom resource strategy, used the Kubernetes executor, and attempted to run many tasks at once.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
  * [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
  * [CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626)
  * [CVE-2024-25062](https://nvd.nist.gov/vuln/detail/CVE-2024-25062)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
  * [CVE-2024-28757](https://nvd.nist.gov/vuln/detail/CVE-2024-28757)
  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2024-25710](https://nvd.nist.gov/vuln/detail/CVE-2024-25710)
  * [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283)
  * [CVE-2024-26308](https://nvd.nist.gov/vuln/detail/CVE-2024-26308)
  * [GHSA-9763-4f94-gfch](https://github.com/advisories/GHSA-9763-4f94-gfch)
</Update>

<Update label="0.34.1" description="April 8, 2024">
  ### Documentation refactor

  * To make the documentation more consistent with Helm standards, all instances of `config.yaml` have been replaced with `values.yaml`.

  ### Additional improvements

  * NGinx now has a dedicated service account with only the required permissions for the service
  * You can now specify an image pull secret for the `privateCaCertsAddToHost.certCopier` image so that it can pull the image from a private registry.
  * Added support for [Kubernetes 1.29](https://kubernetes.io/blog/2023/12/13/kubernetes-v1-29-release/).
  * You can now define `additionalScrapeJobs` in the Prometheus Helm chart so that Prometheus scrapes additional jobs on the Astronomer Software cluster. For example, you could add the following configuration to `values.yaml` to scrape a static job:

    ```yaml wrap theme={null}
    astronomer:
    prometheus:
    additionalScrapeJobs:
    - job_name: example-static-job
      static_configs:
      - targets:
        - localhost:9090
    ```

  ### Bug fixes

  * Fixed an issue where the value for `houston.config.deployments.resourceProvisioningStrategy.astroUnitsEnabled` was not respected when creating Deployments using the Houston API.
  * Fixed an issue where skipping multiple pages of a list in the Software UI could skip an extra page.
  * Removed support for Kubernetes 1.24.
  * Fixed an issue where task usage metrics didn't work when using a private certificate authority.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
  * [CVE-2023-7104](https://nvd.nist.gov/vuln/detail/CVE-2023-7104)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2024-25062](https://nvd.nist.gov/vuln/detail/CVE-2024-25062)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [GHSA-9763-4f94-gfch](https://github.com/advisories/GHSA-9763-4f94-gfch)
  * [CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626)
  * [CVE-2022-2625](https://nvd.nist.gov/vuln/detail/CVE-2022-2625)
  * [CVE-2024-0985](https://nvd.nist.gov/vuln/detail/CVE-2024-0985)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
  * [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)
</Update>

<Update label="0.34.0" description="February 12, 2024">
  ### Updated permissions for upgrading Deployments to unsupported Astro Runtime versions

  <Danger>
    **Breaking Change**

    This update includes a breaking change to the Astronomer Software Helm chart. The setting `enableSystemAdminCanUseAllRuntimes` no longer exists and has been replaced with:

    ```yaml wrap theme={null}
    astronomer:
       houston:
          config:
             deployments:
                enableListAllRuntimeVersions: true
    ```

    This new setting changes whether all Admin-level users can view and upgrade to deprecated versions of Astro Runtime from the Software UI.
  </Danger>

  By default, any user with an Admin-level role (Deployment Admin, Workspace Admin, System Admin) can now upgrade a Deployment to an unsupported version of Astro Runtime using the Astro CLI and the Houston API.

  You can additionally set the following value in your `values.yaml` file to enable these users to view and upgrade to unsupported Runtime versions through the Software UI:

  ```yaml wrap theme={null}
  astronomer:
     houston:
        config:
           deployments:
              enableListAllRuntimeVersions: true
  ```

  ### Change resource provisioning strategy per Deployment

  You can now set a **Resource Strategy** for each Deployment to fine-tune how Astronomer Software reserves resources for the Deployment within the cluster. The new resource strategies don't use AUs, meaning you can specify the exact CPU/ Memory requests and limits based on the needs of the Deployment. For example, you can configure a Deployment to have significantly more memory than CPU in extra capacity so that memory-intensive tasks are always guaranteed to run. See [Customize resource usage](https://www.astronomer.io/docs/software/customize-resource-usage) for more information.

  ### Deploy only DAGs with `astro deploy -—dags`

  You can now deploy only the DAGs folder of an Astro project to a Deployment. If you only need to deploy DAG code changes, DAG-only deploys are faster and safer than a full image deploy. This also allows you to configure CI/CD pipelines that allow certain team members to only push DAGs, while allowing other team members to push Astro project configuration updates. See [Deploy DAGs](/docs/astro-private-cloud/v-0-37/deploy-dags) for more information.

  ### Additional improvements

  * You can now configure a global label that is applied to all Astronomer Software Pods.

  * You can now filter on `release_name` when you make a `deployments()` query to the Houston API.

  * You can now use containerd-based Astro Runtime images on an Astronomer Software cluster with a self-managed private CA certificate. To configure a self-managed private CA certificate, add the following configuration to your `values.yaml` file and apply the configuration to your cluster:

    ```yaml wrap theme={null}
    astronomer:
      privateCaCertsAddToHost:
        enabled: true
        hostDirectory: /path/to/docker/certs.d
        addToContainerd: false
        containerdCertConfigPath: /path/to/containerd/certs.d
        containerdConfigToml: ~
        containerdnodeAffinitys: []
    ```

  * You can now make a `createDeployment` or `upsertDeployment` query by specifying a Workspace name or label instead of a Workspace ID.

  * You can now disable the `astro-cli` Pod to free up resources on your cluster. This Pod is typically only used in airgapped clusters that can't access `https://install.astronomer.io`. To disable the Pod, add the following configuration to your `values.yaml` file and apply the change to your cluster:

    ```yaml wrap theme={null}
    astronomer:
      install:
        cli-enabled: true
    ```

  * Astronomer Software now redeploys your Deployment when you switch your executor type.

  * You no longer have to manually define your private registry in the configuration for [Vector logging sidecars.](https://www.astronomer.io/docs/software/export-task-logs#customize-vector-logging-sidecars).

  ### Bug fixes

  * Fixed an issue where Astronomer users would occasionally not be associated with their related Azure AD/ Microsoft Entra ID accounts when added to Astronomer using SCIM.
  * The Houston API now validates `updateDeployment` queries to ensure that Deployment resource limits and requests are set correctly.
  * Fixed an issue where the **Core Container Status** section of the **Metrics** tab would occasionally show unhealthy containers with a healthy status.
  * Fixed an issue where Deployments would occasionally not recreate the correct resources when switching from the Kubernetes executor to the Celery executor.
  * Fixed an issue where deploys could fail when using a self-signed certificate signed by a private certificate authority.
  * Fixed an issue where Deployments would not have default configuration values as expected when a configuration was missing.
  * Fixed an issue where you couldn't search for a user in the Software UI by their user ID.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-46233](https://nvd.nist.gov/vuln/detail/CVE-2023-46233)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
  * [GHSA-fr2g-9hjm-wr23](https://github.com/advisories/GHSA-fr2g-9hjm-wr23)
  * [CVE-2023-25653](https://nvd.nist.gov/vuln/detail/CVE-2023-25653)
  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976)
  * [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370)
  * [CVE-2023-40690](https://nvd.nist.gov/vuln/detail/CVE-2023-40690)
  * [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253)
  * [CVE-2023-37788](https://nvd.nist.gov/vuln/detail/CVE-2023-37788)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2021-33914](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
</Update>

<Update label="0.33.3" description="January 19, 2024">
  ### Additional improvements

  * Added support for [Kubernetes 1.29](https://kubernetes.io/blog/2023/12/13/kubernetes-v1-29-release/).

  ### Bug fixes

  * Fixed an issue where the Workspace list page in the Software UI would show an error if any Workspace had an empty description.
  * Fixed an issue in 0.33.2 where you couldn't migrate a Deployment from Astronomer Certified to Astro Runtime.
  * Fixed an issue where a Deployment would incorrectly appear as unhealthy if you scaled down its number of triggerers to zero.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253)
  * [CVE-2023-37788](https://nvd.nist.gov/vuln/detail/CVE-2023-37788)
  * [GHSA-fr2g-9hjm-wr23](https://github.com/advisories/GHSA-fr2g-9hjm-wr23)
</Update>

<Update label="0.33.2" description="November 20, 2023">
  ### Change to behavior for interacting with deprecated Runtime versions

  In 0.33.2, non-System Admin users can now update Deployments using deprecated versions of Astro Runtime. By default, non-System Admin users can now interact with Deployments using deprecated Runtime versions, but only System Admins can create new Deployments with deprecated Runtime versions. As a result of this change, the `enableSystemAdminCanUseNonSupportedRuntime` key has been replaced with `enableSystemAdminCanUseAllRuntimes`. To set the new flag, add the following configuration to your `values.yaml` file:

  ```yaml wrap theme={null}
  astronomer:
     houston:
        config:
           deployments:
              enableSystemAdminCanUseAllRuntimes: true
  ```

  ### Additional improvements

  * You can now configure a global index name prefix to use for both Fluentd and sidecar-based logging, which allows Astronomer Software to retain logs when you migrate between logging solutions. To enable this feature, add the following lines to your `values.yaml` file:

    ```yaml wrap theme={null}
    global:
       logging:
          indexNamePrefix: <your-index-prefix>
    ```
  * Deprecated Kubernetes 1.23

  ### Bug fixes

  * Fixed an issue where deploys were failing for Deployments that used older versions of the Airflow Helm chart.
  * Fixed an issue where some dashboards in Grafana were not visible if you didn't manually log in to Grafana as an admin.
  * Fixed an issue where the Software UI showed Deployments as healthy even if the triggerer Pod was down.
  * Fixed an issue where you couldn't search for a user in the Software UI by their user ID.
  * Fixed an issue where the `invites` query returned an error instead of an empty array when no users invites were found.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-43787](https://nvd.nist.gov/vuln/detail/CVE-2023-43787)
  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
  * [CVE-2023-32002](https://nvd.nist.gov/vuln/detail/CVE-2023-32002)
  * [CVE-2023-32006](https://nvd.nist.gov/vuln/detail/CVE-2023-32006)
  * [CVE-2023-32559](https://nvd.nist.gov/vuln/detail/CVE-2023-32559)
  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540)
  * [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538)
  * [CVE-2023-45133](https://nvd.nist.gov/vuln/detail/CVE-2023-45133)
  * [CVE-2022-48174](https://nvd.nist.gov/vuln/detail/CVE-2023-48174)
  * [CVE-2023-39320](https://nvd.nist.gov/vuln/detail/CVE-2023-39320)
  * [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402)
  * [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404)
  * [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405)
</Update>

<Update label="0.33.1" description="October 13, 2023">
  ### Additional improvements

  * You can now set `astronomer.auth.microsoft.useExternalProxy: false` in your `values.yaml` file to bypass proxy support for Azure logins.
  * You can now list System-level Service Accounts using the Houston API.
  * You can now configure a service account specifically for your image registry using by setting `astronomer.registry.serviceaccount` in your `values.yaml` file.
  * The Kibana logging dashboard now includes a default index.

