Skip to content

chore: upgrade headscale to v0.29.3 - #33

Merged
kervel merged 2 commits into
mainfrom
feature/client-only-external-server
Sep 4, 2026
Merged

chore: upgrade headscale to v0.29.3#33
kervel merged 2 commits into
mainfrom
feature/client-only-external-server

Conversation

@kervel

@kervel kervel commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Motivation

headscale released 0.29.x; the chart still shipped v0.28.0.

Changes

  • Bump appVersion and image.tag to v0.29.3 (latest upstream release).
  • Add an "Upgrading to headscale 0.29" section to README.md.gotmpl and regenerate README.md.
  • Correct the AGENTS.md instruction that asked for a manual Chart.yaml version bump — the published chart version comes from the release tag via helm package --version in publish-helm-chart.yaml, so that field is inert.

User impact

The chart's own defaults set none of the config keys 0.29 removed or renamed (randomize_client_port, oidc.expiry, ephemeral_node_inactivity_timeout), and the auto-generated policy uses no wildcards, so it is unaffected by the new * semantics. Users who override config or ship their own policy do need to act, so the README now documents:

  • the strict one-minor-at-a-time upgrade path (0.27 → 0.29 is refused),
  • the three config key moves,
  • the wildcard → tailnet-range ACL change,
  • MagicDNS name changes for nodes with random-hash-suffixed names,
  • the new config.trusted_proxies, needed for real client IPs behind the ingress.

Validation

  • helm lint headscale/ — clean (only the pre-existing "icon is recommended" info).
  • helm template for default, ingress+ui+policy, and client-only (server.enabled=false) — all render.
  • hack/kind-smoke.sh --with-client — passed end-to-end on the new image, including the idempotent second helm upgrade.

🤖 Generated with Claude Code

Bump the image tag and appVersion from v0.28.0 to v0.29.3 and the chart
version to 0.3.0.

The chart's default config sets no keys that 0.29 removed or renamed
(randomize_client_port, oidc.expiry, ephemeral_node_inactivity_timeout),
and the auto-generated policy uses no wildcards, so it is unaffected by
the new `*` semantics. Document those breaking changes plus the strict
one-minor-at-a-time upgrade path and the new trusted_proxies option in
an "Upgrading to headscale 0.29" README section for users who override
config or ship their own policy.

Verified with helm lint, helm template (default, ingress+ui+policy, and
client-only), and hack/kind-smoke.sh --with-client.
The published chart version comes from the git release tag: the publish
workflow runs `helm package --version "${CHART_VERSION}"`, so `version:`
in Chart.yaml is never used. Revert the 0.3.0 bump from the previous
commit, correct the AGENTS.md instruction that asked for it, and drop
the chart-version references from the upgrade notes.
@kervel
kervel merged commit 04fe0a3 into main Sep 4, 2026
1 check passed
@kervel
kervel deleted the feature/client-only-external-server branch September 4, 2026 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant