What k8sgpt-ai/k8sgpt shipped
Written by FoxPlug from the repository's own releases; not affiliated with K8sgpt. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/k8sgpt-ai/k8sgpt; K8sgpt did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Bumped helm.sh/helm/v3 to v3.20.2 to address CVE-2025-53547, with the transitive dependency work needed to build. Pull request #1791
- Release artifacts are now signed with cosign keyless signing over the checksums file from GoReleaser. Pull request #1889
- The ollama, cohere and huggingface backends now reject empty completions the same way. Pull request #1922
- The Ollama backend now applies maxtokens and topk from auth configuration. Pull request #1905
- Bedrock Converse, Cohere, SageMaker, OCI and Google backends now fall back to 2048 max tokens when none is configured, matching the other backends. Pull request #1916
- Verbose and cache messages no longer go to stdout, so analyze with json output can be piped into jq. Pull request #1906
- Workflows get restricted token permissions plus Scorecard, Security Insights and dependency policy files. Pull request #1894
Why it matters
This week fixed a set of provider backends so that configured limits take effect and blank answers are reported as errors instead of empty explanations. It also removed stdout noise that broke piping json output, and closed a Helm dependency CVE. On the project side, security, governance and maintainer documentation was brought in line with CNCF expectations, and releases are now signed.
Changelog entry
- Bump helm.sh/helm/v3 to v3.20.2 for CVE-2025-53547. Pull request #1791
- Sign release artifacts with cosign keyless signing. Pull request #1889
- Reject empty completions from ollama, cohere and huggingface. Pull request #1922
- Keep verbose and cache messages off stdout. Pull request #1906
- Send maxtokens and topk to Ollama. Pull request #1905
- Default max tokens for Bedrock Converse, Cohere, SageMaker, OCI and Google backends. Pull request #1916
- Restrict workflow token permissions and add Scorecard, Security Insights and dependency policy. Pull request #1894
- Expand security policy with reporting channels, response roles and timelines. Pull request #1896
- Correct the general technical review on anonymization default, operator writes and security team. Pull request #1891
This week: Helm bumped to v3.20.2 for CVE-2025-53547, release artifacts signed with cosign keyless signing, and several backends fixed to respect max tokens and reject empty completions. Verbose output no longer breaks json piping.
Week of October 26, 2026
What shipped
- Adding or removing filters over MCP keeps the core analyzers active instead of replacing the whole list. Pull request #1857
- Added an opt-in NodePool analyzer for Karpenter v1. Pull request #1843
- Analyzer warnings no longer go to stdout, so JSON output stays valid for jq. Pull request #1849
- OLM analyzers now honor namespace, label and resource filters. Pull request #1859
- OLM ClusterServiceVersion and Subscription analyzers now report the current failure reason. Pull request #1855
- HPA and KEDA ScaledObject target kinds are matched case-insensitively. Pull request #1862
Why it matters
This week fixes several cases where configuration was ignored, such as the default backend and maxtokens, and where analyzers returned wrong or incomplete results. It also adds a Karpenter NodePool analyzer and a new provider, so users get more accurate analysis with less manual setup.
Changelog entry
- Honor the default AI provider in serve and query. Pull request #1872
- Keep core analyzers when adding or removing filters over MCP. Pull request #1857
- Add NodePool analyzer for Karpenter v1. Pull request #1843
- Keep analyzer warnings off stdout. Pull request #1849
- Honor namespace, label and resource filters in OLM analyzers. Pull request #1859
- Report the current failure reason for OLM ClusterServiceVersion and Subscription. Pull request #1855
- Accept case-insensitive scale target kinds. Pull request #1862
- Use the HPA namespace in the resource-configured message. Pull request #1847
Week of October 19, 2026
What shipped
- Added an opt-in NodeClaim analyzer for Karpenter v1 so pending pods can be traced to conditions recorded on the node they are waiting for. Pull request #1842
- The Ollama backend now checks for a requested model and prompts to pull it when it is missing, instead of failing straight away. Pull request #1766
- Hardened completion calls so empty responses are checked before use and requests no longer hang. Pull request #1731
Why it matters
This week brings a new release plus a new Karpenter analyzer, so users on Karpenter v1 can diagnose pending pods that never get a ready node. The release also widens model choice on Amazon Bedrock and makes the Ollama backend easier to use when a model is not installed. Several robustness and configuration fixes round it out.
Changelog entry
- Release v0.4.41. Release
- Allow customHeaders to be sourced from the config file. Release
- Prompt to auto-pull missing ollama models. Release
- Accept an empty storageClassName in StatefulSet analysis. Release
- Add opt-in NodeClaim analyzer for Karpenter v1. Pull request #1842
- Prompt to auto-pull missing ollama models. Pull request #1766
- Harden completion calls against empty responses and hangs. Pull request #1731
Week of October 12, 2026
What shipped
- The node analyzer now recognizes node-problem-detector conditions, so healthy nodes no longer report conditions such as KernelDeadlock with reason KernelHasNoDeadlock as errors. Pull request #1821
- The Gateway API analyzers now honor the namespace filter, so a namespaced analyze run no longer includes Gateway and HTTPRoute results from every namespace. Pull request #1826
- Kyverno ClusterPolicyReport results are now reported; the severity check expected uppercase CRITICAL but the CRD only allows lowercase values, so nothing was ever reported. Pull request #1832
- HTTPRoute AllowedRoutes namespace selectors are now matched against the namespace labels instead of the route's own labels. Pull request #1825
- Mutating and ValidatingWebhookConfiguration findings are no longer collapsed when two configurations share a webhook name, so the dropped finding is kept. Pull request #1827
- Util.GetParent keeps the known parent when the top owner has a kind it does not support, instead of losing the result of the earlier step. Pull request #1833
- An unsupported KEDA scaleTargetRef kind, such as an Argo Rollout, is no longer reported as a missing target. Pull request #1831
- A StatefulSet volumeClaimTemplates entry with an empty storageClassName is no longer treated as a class to look up. Pull request #1830
- Custom headers can now be sourced from the config file, and headers passed on the CLI are appended to those in the file. Pull request #1339
- The node analyzer now looks up the healthy status of each condition type through one helper, so adding a new source of conditions is a one-line change. Pull request #1838
Why it matters
This week's fixes target analyzers that were quietly wrong: Kyverno policy reports and Gateway API results could be missed or shown from the wrong namespace, and health conditions from node-problem-detector were flagged as errors. Webhook, StatefulSet and owner-reference fixes reduce false or dropped findings. Custom headers can now come from the config file, which helps teams that configure through it.
Changelog entry
- Recognize node-problem-detector node conditions so healthy nodes are not reported as errors Pull request #1821
- Honor the namespace filter in the Gateway API analyzers Pull request #1826
- Report failed results in Kyverno ClusterPolicyReports by checking lowercase severity values Pull request #1832
- Match HTTPRoute namespace selectors against the namespace instead of the route labels Pull request #1825
- Keep webhook findings when configurations share a webhook name Pull request #1827
- Keep the known parent when the top owner has an unsupported kind in util.GetParent Pull request #1833
- Do not report an unsupported KEDA scaleTargetRef as missing Pull request #1831
- Accept an empty storageClassName in StatefulSet claim templates Pull request #1830
- Source customHeaders from the config file and append CLI headers Pull request #1339
- Look up the healthy status of each node condition type through one helper Pull request #1838
Fixes this week: node-problem-detector conditions no longer show as errors on healthy nodes, Gateway analyzers honor the namespace filter, Kyverno ClusterPolicyReport results are reported, and custom headers can come from the config file.
This week's changes to K8sgpt focus on analyzer correctness. Node conditions added by node-problem-detector, such as KernelDeadlock with reason KernelHasNoDeadlock, are no longer reported as errors on healthy nodes. The Gateway API analyzers now honor the namespace filter, so a namespaced analyze run only includes that namespace. Kyverno ClusterPolicyReport results are reported again: the severity check expected uppercase CRITICAL while the CRD only allows lowercase values. HTTPRoute namespace selectors are matched against the namespace, webhook findings are no longer dropped when configurations share a webhook name, and unsupported KEDA scaleTargetRef kinds are not reported as missing. Custom headers can now be read from the config file, with CLI headers appended.
Week of October 5, 2026
What shipped
- Released version 0.4.40, adding a ResourceClaim analyzer for missing DeviceClasses and fixing several analyzer issues. Release
- NetworkPolicy analysis now honors matchExpressions in pod selectors, instead of only reading matchLabels. Pull request #1818
- The PodDisruptionBudget analyzer now reports blocked PDBs whose selector is empty or uses matchExpressions. Pull request #1797
- PDB selector operators are now rendered as readable phrases such as NotIn and DoesNotExist. Pull request #1820
- The OLM analyzers no longer panic on catalogs that have no image. Pull request #1815
- The StatefulSet analyzer now honors start ordinals other than zero. Pull request #1759
- The Kyverno policy-report scheme is now registered once in NewClient, avoiding concurrent map writes. Pull request #1777
- API doc lookups for the MutatingWebhookConfiguration and ValidatingWebhookConfiguration analyzers are now correct. Pull request #1802
Why it matters
This week fixes analyzers that could report the wrong result or fail silently. NetworkPolicy and PodDisruptionBudget selectors are now read fully, StatefulSet and OLM analysis no longer stops early or panics, webhook doc lookups are right, and version 0.4.40 ships these changes along with the new ResourceClaim check.
Changelog entry
- Add ResourceClaim analyzer for missing DeviceClasses Release
- Close the custom analyzer gRPC connection after each analysis Release
- Correct API doc lookups for the webhook analyzers Release
- Honor matchExpressions in NetworkPolicy pod selectors Pull request #1818
- Report blocked PDBs whose selector is empty or uses matchExpressions Pull request #1797
- Render PDB selector operators as readable phrases Pull request #1820
- Stop the OLM analyzers panicking on catalogs without an image Pull request #1815
- Honor StatefulSet start ordinals Pull request #1759
- Register kyverno policy-report scheme once to avoid concurrent map writes Pull request #1777
K8sgpt v0.4.40 is out. This week: NetworkPolicy matchExpressions and PDB selectors are honored, OLM no longer panics, StatefulSet start ordinals work, and webhook doc lookups are fixed.
K8sgpt v0.4.40 is out. This week we fixed several analyzers that could produce wrong or missing results: NetworkPolicy selectors now honor matchExpressions, the PodDisruptionBudget analyzer reports blocked PDBs with empty or matchExpressions selectors, and selector operators read as plain phrases like NotIn and DoesNotExist. The OLM analyzers no longer panic on catalogs without an image, the StatefulSet analyzer honors start ordinals, the Kyverno scheme is registered once in the client, and the webhook analyzers now resolve API docs correctly. The release also adds a ResourceClaim analyzer for missing DeviceClasses.
Week of September 28, 2026
What shipped
- Fixed gRPC connection leaks where custom analyzers left one connection open per analysis call. Pull request #1800
- Fixed ConfigMap tracking in cluster-wide analysis to properly scope ConfigMaps to their namespaces. Pull request #1812
- Fixed Deployment, DaemonSet, and Webhook analyzers to use caller-supplied context instead of context.Background(). Pull request #1732
- Fixed GatewayClass analyzer to properly locate the Accepted condition in unordered status condition slices. Pull request #1806
- Fixed Ingress analyzer to detect missing default backend services specified at the top level. Pull request #1810
- Fixed Job analyzer to detect failed jobs that exceed activeDeadlineSeconds and report DeadlineExceeded/JobFailed conditions. Pull request #1809
- Fixed PersistentVolumeClaim analyzer to report FailedBinding events when claims remain pending. Pull request #1808
- Fixed S3 cache backend to paginate through all ListObjectsV2 results instead of stopping after the first response. Pull request #1811
- Added recognition of EKS node monitoring agent conditions (KernelReady, NetworkingReady, StorageReady, ContainerRuntimeReady, AcceleratedHardwareReady). Pull request #1798
- Fixed serve command to respect K8SGPT_BACKEND environment variable on every restart, not just initial startup. Pull request #1749
Why it matters
This week addresses resource leaks in custom analyzers and fixes detection accuracy across multiple analyzer types. Improvements to context handling, condition checking, and status reporting make the project more reliable in cluster environments and reduce false negatives in failure detection.
Changelog entry
- Close gRPC connections from custom analyzers after each analysis to prevent connection leaks Pull request #1800
- Scope ConfigMap usage tracking to pod namespace in cluster-wide analysis Pull request #1812
- Use caller-supplied context in Deployment, DaemonSet, and Webhook analyzers Pull request #1732
- Use apimeta.FindStatusCondition to locate GatewayClass Accepted condition Pull request #1806
- Recognize EKS node monitoring agent conditions (KernelReady, NetworkingReady, StorageReady, ContainerRuntimeReady, AcceleratedHardwareReady) Pull request #1798
- Report missing default backend services in Ingress analyzer Pull request #1810
- Use apimeta.FindStatusCondition to locate PDB DisruptionAllowed condition Pull request #1807
- Report DeadlineExceeded and JobFailed conditions in Job analyzer Pull request #1809
- Report FailedBinding events in PersistentVolumeClaim analyzer Pull request #1808
- Paginate S3 object listings to consume all ListObjectsV2 pages Pull request #1811
- Honour K8SGPT_BACKEND environment variable on every serve start Pull request #1749
- Handle empty AI responses and respect configured language setting Pull request #1756
This week's releases fix gRPC leaks in custom analyzers, improve Ingress and Job failure detection, and add EKS node condition support. Cluster-wide analysis and S3 caching are also more reliable.
K8sgpt improvements this week target reliability and detection accuracy: gRPC connection leaks in custom analyzers are fixed, GatewayClass and PDB analyzers now correctly find status conditions in unordered slices, Jobs that exceed deadline are detected, Ingress defaultBackend is validated, and PersistentVolumeClaim binding failures are reported. EKS node monitoring conditions are now recognized. Context handling and S3 pagination are fixed.
Week of September 21, 2026
What shipped
- Added ResourceClaim analyzer to check Kubernetes Dynamic Resource Allocation DeviceClass references and report missing device class names. Pull request #1768
- Fixed Deployment analyzer to skip replica mismatch reports during healthy rollouts when the controller has not yet observed the latest spec. Pull request #1743
- Fixed NetworkPolicy analyzer to scope pod lookups to the policy's namespace instead of searching cluster-wide. Pull request #1747
- Fixed analyzer to stop reporting local StorageClasses without provisioners as deprecated. Pull request #1779
- Updated release pipeline to use release tags for gating GoReleaser and container publishing instead of relying on release-please output. Pull request #1803
- Updated CONTRIBUTING.md to point to CNCF Slack instead of the expired invite link. Pull request #1799
Why it matters
This week addresses correctness in multiple analyzers that were generating false positives during normal cluster operations. The Deployment and NetworkPolicy fixes reduce noise for users dealing with rollouts and network policies, while the new ResourceClaim analyzer expands coverage for Kubernetes features. Release pipeline improvements ensure more reliable artifact publishing.
Changelog entry
- Feat: add ResourceClaim analyzer for missing DeviceClasses Pull request #1768
- Fix: ignore in-progress Deployment replica mismatches Pull request #1743
- Fix: scope NetworkPolicy pod lookup to policy namespace Pull request #1747
- Fix: stop reporting local StorageClasses as deprecated Pull request #1779
- Ci: run release jobs from the release tag Pull request #1803
- Docs: point CONTRIBUTING.md at CNCF Slack Pull request #1799
K8sgpt fixes false positives in Deployment and NetworkPolicy analysis, adds ResourceClaim analyzer for Dynamic Resource Allocation, and improves release reliability.
This week's K8sgpt updates focus on reducing false positives in cluster diagnostics. The Deployment analyzer now skips replica mismatches during healthy rollouts, and NetworkPolicy analysis correctly scopes pod lookups to policy namespaces. New support for ResourceClaim analyzer enables checking Kubernetes Dynamic Resource Allocation DeviceClass references. Release pipeline improvements ensure reliable artifact publishing.
Week of September 14, 2026
What shipped
- Released v0.4.39 with a new --resource flag to analyze single resources and a ValidatingAdmissionPolicy analyzer for Kubernetes admission policies. Release
- Added ValidatingAdmissionPolicy analyzer that reports CEL type-check warnings and validates policy bindings. Pull request #1765
- Fixed MCP list-events tool to send involvedObject filters as field selectors instead of filtering results locally. Pull request #1792
- Fixed analyzer event fetching to match full object identity including kind and UID, not just name. Pull request #1790
- Fixed service event scoping to respect endpoint namespaces. Pull request #1795
- Fixed service analyzer to filter events by involved object kind, preventing misattribution of events from other resources with the same name. Pull request #1783
- Fixed Security analyzer to resolve ClusterRole references in RoleBindings by checking roleRef.kind. Pull request #1755
- Fixed --anonymize flag to mask resource names appearing in Kubernetes event messages. Pull request #1778
- Fixed ReplicaSet analyzer to report ReplicaFailure conditions regardless of replica count. Pull request #1750
- Added safety check in OpenAIClient to handle empty completion choices from compatible backends. Pull request #1781
Why it matters
This week focused on event filtering accuracy and namespace isolation. Several fixes prevent events and resource references from being misattributed to the wrong objects, which directly improves diagnostic accuracy.
Changelog entry
- Add --resource flag to analyze a single resource Release
- Add ValidatingAdmissionPolicy analyzer Release
- Anonymise resource names in event-derived failures Pull request #1778
- Send involvedObject filters as a field selector in MCP list-events Pull request #1792
- Scope analyzer events to object identity Pull request #1790
- Scope service events to endpoint namespace Pull request #1795
- Filter service events by involved object kind Pull request #1783
- Resolve ClusterRole references in RoleBindings Pull request #1755
- Report ReplicaFailure regardless of replica count Pull request #1750
- Do not also report an unsupported scaleTargetRef as missing Pull request #1729
V0.4.39 shipped: new --resource flag for single-resource analysis, ValidatingAdmissionPolicy analyzer, and fixes for event scoping and object reference resolution.
V0.4.39 is out with improvements to event scoping and object reference handling. The new --resource flag lets you analyze individual resources, while the ValidatingAdmissionPolicy analyzer adds support for Kubernetes admission policies. This release includes multiple fixes to prevent event misattribution and improve namespace isolation in diagnostics.