  ### Bug fixes

  * Fixed an issue where if you queried a Deployment name that belonged to two different Deployments in two different Workspaces, the Houston API might retrieve the unintended Deployment.
  * Fixed an issue where you could create users with the Houston API when SCIM was enabled and `userManagement.enable` was `false`.
  * Fixed an issue where some dashboards on Grafana didn't load properly.
  * Fixed an issue where the Houston API `CreateDeployment` request would return a successful response even though no Deployment was created due to no specified Airflow version.
  * Fixed an issue where a System Admin user that did not belong to a Team could delete the Team from the Software UI.
  * Fixed an issue where syncing an IdP group from Okta failed when SCIM was enabled and a user account was removed only from Astronomer Software.
  * Fixed an issue where adding a user through SCIM provisioning that already exists on an Astronomer Software Azure cluster would throw an error instead of updating the existing user.
  * Fixed an issue where the user login process would be unresponsive if the Houston API failed to retrieve IdP group information from Azure.
  * Fixed an issue where the Software UI would show Deployments as healthy even when triggerer Pods were failing.
  * Fixed an issue where a user who was deleted from Astronomer Software would not appear when they were reinvited through a Team.
  * Fixed an issue where the System Admin page in the Software UI had entries that didn't fit the page.
  * Astronomer Software now throws an error if you attempt to install it with an unsupported version of Kubernetes.
  * Fixed an issue where using the Houston API to query for a Deployment that didn't exist returned a non-descriptive error.
  * Fixed an issue where `ap-blackbox-exporter` did not respect global network policies.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-38325](https://nvd.nist.gov/vuln/detail/CVE-2023-38325)
  * [CVE-2023-4863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863)
  * [CVE-2023-37788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37788)
  * [CVE-2023-37920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920)
  * [CVE-2023-36665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36665)
  * [CVE-2023-26115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26115)
  * [CVE-2023-29526](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29526)
  * [CVE-2022-48174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48174)
  * [CVE-2022-2253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2253)
  * [CVE-2017-11468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11468)
  * [CVE-2023-28840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840)
  * [CVE-2023-2976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976)
  * [CVE-2023-1370](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1370)
  * [CVE-2021-40690](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40690)
  * [CVE-2023-40577](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40577)
  * [CVE-2022-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41721)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2021-33194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194)
  * [CVE-2021-38561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
  * [CVE-2023-25653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25653)
</Update>

<Update label="0.33.0" description="September 8, 2023">
  ### Automatic PGBouncer connection scaling

  Astronomer Software can now automatically scale the size of PGBouncer connection pools based on your Airflow component counts and Airflow configuration, instead of solely based on total AU. This improves performance, scalability, and utilization of database connections across all Deployments.

  This feature is off by default. You can enable it by setting  `deployments.pgBouncerResourceCalculationStrategy: airflowStratV2` in your `values.yaml` file. To revert back to previous behavior, set this key to `auStratV1` instead.

  ### Additional improvements

  * You can now disable Airflow and platform alerts on the Prometheus alerts dashboard by setting `prometheus.defaultAlerts.airflow.enabled` and `prometheus.defaultAlerts.airflow.enabled` to `false` in your Prometheus Helm chart. If you disable these alerts, you can still add back specific alerts or configure custom alerts using `prometheus.defaultAlerts.additionalAlerts`. See [Create custom alerts](/docs/astro-private-cloud/v-0-37/platform-alerts#create-custom-alerts).
  * Added support for [Kubernetes 1.27](https://kubernetes.io/blog/2023/04/11/kubernetes-v1-27-release/).
  * The Workspace **Deployments** page is now paginated in the Astronomer UI.
  * The **Extra Capacity** field in the Astronomer UI now shows up to 6 digits of AU.
  * You no longer have to set `elasticsearch.curator.age.timestring` when you configure a custom indexing pattern for [Vector logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars). The only required value is now `astronomer.houston.config.deployments.helm.loggingSidecar.indexPattern`.
  * When you create or update a Deployment and select a Runtime version, the Astronomer UI now shows only the latest supported Astro Runtime patch for each supported Astro Runtime major version.
  * You can now set `deployments.canUpsertDeploymentFromUI: false` to prevent all users besides System Admins from updating Deployments and environment variables through the Astronomer UI.
  * You can now [overprovision](/docs/astro-private-cloud/v-0-37/cluster-resource-provisioning) the `triggerer-log-groomer` component.

  ### Bug fixes

  * Fixed an issue where a Deployment using Runtime 8 or earlier with the Celery executor would show as healthy in the Software UI even when workers were unavailable.
  * Fixed an issue where Grafana could not start up on an OpenShift cluster.
  * Fixed an issue where configurations in `astronomer.houston.config.deployments.components` applied only to Deployments that were created after the configuration was set.
  * Fixed an issue where a Workspace-level service account would improperly inherit lesser permissions for Deployments it was added to.
  * The Astronomer UI now shows an error if you click the **Delete** button for Teams and you don't have the `system.teams.remove` permission.
  * Fixed an issue where you couldn't upgrade a Deployment's Airflow version if the Deployment used git-sync deploys and had default resources.
  * Fixed an issue where you could get a 500 internal server error from the Airflow UI when switching between pages for a DAG.
  * Fixed an issue where you couldn't set `properties.email` using the `upsertDeployment` mutation.
  * Fixed an issue where the Astronomer UI would not show the right error screen when a user without the appropriate permissions viewed service accounts.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-35945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35945)
  * [CVE-2023-37920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920)
  * [CVE-2023-2253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2253)
  * [CVE-2023-39417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39417)
  * [CVE-2023-37920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920)
  * [CVE-2023-35945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35945)
</Update>

<Update label="0.32.6" description="February 16, 2024">
  ### Additional improvements

  * Added support for [Kubernetes 1.29](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md)
  * You no longer have to manually define your private registry in the configuration for [Vector logging sidecars.](https://www.astronomer.io/docs/software/export-task-logs#customize-vector-logging-sidecars). Your registry details are now automatically pulled from your core private registry configuration.
  * Fixed an issue where container status and usage did not appear in the **Metrics** tab for Deployments with pre-created namespaces.

  ### Bug fixes

  * Fixed an issue where Deployments would not have default configuration values as expected when a configuration was missing.
  * Fixed an issue where the **Core Container Status** section of the **Metrics** tab would occasionally show unhealthy containers with a healthy status.
  * Fixed an issue where a Deployment would incorrectly appear as unhealthy if you scaled down its number of triggerers to zero.
  * Fixed an issue where you couldn't specify an image pull secret for the `certCopier` image, meaning that you couldn't pull it from a private registry.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-39325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325)
  * [CVE-2023-52425](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52425)
  * [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g)
  * [CVE-2023-7104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7104)
  * [CVE-2023-34054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34054)
  * [CVE-2023-34062](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34062)
  * [GHSA-xpw8-rcwv-8f8p](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)
  * [CVE-2023-1370](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1370)
  * [CVE-2024-0985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0985)
  * [CVE-2024-21626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21626)
  * [CVE-2023-47090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47090)
  * [CVE-2023-46129](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46129)
  * [CVE-2023-46233](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46233)
  * [GHSA-36jr-mh4h-2g58](https://github.com/advisories/GHSA-36jr-mh4h-2g58)
  * [GHSA-9763-4f94-gfch](https://github.com/advisories/GHSA-9763-4f94-gfch)
  * [CVE-2023-49569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49569)
  * [CVE-2023-49568](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49568)
  * [CVE-2023-47108](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47108)
  * [CVE-2023-45142](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45142)
  * [CVE-2022-2625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2625)
  * [CVE-2023-5869](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5869)
  * [CVE-2023-2253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2253)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-21698)
  * [CVE-2021-33194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194)
  * [CVE-2021-38561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561)
</Update>

<Update label="0.32.5" description="December 8, 2023">
  ### Additional improvements

  * You can now configure a global index name prefix to use for both [Fluentd and sidecar-based logging](/docs/astro-private-cloud/v-0-37/export-task-logs), which allows Astronomer Software to retain logs when you migrate between logging solutions. To enable this feature, add the following lines to your `values.yaml` file:

    ```yaml wrap theme={null}
    global:
      logging:
        indexNamePrefix: <your-index-prefix>
    ```

  * Deprecated Kubernetes 1.23.

  * Astronomer Software now throws an error if you attempt to install it with an unsupported version of Kubernetes.

  * You can now set the following configuration to bypass proxy support when Astronomer Software redirects to Azure login. This might be required in some circumstances when importing identity provider groups as Teams:

    ```yaml wrap theme={null}
    astronomer:
      houston:
        config:
          auth:
            microsoft:
              useExternalProxy: false
    ```

  ### Bug fixes

  * Fixed an issue where deleting a user from Astronomer Software without deleting the user from an Idp Team could result in the user not being active if they're re-added.
  * Fixed an issue that allowed user creation with the Houston API when SCIM was enabled and `userManagement.enable` was `false`.
  * Fixed an issue where the Software UI showed Deployments as healthy even if the triggerer Pod was down.
  * Fixed an issue where using the Houston API to query for a Deployment that didn't exist returned a non-descriptive error.
  * Fixed an issue where you couldn't update the value for an existing secret environment variable.
  * Fixed an issue where you couldn't search for a user in the Software UI by their user ID.
  * Fixed an issue where you couldn't access Grafana or Kibana on GKE V2 clusters.
  * Fixed an issue where the `invites` query returned an error instead of an empty array when no users invites were found.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-39325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325)
  * [CVE-2023-5363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5363)
  * [CVE-2023-43787](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43787)
  * [CVE-2023-4911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4911)
  * [CVE-2023-5678](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5678)
  * [CVE-2023-37788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37788)
  * [CVE-2023-32002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32002)
  * [CVE-2023-32006](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32006)
  * [CVE-2023-32559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32559)
  * [CVE-2022-37434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434)
  * [CVE-2022-48174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48174)
  * [CVE-2023-39320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39320)
  * [CVE-2023-29402](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29402)
  * [CVE-2023-29404](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29404)
  * [CVE-2023-29405](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29405)
  * [CVE-2023-37788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37788)
  * [CVE-2023-40577](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40577)
  * [CVE-2023-2253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2253)
  * [CVE-2022-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41721)
</Update>

<Update label="0.32.4" description="October 19, 2023">
  ### Additional improvements

  You can now create a default Kibana index when installing Software.

  ### Bug fixes

  * Fixed an issue where `ap-blackbox-exporter` did not respect global network policies.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-4863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863)
  * [CVE-2023-4911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4911)
  * [CVE-2023-11468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-11468)
  * [CVE-2023-28840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840)
  * [CVE-2023-29491](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29491)
  * [CVE-2023-37788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37788)
  * [CVE-2023-37920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920)
  * [CVE-2023-38039](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38039)
  * [CVE-2023-38325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38325)
  * [CVE-2023-38545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545)
  * [CVE-2023-39417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39417)
  * [CVE-2023-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41721)
  * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487)
  * [CVE-2023-45133](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45133)
  * [CVE-2023-48174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48174)
  * [CVE-2021-33194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194)
  * [CVE-2021-38561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561)
  * [CVE-2023-40577](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40577)
</Update>

<Update label="0.32.3" description="August 31, 2023">
  ### Additional improvements

  * You can now disable Airflow and platform alerts on the Prometheus alerts dashboard by setting `Values.defaultAlerts.airflow.enabled` and `prometheus.defaultAlerts.platform.enabled` to `false` in your Prometheus Helm chart. If you disable these alerts, you can still add back specific alerts or configure custom alerts using `prometheus.defaultAlerts.additionalAlerts`. See [Create custom alerts](/docs/astro-private-cloud/v-0-37/platform-alerts#create-custom-alerts).
  * You no longer have to set `elasticsearch.curator.age.timestring` when you configure a custom indexing pattern for [Vector logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars). The only required value is now `global.loggingSidecar.indexPattern`.
  * You can now configure a service account specifically for your image registry using by setting `astronomer.registry.serviceaccount` in your `values.yaml` file.
  * You can now [overprovision](/docs/astro-private-cloud/v-0-37/cluster-resource-provisioning) the `triggerer-log-groomer` component.
  * You can now set `astronomer.houston.enableHoustonInternalAuthorization` in your `values.yaml` file to redirect all authorization requests from the ingress controller to the Houston API internal service endpoint. This can increase performance and decrease network latency.
  * Upgraded ElasticSearch to 8.x.
  * Added support for [Kubernetes 1.27](https://kubernetes.io/blog/2023/04/11/kubernetes-v1-27-release/).

  ### Bug fixes

  * Fixed an issue where Helm changes to statsd Pod resources would apply only to new Deployments.
  * Fixed an issue where Grafana could not start up on an OpenShift cluster.
  * Fixed an issue where a Deployment using Runtime 8 or earlier with the Celery executor would show as healthy in the Software UI even when workers were unavailable.
  * Fixed an issue where a System Admin user that did not belong to a Team could delete the Team from the Software UI.
  * Fixed an issue where syncing an IdP group from Okta failed when SCIM was enabled and a user account was removed only from Astronomer Software.
  * Fixed an issue where you couldn't upgrade a Deployment's Airflow version if the Deployment used git-sync deploys and had default resources.
  * Fixed an issue where the user login process would be unresponsive if the Houston API failed to retrieve IdP group information from Azure.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-37920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920)
  * [CVE-2023-35945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35945)
  * [CVE-2023-36665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36665)
  * [CVE-2023-2650](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2650)
</Update>

<Update label="0.32.2" description="June 23, 2023">
  ### Bug fixes

  * Reverted a change which prevented Workspace-level service accounts from accessing a Deployment when the service account didn't have specific permissions for that Deployment.
  * Fixed an issue where some screens of the Airflow UI would produce an HTTP 500 internal server error.
</Update>

<Update label="0.32.1" description="June 12, 2023">
  ### Additional improvements

  * [Overprovisioning](/docs/astro-private-cloud/v-0-37/cluster-resource-provisioning) now also applies to the following components:

    * PGBouncer
    * StatsD
    * Flower

  * You can now configure `astronomer.houston.config.deployments.overProvisioningComponents` to limit the scope of [overprovisioning](/docs/astro-private-cloud/v-0-37/cluster-resource-provisioning) only to specific Airflow components.

  * Teams without any users are now automatically deleted when SCIM is disabled.

  * You can now authenticate to an external storage service for [archiving task metadata](/docs/astro-private-cloud/v-0-37/clean-up-task-metadata) using Workload Identity.

  * You can now set `prometheus.config.scrape_configs.kubernetes_apiservers.tls_config.insecure_skip_verify` in the Prometheus Helm chart.

  * You can now set `astronomer.houston.config.deployments.helm.prometheus.certgenerator.extraAnnotations` in your `values.yaml` file.

  * You can now configure credentials for a registry backend as Kubernetes secrets in your `values.yaml` file. See [Configure a registry backend](/docs/astro-private-cloud/v-0-37/registry-backend).

  ### Bug fixes

  * Fixed an issue where `git-sync-relay` containers wouldn't restart as expected after being terminated.
  * Fixed an issue where a service account with the Workspace Editor role could update a Deployment when it didn't have any Deployment-level permissions for the Deployment.
  * Fixed an issue where data for **Disk Usage** and **Platform Overview** did not appear in Grafana.
  * System Admins can no longer change a user's system role if the user is imported to Astronomer through an IdP group and `manageSystemPermissionsViaIdpGroups` is set to `true`.
  * Fixed an issue where you could not create a new Deployment from the Astro UI if you updated its scheduler count using the text-based input field.
  * Fixed an issue where container status and usage did not appear in the **Metrics** tab for Deployments with pre-created namespaces.
  * Fixed an issue where resource requests configured from the Software UI could get out of sync with the Houston database.
  * Fixed an issue where updating a Deployment's resource configuration did not persist in the Houston database when that Deployment had overprovisioning enabled.
  * Reduced the number of redundant calls that Astronomer Software makes to your identity provider (IdP) when a user logs in.
  * Fixed a security vulnerability in logging.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-29491](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29491)
  * [CVE-2023-1999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1999)
  * [CVE-2023-27561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561)
  * [CVE-2022-41727](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41727)
  * [CVE-2023-28840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840)
  * [CVE-2023-2650](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2650)
</Update>

<Update label="0.32.0" description="April 28, 2023">
  ### Clean Deployment task metadata

  You can now clean task data from your Deployments by exporting it to an external storage service. This workflow reduces the amount of data Airflow stores in your Deployment metadata database by archiving data that you don't need to access on a regular basis. To configure this job, see [Clean Deployment task metadata](/docs/astro-private-cloud/v-0-37/clean-up-task-metadata).

  ### Programmatically create and update Deployments with the Houston API

  You can now programmatically create or update Deployments using the Houston API `upsertDeployment` mutation. Unlike `createDeployment`, the `upsertDeployment` mutation includes keys for configuring Deployment resources such as environment variables. See [Create or update a Deployment with configurations](/docs/astro-private-cloud/v-0-37/houston-api-examples#create-or-update-a-deployment-with-configurations).

  ### Reduce resource requests for Airflow components in development environments

  You can reduce the amount of CPU and memory that an Airflow component requests in development environments, allowing you to more efficiently provision resources based on the requirements for your development Deployments. See [Underprovision Airflow resources](/docs/astro-private-cloud/v-0-37/cluster-resource-provisioning) for configuration steps.

  ### New cron job to clean Deployment task data

  You can now clean task data from your Deployments by exporting it to an external storage service. This workflow reduces the amount of storage Astronomer Software uses by archiving data that you don't need to access on a regular basis. See [Configure a Deployment](/docs/astro-private-cloud/v-0-37/clean-up-task-metadata) for configuration steps.

  ### Assign System-level permissions to Teams

  You can assign the System Admin, System Editor, and System Viewer permissions to teams by setting the following values in your `values.yaml` file:

  ```sh wrap theme={null}
  # Auth configuration.
  auth:
    openidConnect:
      idpGroupsImportEnabled: true
      # Optional configuration. Set to assign System-level permissions using Teams.
      manageSystemPermissionsViaIdpGroups:
        enabled: true
        systemAdmin: ["<your-system-admin-groups>"] // Only these groups will be treated as SysAdmin Groups
        systemEditor: ["<your-system-editor-groups>"]
        systemViewer: ["<your-system-viewer-groups>"]
  ```

  When coupled with [disabling individual user management](/docs/astro-private-cloud/v-0-37/import-idp-groups#disable-individual-user-management), this feature allows you to control all user permissions on Astronomer Software exclusively through your identity provider. For more information, see [Import IdP groups](/docs/astro-private-cloud/v-0-37/import-idp-groups).

  ### PostgreSQL 15

  Astronomer Software version 0.32 upgrades PostgreSQL from 11.18.0-1 to 15. If you use in-cluster PostgreSQL for your workflows, upgrading to Software 0.32 without pinning your PostgreSQL version can impact your workflows. See the [Upgrade to Postgres 15](/docs/astro-private-cloud/v-0-37/upgrade-astronomer#upgrade-to-postgres-15) for upgrade considerations and steps.

  ### Additional improvements

  * Added support for using git-sync with a private image registry.
  * The root user feature introduced in Astronomer Software version 0.31 has been deprecated. System Admins now have the highest level of permissions on the platform.
  * Workspaces are now required to have unique names. If you have existing Workspaces with identical names, upon upgrade the duplicate names will be appended with an underscore and a number.
  * If you configured [git-sync deploys](/docs/astro-private-cloud/v-0-37/deploy-git-sync) for a Deployment, you can now [view error logs](/docs/astro-private-cloud/v-0-37/deployment-logs) emitted from the git-sync Kubernetes Pod in the Software UI.
  * You can now configure a custom indexing pattern for [Vector logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars) by setting both `elasticsearch.curator.age.timestring` and `astronomer.houston.config.deployments.helm.loggingSidecar.indexPattern` in your `values.yaml` file.
  * You can now configure custom environment variables for ElasticSearch-based custom logging using the `astronomer.customLogging.extraEnv` value in your `values.yaml` file.
  * The `astronomer.houston.config.deployments.sysAdminScalabilityImprovementsEnabled` key has been replaced with `astronomer.houston.config.deployments.performanceOptimizationModeEnabled`  for improved performance across additional Software UI views.

  ### Bug fixes

  * Fixed an issue where ElasticSearch Curator version 7 and later did not work as expected.
  * Fixed an issue where sidecar containers would sometimes not terminate properly after their primary container was terminated.
  * Fixed an issue in the Software UI where you could not view Deployment details for a Deployment that included "team" in its name.
  * Fixed an issue where a service account with Workspace Editor permissions could update Deployments.
  * Fixed an issue where Prometheus was using more memory than expected due to a misconfiguration of statsd.
    Fixed an issue in the Software UI where a text search returned duplicate entries for a single Deployment name.
  * Fixed an issue where authentication tokens were visible in Nginx logs produced by the Software UI.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-46146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2021-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32149)
  * [CVE-2021-2625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2625)
  * [CVE-2023-0286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286)
  * [CVE-2023-25881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25881)
  * [CVE-2023-27536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27536)
  * [CVE-2023-27533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27533)
  * [CVE-2023-27534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27534)
  * [CVE-2023-27535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27535)
  * [CVE-2023-0464](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0464)
  * [CVE-2023-27561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27664)
  * [CVE-2022-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41721)
  * [CVE-2022-41723](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41723)
  * [CVE-2022-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32149)
  * [CVE-2020-25649](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25649)
  * [CVE-2020-36518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518)
  * [CVE-2022-42003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003)
  * [CVE-2022-42004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-022-42004)
  * [CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171)
  * [CVE-2022-3509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3509)
  * [CVE-2022-3510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3510)
  * [CVE-2022-25857](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857)
  * [CVE-2022-42898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898)
  * [CVE-2022-3970](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3970)
</Update>

<Update label="0.31.3" description="February 24, 2023">
  ### Additional improvements

  * You can now configure `extraVolumes` and `extraVolumeMounts` in the Alertmanager Helm chart, which can be useful for storing secret credentials for services that read your alerts.
  * You can now use `astronomer.houston.ingress.annotation` in the Astronomer Helm chart to configure custom ingress annotations for Houston.
  * You can now upgrade the Airflow Helm chart for individual Deployments by running `yarn upgrade-deployments <deployment-id>` from within the Houston Pod.

  ### Bug fixes

  * Fixed an issue where you could not set `AIRFLOW__LOGGING__REMOTE_BASE_LOG_FOLDER` in a Deployment if you were using an Astronomer Certified image.
  * Astronomer Software now filters orphaned Deployments and Workspaces owned by users who were removed from an identity provider (IdP) group with SCIM enabled.
  * Fixed a security vulnerability where you could query Elasticsearch logs for a Deployment from a different Deployment.
  * Fixed an issue where authentication tokens were visible in Nginx logs produced by the Software UI.
  * Fixed an issue where deploying an image with the `docker/build-push-action` GitHub action could produce errors in Houston that affected the entire Astronomer Software installation.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-24807](https://nvd.nist.gov/vuln/detail/CVE-2023-24807)
  * [CVE-2022-25881](https://nvd.nist.gov/vuln/detail/CVE-2023-25881)
  * [CVE-2023-8286](https://nvd.nist.gov/vuln/detail/CVE-2023-8286)
</Update>

<Update label="0.31.2" description="February 2, 2023">
  ### Additional improvements

  * Support for Kubernetes [1.25](https://kubernetes.io/blog/2022/08/23/kubernetes-v1-25-release/) and [1.26](https://kubernetes.io/blog/2022/12/09/kubernetes-v1-26-release/).

  * You can now configure custom annotations for Houston ingress by setting `astronomer.houston.ingress.annotation` in your `values.yaml` file.

  * The System Admin **Deployments** list in the Software UI is now paginated.

  * You can now use the following values in your `values.yaml` file to configure resource allocation for the git-sync relay service:

    * `astronomer.gitSyncRelay.gitSyncResources`
    * `astronomer.gitSyncRelay.gitDaemonResources`
    * `astronomer.gitSyncRelay.securityContext`

  * You can now set `timeoutSeconds` for `readinessProbe` and `livenessProbe` in the Prometheus Helm chart.

  * Fixed an issue where Deployments with many DAGs could not be successfully upgraded due to a short timeout.

  * Houston API now logs an installation's deployed image versions whenever a GraphQL mutation is completed.

  ### Bug fixes

  * To limit Out of Memory (OOM) errors when migrating large DAGs, Deployment database migrations now use the same resources as the Deployment's scheduler.
  * Fixed an issue in the Software UI where refreshing pages listing Workspace or Deployment service accounts returned an error.
  * Fixed an issue where PgBouncer didn't work if you pulled its image from a private registry.
  * When you view a user through a Teams list as a System Admin and return to the list, you now return to the Teams list instead of the System Admin users list.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-23529](https://nvd.nist.gov/vuln/detail/CVE-2022-23529)
  * [CVE-2021-44906](https://nvd.nist.gov/vuln/detail/CVE-2021-44906)
  * [CVE-2022-23540](https://nvd.nist.gov/vuln/detail/CVE-2022-23540)
  * [CVE-2022-23541](https://nvd.nist.gov/vuln/detail/CVE-2022-23541)
  * [CVE-2022-3996](https://nvd.nist.gov/vuln/detail/CVE-2022-3996)
  * [CVE-2022-43551](https://nvd.nist.gov/vuln/detail/CVE-2022-43551)
  * [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2021-44716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44716)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2021-43565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43565)
  * [CVE-2021-38561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561)
</Update>

<Update label="0.31.1" description="December 23, 2022">
  ### Additional improvements

  * You can now configure `extraFlags` for the Prometheus startup command in the Prometheus Helm chart.

  ### Bug fixes

  * Fixed an issue where logging sidecars would occasionally fail to terminate.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848)
  * [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716)
  * [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191)
  * [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664)
  * [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-41717)
  * [CVE-2022-37454](https://nvd.nist.gov/vuln/detail/CVE-2022-37454)
  * [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717)
  * [CVE-2022-42919](https://nvd.nist.gov/vuln/detail/CVE-2022-42919)
  * [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061)
  * [CVE-2022-46146](https://nvd.nist.gov/vuln/detail/CVE-2022-46146)
</Update>

<Update label="0.31.0" description="December 7, 2022">
  ### View and export task usage metrics

  You can now view task usage metrics from the Software UI.

  Task usage metrics provide an overview of your Airflow task runs and can help you quickly identify Deployments where more tasks are running or failing than expected.

  To configure the feature, see [Set up task usage metrics](/docs/astro-private-cloud/v-0-37/task-usage-metrics).

  ### New root user role

  Astronomer Software's role-based access control (RBAC) system now supports a single root user for each installation. The root user has a non-configurable username and autogenerated password stored as a Kubernetes secret in your installation.

  See [Manage the root user](/docs/astro-private-cloud/archive/documentation-archive).

  ### Manage Astronomer users through a SCIM integration

  Astronomer Software now supports managing users through System for Cross-domain Identity Management (SCIM), which allows you to automatically provision and deprovision users based on templates for access and permissions. See [Manage users with SCIM](/docs/astro-private-cloud/v-0-37/integrate-auth-system#manage-users-and-teams-with-scim).

  ### Invite users only through Teams

  Using the new root user feature, you can now configure Astronomer Software so that users are managed exclusively through Teams. This helps you better integrate with your identity provider (IdP) by ensuring that all users on your platform are authenticated and managed through the IdP. See [Disable individual user management](/docs/astro-private-cloud/v-0-37/import-idp-groups#disable-individual-user-management).

  ### New default resource limits and requests

  Astronomer Software 0.31 includes new default resource limits and requests on the following resources:

  * Alertmanager
  * Elasticsearch
  * NATS
  * PostrgeSQL
  * STAN
  * Nginx
  * Grafana
  * Blackbox exporter

  You might experience OOMKill errors or unexpected behavior after upgrading if you use resources beyond the new default limits. To minimize disruption, view resource usage for these components in [Grafana](/docs/astro-private-cloud/v-0-37/grafana-metrics) prior to upgrade and compare this usage to the default resource limits in the [Astronomer Helm chart](https://github.com/astronomer/astronomer/blob/master/charts/astronomer/values.yaml).

  If your current usage is expected and higher than the default resource limits, update the limits in your `values.yaml` file before upgrading to Astronomer Software 0.31.

  ### Additional improvements

  * You can now set a custom security context for `es-client` by setting `elasticsearch.client.securityContext.capabilities.add={}` in the ElasticSearch Helm chart.
  * The **Deployment users** page is now paginated in the Software UI.
  * You can now set `astronomer.registry.logLevel` to filter which types of logs appear in your Docker registry.
  * The default Git-sync interval is now 1 instead of 0.
  * You can now configure a Deployment to have 0 triggerer components.
  * You can now set `astronomer.houston.config.useAutoCompleteForSensativeFields=false` to disable autocomplete on sensitive fields in the Software UI.
  * You can now set `astronomer.houston.config.shouldLogUsername=true` to include user email addresses in audit logs for logins through the Houston API.
  * [Git sync-based Deployments](/docs/astro-private-cloud/v-0-37/deploy-git-sync) now have a dedicated git-sync relay pod, service, and network policy.

  ### Bug fixes

  * The Software UI now stores user tokens with `httpOnly` and `secure` flags.
  * Fixed an issue where the Software UI would occasionally show an incorrect **Extra AU** number for Deployments.
  * Fixed an issue where you could not access Astronomer Software's Docker registry if you had access to more than 100 Deployments.
  * Fixed an issue where the Software UI did not show the correct last used dates for service accounts.
  * Fixed an issue where NATS would send false Deployment alert emails.
  * Fixed an issue where the configuration in `astronomer.houston.updateRuntimeCheck.url` was ignored if not all supported Deployment image versions were present in the destination URL.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-37601](https://security.snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105)
  * [CVE-2022-43680](https://nvd.nist.gov/vuln/detail/CVE-2022-43680)
  * [CVE-2022-40674](https://nvd.nist.gov/vuln/detail/CVE-2022-40674)
</Update>

<Update label="0.30.8" description="September 15, 2023">
  ### Additional improvements

  * You can now configure credentials for a registry backend as Kubernetes secrets in your `values.yaml` file. See [Configure a registry backend](/docs/astro-private-cloud/v-0-37/registry-backend).
  * You can now disable Airflow and platform alerts on the Prometheus alerts dashboard by setting `prometheus.defaultAlerts.airflow.enabled` and `prometheus.defaultAlerts.airflow.enabled` to `false` in your Prometheus Helm chart. If you disable these alerts, you can still add back specific alerts or configure custom alerts using `prometheus.defaultAlerts.additionalAlerts`. See [Create custom alerts](/docs/astro-private-cloud/v-0-37/platform-alerts#create-custom-alerts).
  * You no longer have to set `elasticsearch.curator.age.timestring` when you configure a custom indexing pattern for [Vector logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars). The only required value is now `astronomer.houston.config.deployments.helm.loggingSidecar.indexPattern`.
  * You can now configure a service account specifically for your image registry using by setting `astronomer.registry.serviceaccount` in your `values.yaml` file.
  * The Kibana logging dashboard now includes a default index.
  * Added support for [Kubernetes 1.27](https://kubernetes.io/blog/2023/04/11/kubernetes-v1-27-release/).

  ### Bug fixes

  * Fixed an issue where if you queried a Deployment name that belonged to two different Deployments in two different Workspaces, the Houston API might retrieve the unintended Deployment.
  * Fixed an issue where Helm changes to statsd Pod resources would apply only to new Deployments.
  * Fixed an issue where data for **Disk Usage** and **Platform Overview** did not appear in Grafana.
  * Fixed an issue where you could get a 500 internal server error from the Airflow UI when switching between pages for a DAG.
  * Astronomer Software now throws an error if you attempt to install it with an unsupported version of Kubernetes.
  * Removed support for Kubernetes 1.22.
  * Fixed an issue where using the Houston API to query for a Deployment that didn't exist returned a non-descriptive error.
  * Fixed an issue where you couldn't create registry service accounts on Openshift clusters.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-48174](https://nvd.nist.gov/vuln/detail/CVE-2022-48174)
  * [CVE-2023-38325](https://nvd.nist.gov/vuln/detail/CVE-2023-38325)
  * [CVE-2023-36665](https://nvd.nist.gov/vuln/detail/CVE-2023-36665)
  * [CVE-2022-48174](https://nvd.nist.gov/vuln/detail/CVE-2022-48174)
  * [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723)
  * [CVE-2022-29458](https://nvd.nist.gov/vuln/detail/CVE-2022-29458)
  * [CVE-2023-0464](https://nvd.nist.gov/vuln/detail/CVE-2023-0464)
  * [CVE-2023-2650](https://nvd.nist.gov/vuln/detail/CVE-2023-2650)
  * [CVE-2022-29458](https://nvd.nist.gov/vuln/detail/CVE-2022-29458)
  * [CVE-2023-27561](https://nvd.nist.gov/vuln/detail/CVE-2023-27561)
  * [CVE-2017-11468](https://nvd.nist.gov/vuln/detail/CVE-2017-11468)
  * [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253)
  * [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840)
  * [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698)
  * [CVE-2023-28319](https://nvd.nist.gov/vuln/detail/CVE-2023-28319)
  * [CVE-2023-29491](https://nvd.nist.gov/vuln/detail/CVE-2023-29491)
  * [CVE-2023-35945](https://nvd.nist.gov/vuln/detail/CVE-2023-35945)
  * [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920)
  * [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721)
  * [CVE-2023-39417](https://nvd.nist.gov/vuln/detail/CVE-2023-39417)
  * [CVE-2023-37788](https://nvd.nist.gov/vuln/detail/CVE-2023-37788)
  * [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577)
  * [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194)
  * [CVE-2021-38561](https://nvd.nist.gov/vuln/detail/CVE-2021-38561)
</Update>

<Update label="0.30.7" description="May 26, 2023">
  ### Additional improvements

  * You can now configure custom environment variables for ElasticSearch-based custom logging using the `astronomer.customLogging.extraEnv` value in your `values.yaml` file.
  * You can now configure `prometheus.config.scrape_configs.kubernetes_apiservers.tls_config.insecure_skip_verify` in the Prometheus Helm chart.
  * You can now set `astronomer.houston.config.deployments.helm.prometheus.certgenerator.extraAnnotations` in your `values.yaml` file.
  * You can now configure a custom indexing pattern for [Vector logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars) by setting both `elasticsearch.curator.age.timestring` and `astronomer.houston.config.deployments.helm.loggingSidecar.indexPattern` in your `values.yaml` file.
  * The Software UI now shows a warning message for Deployments currently running an Astronomer Certified image. Only System Admins can create Deployments with deprecated Astronomer Certified images by setting `deployments.enableSystemAdminCanCreateDeprecatedAirflows` to `true`.
  * Grafana now includes an **Astronomer Houston Dashboard** that you can use to view Houston metrics.
  * Improved signalling between primary Kubernetes containers and the logging sidecar so that you no longer have to set `global.loggingSidecar.terminationEndpoint` in your `values.yaml` file.

  ### Bug fixes

  * Fixed an issue where container status and usage did not appear in the **Metrics** tab for Deployments with pre-created namespaces.
  * Fixed a security vulnerability in logging.
  * Fixed an issue where sidecar containers would sometimes not terminate properly after their primary container was terminated.
  * Fixed an issue where Prometheus was using more memory than expected due to a misconfiguration of statsd.
  * Fixed an issue where a service account with the Workspace Editor role could update a Deployment when it didn't have any Deployment-level permissions for the Deployment.
  * Fixed an issue in the Software UI where you could not view Deployment details for a Deployment that included "team" in its name.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-28840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840)
  * [CVE-2023-27536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27536)
  * [CVE-2023-27533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27533)
  * [CVE-2023-27534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27534)
  * [CVE-2023-27535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27535)
  * [CVE-2023-0464](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0464)
  * [CVE-2023-27561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27664)
  * [CVE-2022-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41721)
  * [CVE-2022-41723](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41723)
  * [CVE-2022-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32149)
  * [CVE-2020-25649](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25649)
  * [CVE-2020-36518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518)
  * [CVE-2022-42003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003)
  * [CVE-2022-42004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-022-42004)
  * [CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171)
  * [CVE-2022-3509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3509)
  * [CVE-2022-3510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3510)
  * [CVE-2022-25857](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857)
  * [CVE-2022-42898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898)
</Update>

<Update label="0.30.6" description="March 2, 2023">
  ### Additional improvements

  * Support for Kubernetes [1.25](https://kubernetes.io/blog/2022/08/23/kubernetes-v1-25-release/) and [1.26](https://kubernetes.io/blog/2022/12/09/kubernetes-v1-26-release/).
  * You can now configure `extraVolumes` and `extraVolumeMounts` in the Alertmanager Helm chart, which can be useful for storing secret credentials for services that read your alerts.

  ### Bug fixes

  * Fixed a security vulnerability where you could query Elasticsearch logs for a Deployment from a different Deployment.
  * Fixed an issue where deploying an image with the `docker/build-push-action` GitHub action could produce errors in Houston that affected the entire Astronomer Software installation.
  * Fixed an issue where authentication tokens were visible in Nginx logs produced by the Software UI.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)
  * [CVE-2023-0286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286)
  * [CVE-2023-25881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25881)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2022-41721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41721)
  * [CVE-2022-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32149)
  * [CVE-2022-23529](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23529)
  * [CVE-2021-44906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44906)
  * [CVE-2022-23540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23540)
  * [CVE-2022-23541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23541)
</Update>

<Update label="0.30.5" description="January 11, 2023">
  ### Additional improvements

  * You can now set `timeoutSeconds` for both `readinessProbe` and `livenessProbe` in the Prometheus Helm chart.
  * You can now roll back from Software version 0.30 to 0.28.

  ### Bug fixes

  * Fixed an issue where PgBouncer didn't work if you pulled its image from a private registry.
  * Fixed an issue where the Software UI would occasionally show an incorrect **Extra AU** number for Deployments.
  * Fixed an issue where users who had access to more than 100 Deployments could not access the Astronomer Software Docker registry.
  * Fixed an issue where Deployments with many DAGs could not be successfully upgraded due to a short timeout.
  * Fixed an issue where users couldn't log in through Azure Active Directory (AD) if they belonged to more than 100 teams.
  * Fixed an issue where service accounts with System Admin permissions could not create Deployments for deprecated Airflow versions.
  * Fixed an issue where you could not set `AIRFLOW__LOGGING__REMOTE_BASE_LOG_FOLDER` in a Deployment if you were using an Astronomer Certified image.
  * Fixed an issue in the Software UI where refreshing pages listing Workspace or Deployment service accounts resulted in an error.
  * Fixed an issue where logging sidecars would occasionally fail to terminate.
  * Fixed an issue where NATS would send false Deployment alert emails.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-3996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3996)
  * [CVE-2022-43551](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43551)
  * [CVE-2021-44716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44716)
  * [CVE-2022-2625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2625)
  * [CVE-2022-37454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37454)
  * [CVE-2022-42919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919)
  * [CVE-2022-45061](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45061)
  * [CVE-2022-43680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680)
  * [CVE-2017-11468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11468)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2022-46146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146)
  * [CVE-2022-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2022-27191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27191)
  * [CVE-2022-37601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37601)
  * [CVE-2021-43565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43565)
  * [CVE-2021-38561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561)
</Update>

<Update label="0.30.4" description="November 3, 2022">
  ### Bug fixes

  * Fixed an issue where `astronomer.houston.updateRuntimeCheck.url: true` was ignored when searching for new Astronomer Certified and Astro Runtime images.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-42915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915)
  * [CVE-2022-32190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32190)
  * [CVE-2022-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-14809)
  * [CVE-2022-14271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-14271)
  * [CVE-2022-1996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1996)
</Update>

<Update label="0.30.3" description="October 26, 2022">
  ### Additional improvements

  * You can now configure custom Alertmanager receivers with their own rules and topics using `customReceiver` in the Alertmanager Helm chart.
  * You can now limit which Runtime versions are available for new Deployments using `astronomer.minAstroRuntimeVersion` and `astronomer.airflowMinimumAstroRuntimeVersion` in your `values.yaml` file.
  * You can now configure a `livenessProbe` and `readinessProbe` specific to Prometheus in the Prometheus Helm chart.
  * You can now pass extra environment variables to [logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#configure-logging-sidecars) using `global.loggingSidecar.extraEnv` in your `values.yaml` file.
  * You can now define resource requests for [logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#configure-logging-sidecars) using `global.loggingSidecar.resources` in your `values.yaml` file.
  * You can now configure whether introspection APIs are available in GraphQL using `astronomer.apollo.introspection` in your `values.yaml` file.

  ### Bug fixes

  * Fixed an issue where upgrading Astronomer Software with a custom `houston.deployments.components` value in Helm could make the Software UI unavailable.
  * Fixed an issue where the Software UI didn't show the correct value for **Extra Capacity**.
  * Fixed an issue where upgrading a Deployment from Airflow 1.10.15 to 2.3 prevented you from configuring Deployment resources in the Software UI.
  * Added protections for using Arm-based Runtime images in Software Deployments.
  * Fixed an issue where some Deployments failed when pulling secrets from a private Docker registry.
  * Fixed an issue where some email alerts for unhealthy Deployments would not send if `namespaceFreeFormEntry: true` was set in `values.yaml`.
  * Fixed an issue where you could not view Deployment-level service accounts in the Software UI.
  * Fixed an issue where token refreshing could break when the token didn't have a properly formatted date.
  * Suppressed some extraneous ElasticSearch logs that made parsing logs for relevant information difficult.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-40674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674)
  * [CVE-2022-41816](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41816)
  * [CVE-2022-2900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2900)
  * [CVE-2022-3224](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224)
</Update>

<Update label="0.30.2" description="September 22, 2022">
  ### Additional improvements

  * You can now use the [Fluentd Helm chart](https://github.com/astronomer/astronomer/blob/master/charts/fluentd/values.yaml) to set a `securityContext` for Fluentd Pods and containers.
  * Improved the startup time for the platform NATS server.
  * You can now configure external containers in the `astronomer.houston.config` section of the Astronomer Helm chart.

  ### Bug fixes

  * Fixed several CVEs as a result of updating images for system components.
</Update>

<Update label="0.30.1" description="September 12, 2022">
  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-1996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1996)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2022-35949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35949)
  * [CVE-2022-35948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35948)
  * [CVE-2022-37434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434)
</Update>

<Update label="0.30.0" description="August 29, 2022">
  <Danger>
    **Breaking Change for Azure Database for PostgreSQL**

    A change in 0.30 enabled the `trgm` extension for PostgreSQL. If you use Azure Database for PostgreSQL as your database backend, you need to enable the `pg_trgm` extension before upgrading to Software 0.30 using either Azure portal or the Azure CLI. See [Azure documentation](https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-extensions) for configuration steps.

    If you don't complete this setup before your upgrade, the upgrade will fail.
  </Danger>

  ### Improved token refreshing for IdP integrations

  The Software UI now refreshes your JSON web token (JWT) based on the validity of your authentication token from your IdP. This means that as long as you stay logged in to your IdP, you no longer have to refresh the Software UI to continue accessing the Software UI, Astro CLI, and Houston API.

  Additionally, if you change a user's access to Astronomer from your IdP, their permissions will be automatically updated in Astronomer after their current IdP token expires. If you remove a user completely from Astronomer, they are automatically logged out of the Software UI and CLI after their current IdP token expires.

  As part of this change, you can now configure `jwt.authDuration` in your [Houston Helm configuration](https://github.com/astronomer/astronomer-docs-resources/blob/main/software/software_configs/0.30/default.yaml). If a user is logged on longer than `authDuration`, they will be immediately logged out regardless of the status of their JWT or authentication token.

  ### Additional improvements

  * Workspace users are now paginated in the Software UI.
  * You can now configure credentials for a private image registry by specifying a secret you create instead of a username and password. The secret is attached to any Pods that need to access the registry.
  * You can now specify `authUrlParams` for your identity provider (IdP) in `values.yaml`.
  * System Editors can no longer manage Teams or users in a Workspace. These permissions are now available only at the System Admin level.

  ### Bug fixes

  * Fixed an issue where `updateRuntimeCheck.enabled:false` did not properly stop an Astronomer Software installation from checking for Runtime updates.
  * Fixed an issue where applying an IAM role to a Deployment would reset the Deployment's **Extra Capacity** setting back to the default of 0 AU.
  * Fixed an issue where System Admins could receive an error when trying to view a Team imported from a different IdP than their current one.
  * When a System Admin makes a change to a Team, that change now appears in the UI without needing to refresh the page.
  * Configurations for disabling a specific executor type in `values.yaml` are now reflected in the Software UI.
  * Fixed an issue where Workspace-level service accounts could view Deployment information from Deployments outside of their Workspace.
  * Fixed an issue where updating the role of a user in a Team using the Astro CLI would not throw an error as expected.
  * Fixed an issue where JSON web tokens persisted after a user logged out if `idpGroupsRefreshEnabled` was set to `false`.
  * Users authenticating with Google Direct are no longer automatically logged out of Astronomer Software after 1 hour.
</Update>

<Update label="0.29.5" description="October 11, 2022">
  <Danger>
    **Breaking Change**

    ([https://github.com/kubernetes/kubernetes/issues/65106](https://github.com/kubernetes/kubernetes/issues/65106)) that occurs when you upgrade Helm charts that include duplicate keys in an `env` array. If you have a Helm chart with duplicate keys and upgrade to Astronomer Software 0.29.3+, all key-value pairs with the duplicate key are removed from your environment.

    To preserve duplicate keys in your Helm chart, you can either reapply the values after upgrading, or you can use the `--reset-values` flag when you run the upgrade script as described in [Upgrade Astronomer](/docs/astro-private-cloud/v-0-37/upgrade-astronomer).
  </Danger>

  ### Additional improvements

  * Improved the startup time for the platform NATS server.
  * You can now configure a `livenessProbe` and `readinessProbe` specific to Prometheus in the Prometheus Helm chart.
  * You can now configure a specific `securityContext` for Fluentd Pods and containers in the Fluentd Helm chart.

  ### Bug fixes

  * Fixed an issue where upgrading Astronomer Software with a custom `houston.deployments.components` value in Helm could break the Software UI.
  * Fixed an issue where upgrading a Deployment from Airflow 1.10.15 to 2.3 can prevent you from configuring the Deployment's resources in the Software UI.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-40674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674)
  * [CVE-2022-3224](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224)
</Update>

<Update label="0.29.4" description="September 13, 2022">
  ### Additional improvements

  * You can now specify `authUrlParams` for your identity provider (IdP) in `values.yaml`
  * Added error handling for upgrading a Software installation on an unsupported upgrade path

  ### Bug fixes

  * Fixed an issue where you could not create Deployments with unsupported Airflow versions when `enableSystemAdminCanCreateDeprecatedAirflows: true`

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-1996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1996)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2022-35949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35949)
  * [CVE-2022-35948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35948)
  * [CVE-2022-37434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434)
</Update>

<Update label="0.29.3" description="August 5, 2022">
  ### Additional improvements

  * Resolved several high and critical CVEs.

  ### Bug fixes

  * API requests to query the AUs allocated to **Extra Capacity** are now returning results for all Deployments in a Workspace. Previously, queries were only returning partial results.
</Update>

<Update label="0.29.2" description="July 18, 2022">
  ### Additional improvements

  * You can now configure Vector on [logging sidecars](/docs/astro-private-cloud/v-0-37/export-task-logs#export-logs-using-container-sidecars) to send Airflow task logs to third-party log management systems.
  * Resolved several high and critical CVEs.
  * You can now assign System Viewer and System Editor permissions to a [Team](/docs/astro-private-cloud/v-0-37/import-idp-groups).
  * You can now assign System Viewer and System Editor permissions to a user from the Software UI.

  ### Bug fixes

  * If you have `customLogging.enabled=true` and `loggingSidecar.customConfig=false` in your Helm configuration, logs now appear in the Software UI as expected.
  * System Admins can no longer update their own role.
  * The Software UI no longer counts inactive users in its user count figures.
  * Fixed an issue where you could still access a Deployment using a URL after logging out of the Software UI.
  * Fixed an issue where you could view Deployment information from a Workspace that was deleted with `astro workspace delete`.
  * Fixed an issue where you could not open Celery from the Software UI.
  * Improved the reliability of upgrading Astronomer Software with 30+ Deployments when `upgradeDeployments=true`.
</Update>

<Update label="0.29.1" description="June 3, 2022">
  ### Bug fixes

  * Fixed an issue where you couldn't run Houston API queries for Deployments using `releaseName` and `label`
  * Fixed an issue where a user could not log in through Azure AD SSO if the user belonged to a group without a `displayName`
</Update>

<Update label="0.29.0" description="June 1, 2022">
  ### Support for Astro Runtime images

  You can now use Astro Runtime images in your Software Deployments. Additionally, you can now select Runtime images when setting **Image Version** for a Deployment in the Software UI.

  Functionally, Runtime images are similar to Certified images. They both include:

  * Same-day support for Apache Airflow releases
  * Extended support lifecycles
  * Regularly backported bug and security fixes

  Astro Runtime includes additional features which are not available in Astronomer Certified images, including:

  * The `astronomer-providers` package, which includes a set of operators that are built and maintained by Astronomer
  * Airflow UI improvements, such as showing your Deployment's Docker image tag in the footer
  * Features that are exclusive to Astro Runtime and coming soon, such as new Airflow components and improvements to the DAG development experience

  To upgrade a Deployment to Runtime, follow the steps in [Upgrade Airflow](/docs/runtime/manage-airflow-versions), making sure to replace the Astronomer Certified image in your Dockerfile with an Astro Runtime version.

  ### Use a custom container image registry to deploy code

  You can now configure a custom container image registry in place of Astronomer's default registry. This option is best suited for mature organizations who require additional control for security and governance reasons. Using a custom registry provides your organization with the opportunity to scan images for CVEs, malicious code, and approved/ unapproved Python and OS-level dependencies prior to deploying code. To configure this feature, see [Configure a custom image registry](/docs/astro-private-cloud/v-0-37/custom-image-registry).

  ### Export task logs using logging sidecars

  You can now configure logging sidecar containers to collect and export task logs to ElasticSearch. This exporting approach is best suited for organizations that use Astronomer Software in a multi-tenant cluster where security is a concern, as well as for organizations running many small tasks using the Kubernetes executor. To configure this feature, see [Export task logs](/docs/astro-private-cloud/v-0-37/export-task-logs).

  ### Simplified configuration for namespace pools

  The process for configuring namespace pools has been simplified. As an alternative to manually creating namespaces, you can now delegate the creation of each namespace, including roles and rolebindings, to Astronomer Software. While this feature is suitable for most use cases, you can still manually create namespaces if you want more fine-grained control over the namespace's resources and permissions. For more information, see [Namespace pools](/docs/astro-private-cloud/v-0-37/namespace-pools).

  ### Additional improvements

  * Added support for [Kubernetes 1.22](https://kubernetes.io/blog/2021/08/04/kubernetes-1-22-release-announcement/)
  * Deprecated usage of [kubed](https://appscode.com/products/kubed/) for security and performance improvements
  * Redis containers can now run as non-root users
  * Added minimum security requirements for user passwords when using local auth
  * You can now use Azure DevOps repos in your [Git sync](/docs/astro-private-cloud/v-0-37/deploy-git-sync) configurations
  * You can now disable all network policies for Airflow components using the Astronomer Helm chart
  * System Admins can now view all Workspaces on their installation by default
  * User auth tokens for the Software UI are now stored in httpOnly cookies
  * When importing IdP groups as teams, you can now configure a `teamFilterRegex` in `values.yaml` to filter out IdP groups from being imported using regex
  * Added support for audit logging when a user interacts with the Houston API. This includes actions within the Software UI

  ### Bug fixes

  * Fixed an issue in Deployments running Airflow 2.3+ where logs for dynamically mapped tasks did not have a correct `log_id`
  * Fixed a typo in the `loadBalancerIP` key in the Nginx Helm chart
  * Fixed an issue where Azure AD connect sync did not work with Astronomer's Teams feature
  * Fixed an issue where upgrades would fail if you had changed `networkNSLabels` from `true` to `false` in `values.yaml`
</Update>

<Update label="v0.28.8" description="January 26, 2023">
  ### Bug fixes

  * Fixed an issue where service accounts with System Admin permissions couldn't create Deployments on deprecated Airflow versions.
  * Fixed an issue where you could not upgrade a Deployment from an unsupported version of Astronomer Certified (AC) to another unsupported version of AC.
  * Fixed an issue where Deployments with many DAGs could not be successfully upgraded due to a short timeout.
  * Fixed an issue in the Software UI where an error message appeared after refreshing pages listing Workspace or Deployment service accounts.
  * Fixed an issue where you could not view Deployment-level service accounts in the Software UI.

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2021-44716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44716)
  * [CVE-2022-27664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664)
  * [CVE-2022-2625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2625)
  * [CVE-2022-37454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37454)
  * [CVE-2022-42919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919)
  * [CVE-2022-45061](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45061)
  * [CVE-2022-46146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146)
  * [CVE-2022-27191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146)
  * [CVE-2022-32149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32149)
  * [CVE-2022-37601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37601)
  * [CVE-2022-43680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680)
</Update>

<Update label="v0.28.7" description="October 14, 2022">
  ### Bug fixes

  * Fixed the following vulnerabilities:
    * [CVE-2022-40674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674)
    * [CVE-2022-3224](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224)
</Update>

<Update label="v0.28.6" description="September 21, 2022">
  ### Additional improvements

  * You can now specify `authUrlParams` for your identity provider (IdP) in `values.yaml`
  * Added support for Kubernetes 1.21, 1.22, and 1.23
  * Upgraded Prometheus to the LTS release of 2.37.0

  ### Bug fixes

  * Fixed several additional CVEs by upgrading images for system components
  * Fixed an issue where custom authentication methods did not appear in the Software UI

  ### Security fixes

  Resolved the following vulnerabilities:

  * [CVE-2022-1996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1996)
  * [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698)
  * [CVE-2022-0624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624)
  * [CVE-2022-31129](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31129)
</Update>

<Update label="v0.28.5" description="June 23, 2022">
  ### Bug fixes

  * Fixed several high level CVEs
  * User auth tokens for the Software UI are now stored in httpOnly cookies
  * Fixed an issue where Grafana dashboards were not accessible
  * Fixed an issue where a user could not log in through Azure AD SSO if the user belonged to a group without a `displayName`
</Update>

<Update label="v0.28.4" description="April 8, 2022">
  ### Additional Improvements

  * Users added to Astronomer Software via an [IDP group](/docs/astro-private-cloud/v-0-37/import-idp-groups) no longer need to be invited by email in order to join Astronomer.
  * Teams now support [Azure AD Connect sync](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/concept-azure-ad-connect-sync-user-and-contacts) for user groups.
  * System admins can no longer remove the last user from an active Workspace or Deployment. This ensures that a given Workspace or Deployment can always be deleted by an existing member. Similarly, Workspace Admins can no longer remove a Team if doing so results in a Workspace having zero Admins.
  * You can now map your IDP's groups claim to Astronomer's expected claim of `groups` via the `astronomer.houston.config.auth.openidConnect.<idp>.claimsMapping` setting in `values.yaml`.

  ### Bug Fixes

  * Fixed an issue where deleted Teams did not disappear from the Software UI until you refreshed the page
  * Fixed an issue where Teams were still available in the Software UI even when their underlying IDP group had been deleted from the IDP
  * Fixed an issue where creating a Deployment with the default resource configuration would result in a Deployment having a **Scheduler Count** of 1 instead of the stated default of 2
  * Fixed an issue where you could not deploy code to a Deployment that shared the release name of a previous Deployment which was hard deleted
  * Fixed an issue where you could not create a Deployment with a numeric-only name in a pre-created namespace
</Update>

<Update label="v0.28.3" description="March 17, 2022">
  ### Bug Fixes

  * Fixed an issue where airgapped upgrades and installations could fail due to a mismatched Airflow Helm chart between Astronomer components
</Update>

<Update label="v0.28.2" description="March 14, 2022">
  ### Additional Improvements

  * System Admins can now update the name and description for any Workspace on their installation.
  * You can now specify `global.external_labels` and `remote_write` options for Prometheus through the Astronomer Helm chart.
  * You can now configure `nodeSelector`, `tolerations`, and `affinity` in the STAN and NATS Helm charts.

  ### Bug Fixes

  * Fixed several CVEs
  * Fixed a few issues where some buttons in the Software UI did not link to the appropriate page
  * Fixed an issue where you could not install Astronomer Software 0.27 or 0.28 in an [airgapped environment](/docs/astro-private-cloud/v-0-37/install-airgapped)
  * Fixed an issue where System and Workspace Admins were able to delete users that were part of an [IDP team](/docs/astro-private-cloud/v-0-37/import-idp-groups)
</Update>

<Update label="v0.28.1" description="February 22, 2022">
  ### Bug fixes

  * Fixed an issue where users could not successfully log in through Azure AD
</Update>

<Update label="v0.28.0" description="February 15, 2022">
  ### Import Identity Provider User Groups as Teams

  You now can import existing identity provider (IDP) groups into Astronomer Software as Teams, which are groups of Astronomer users that have the same set of permissions to a given Workspace or Deployment. Importing existing IDP groups as Teams enables swift onboarding to Astronomer and better control over multiple user permissions.

  ### Additional Improvements

  * Astronomer now supports `prefer` and `require` SSL modes for connecting to PGBouncer. You can set this SSL mode via the `global.ssl.mode` value in your `values.yaml` file. Note that in v0.28.0, this feature works only with AWS and Azure.
  * You can now set [Grafana environment variables](https://grafana.com/docs/grafana/latest/administration/configuration/#override-configuration-with-environment-variables) using the `grafana.extraEnvVars` setting in your `values.yaml` file.
  * Added a new **Ephemeral Storage Overwrite Gigabytes** slider to the Git Sync configuration screen. You can configure this slider to allocate more memory for syncing larger Git repos.
  * Added a new **Sync Timeout** slider to the Git Sync configuration screen. You can configure this slider to set a maximum allowed length of time for syncing a Git repo.

  ### Bug Fixes

  * Removed root user permissions for authSidecar
  * Added AWS RDS certificates to list of trusted certificates
  * Removed support for Kubernetes 1.18
  * Fixed some confusing behavior with the Git-Sync **SSH Key** field in the UI
  * Fixed an issue where the Astronomer platform and Airflow could not communicate in environments where inter-namespace communication is disabled
  * Fixed an issue where users would frequently get 502 errors when logging in to the Astronomer UI
  * Fixed an issue where users would get timeout issues when attempting to log in to an Astronomer installation on OpenShift
</Update>

<Update label="0.27.4" description="March 8, 2022">
  ### Bug Fixes

  * Fixed an issue where you could not install Astronomer Software 0.27 or 0.28 in an airgapped environment
  * Fixed an issue where new users without permissions to create Workspaces would be directed to the **New Workspace** page when they first log in
  * Fixed several CVEs
</Update>

<Update label="0.27.3" description="Feb 22, 2022">
  ### Limit Workspace Creation to System Admins

  To provide more control over resource usage across your organization, you can now limit the ability to create Workspaces only to users with System Admin permissions.

  For more information about each role's permissions, including instructions for how to modify a role's permissions, see [Platform User Management](/docs/astro-private-cloud/v-0-37/manage-platform-users).

  ### Additional improvements

  * Added the `houston.config.deployments.enableSystemAdminCanCreateDeprecatedAirflows` configuration which enables System Admins to create Deployments with deprecated versions of Astronomer Certified

  ### Bug Fixes

  * Fixed documentation links in the Software UI
</Update>

<Update label="0.27.1" description="January 10, 2022">
  ### Bug Fixes

  * Fixed an issue where users could not create Deployments via an IAM role
</Update>

<Update label="0.27.0" description="December 21, 2021">
  ### Custom OAuth Flows

  You can now configure a custom OAuth flow as an alternative to Astronomer's default implicit flow. You can customize Astronomer's existing Okta, Google, and GitHub OAuth flows, or you can import an entirely custom OAuth flow. For more information, read [Configure a Custom OAuth Flow](/docs/astro-private-cloud/v-0-37/integrate-auth-system#configure-a-custom-oauth-flow).

  ### Deploy DAGs via Git Sync

  You can now configure a Git repo to continually push DAGs to an Astronomer Deployment via git-sync. DAGs deployed via git-sync automatically appear in the Airflow UI without requiring additional action or causing downtime. For more information, read [Deploy DAGs via Git Sync](/docs/astro-private-cloud/v-0-37/deploy-git-sync).

  ### External ElasticSearch Logging

  Custom ElasticSearch logging tools are now supported via new values in your `values.yaml` file:

  ```yaml wrap theme={null}
  # External ES logging
  global:
    customLogging:
      enabled: true
      scheme: https
      host: ""
      port: ""
      secret: ""
      #secretName: ~
      #awsSecretName: ~
      #awsIAMRole: ~
      #awsServiceAccountAnnotation: ~
  ```

  ### CLI Support for Podman

  By default, the Astronomer CLI uses Docker to execute a few specific commands. As an alternative, you can now configure the Astronomer CLI to use Podman instead. For more information, read [Run the CLI with Podman](/docs/cli/v1.43/use-podman).

  ### Bug Fixes

  * Dropped support for Kubernetes 1.17
  * Fixed an issue where redeployments could clobber existing annotations for namespaces
  * Fixed an issue where new Deployments could potentially generate invalid usernames for Celery and the metadata DB
  * Fixed an issue where scheduler, webserver, and worker logs were not accessible via the Astronomer CLI
  * Fixed an issue where setting extra volumes via `values.yaml` did not work when NFS DAG deploys were enabled.
</Update>

<Update label="0.26.7" description="March 1, 2022">
  ### Additional improvements

  * Fixed several CVEs
  * Updated documentation links in the UI to point to Software documentation
</Update>

<Update label="0.26.6" description="January 10, 2022">
  ### Bug Fixes

  * Fixed an issue where users could not create Deployments via an IAM role
</Update>

<Update label="0.26.5" description="December 11, 2021">
  ### Security fixes

  Resolved the following vulnerabilities:

  * Remediated [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) related to Log4J by setting ES\_JAVA\_OPTS=-Dlog4j2.formatMsgNoLookups=true at runtime for all ElasticSearch containers
</Update>

<Update label="0.26.4" description="November 22, 2021">
  ### Support for Airflow 2.2.0

  [Apache Airflow 2.2.0](https://airflow.apache.org/blog/airflow-2.2.0/) is an exciting milestone in the open source project. Most notably, this release introduces custom timetables and deferrable operators.

  #### Custom Timetables

  Timetables are a powerful new framework that you can use to create custom schedules using Python. In an effort to provide more flexibility and address known limitations imposed by cron, timetables use an intuitive `data_interval` that, for example, allows you to schedule a DAG to run daily on Monday through Friday, but not on the weekend. Timetables can be easily plugged into existing DAGs, which means that it's easy to create your own or use community-developed timetables in your project.

  For more information on using timetables, read the [Apache Airflow Documentation](https://airflow.apache.org/docs/apache-airflow/stable/howto/timetable.html).

  #### Deferrable Operators

  Deferrable operators are a new type of Airflow operator that promises improved performance and lower resource costs. While standard operators and sensors take up a Worker or Scheduler slot even when they are waiting for an external trigger, deferrable operators are designed to suspend themselves and free up that Worker or Scheduler slot while they wait. This is made possible by a new, lightweight Airflow component called the Triggerer.

  As part of supporting deferrable operators, you can provision multiple Triggerers on your Astronomer Deployments. By provisioning multiple Triggerers, you can ensure that tasks using Deferrable Operators are run even when one Triggerer goes down. For more information about configuring Triggerers and other resources, see [Configure a Deployment](/docs/astro-private-cloud/v-0-37/configure-deployment).

  ### CLI Verbosity Flag

  You can now specify a `--verbosity` flag for all Astronomer CLI commands. When you specify this flag with a CLI command, the CLI prints out [Logrus](https://github.com/sirupsen/logrus) logs as the command runs. This is useful for debugging any errors that might result from a CLI command.

  The flag prints out different levels of logs depending on the value that you pass it. Each possible value (`debug`, `info`, `warn`, `error`, `fatal`, and `panic`) maps to a different Logrus logging level. For more information about these logging levels, read the [Logrus documentation](https://github.com/sirupsen/logrus#level-logging).

  ### Minor Improvements

  * You can now create a custom set of cluster-level permissions for the Astronomer Commander service by setting `astronomer.global.clusterRoles: false` in your `values.yaml` file and pushing a new [RoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) to a pre-created Kubernetes namespace.
  * In the `astronomer.houston.config` section of your `values.yaml` file, you can now configure a list of `allowedSystemLevelDomains []`. If you configure this list, only users with emails from domains specified in the list (for example, `<company>.com`) can be granted System Admin privileges.
  * Greatly improved load times for the **System Admin** page in the UI.
  * You can now specify a node port for 3rd party ingress controllers with a service type of `nodePort`.
  * The naming format of service account pods has been changed from `<release-name>-dags-prod-worker-serviceaccount` to `release_name-dags-prod-airflow-worker`.

  ### Bug Fixes

  * Fixed an issue where you could not update an existing Deployment's IAM role via the Astronomer CLI
  * Fixed an issue where Deployments would not work on clusters with custom domains
  * Fixed error handling when interacting with a Deployment that wasn't fully spun up
  * Added a new validation step for Airflow Helm chart values configured in the `astronomer.houston.config.deployments.helm.airflow` section of `values.yaml`
</Update>