Arcade 1.8.1

App version e3fb0ab · released 2026-05-26 · previous 1.7.1

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Added

  • auth.gatewayLogin values block — operators can point the Gateway login flow at an external OIDC Identity Provider. The four new fields are auth.gatewayLogin.issuer, auth.gatewayLogin.existingSecret, auth.gatewayLogin.clientIdKey, and auth.gatewayLogin.clientSecretKey. Optional — leaving auth.gatewayLogin.issuer empty (the default) keeps Gateway login behavior unchanged. When existingSecret is unset, the chart reuses auth.upstreamIdp.secretName and the existing UPSTREAM_CLIENT_ID / UPSTREAM_CLIENT_SECRET keys, so the common case of one external IdP app serving both flows needs no extra Secret.
  • Coordinator static-user-source gateway login — coordinator validates the Gateway login token against the configured external IdP via its Identity table, completing the end-to-end wiring for auth.gatewayLogin.
  • workerDefaults values block — centralizes defaults for workers[] entries (image, resources, service, hpa, secret). Per-entry overrides deep-merge on top, so existing values files keep working unchanged.
  • GitHub toolkit fields — repository responses now surface archived, labels, and assignees; PR responses include additions, deletions, changed_files, and commits counts.
  • Google Workspace file-picker hint — Docs, Sheets, Slides, and Drive toolkits can optionally return a file-picker URL alongside results, enabling quick-install UX in calling apps.

Changed

  • GitHub toolkit PR shape — see Upgrade notes. The nested form replaces flat top-level fields.
  • Default worker memory limit — raised from 2Gi to 4Gi via workerDefaults.resources.limits.memory. The previous default was occasionally tight for toolkits that page large API responses. Existing workers[] entries with an explicit resources.limits.memory keep their override.
  • google_docs search-and-retrieve — runs concurrently across documents instead of sequentially.
  • google_sheets reads — metadata and cell-range reads run concurrently and no longer block on each other.
  • Tool descriptions — climate-change framing removed from worker toolkit descriptions in favor of neutral phrasing.

Fixed

  • Deprecated kubernetes.io/ingress.class annotation — no longer emitted on rendered ingress resources. Modern controllers read spec.ingressClassName instead; the annotation was deprecated upstream and produced warnings on newer Kubernetes versions.
  • Confluence toolkit pinned to pre-3.0.0 — the upstream Confluence client shipped a breaking change in 3.0; the toolkit is pinned below that until the worker is updated.
  • Dashboard session-expired redirect — replaced with an in-place auth-recovery dialog, so users no longer lose page state on token expiry. The previous redirect threw the user back to the login screen mid-task.
  • Dashboard onboarding redirect — runs server-side on initial page load. The previous client-side flow rendered an empty layout for a beat before deciding where to send the user, producing a brief blank-screen flicker.
  • Coordinator OAuth callback log level — expected client-side flow drops log at info instead of error, so they no longer page oncall as failures.

Operator impact

  • Default worker memory limit raised 2Gi → 4Gi. Plan for the added headroom on nodes that schedule the worker. Explicit workers[].resources.limits.memory overrides still win.
  • New auth.gatewayLogin values block. Optional. Set auth.gatewayLogin.issuer to an external OIDC issuer URL to point Gateway login at that IdP. Leaving it empty preserves current behavior. See the README's Authentication section for the full table.
  • workerDefaults block is additive. Existing workers[] entries are unchanged and continue to override the defaults field-by-field.
  • No RBAC, secret, or Kubernetes-version changes. kubeVersion remains >=1.30.0-0.
  • Ingress annotation cleanup. If you grep cluster manifests for kubernetes.io/ingress.class, expect it to disappear from Arcade-managed ingresses after upgrade.

API & behavior

  • GitHub toolkit PR responses — nested user/head/base/ reviewers/teams/merged_by sub-objects replace the flat shape.
  • GitHub toolkit repository / PR responses — additional fields surfaced: archived, labels, assignees, plus per-PR additions, deletions, changed_files, commits.
  • Google Workspace toolkits — optional file-picker URL field returned alongside results across Docs, Sheets, Slides, Drive.
  • Gateway login — when auth.gatewayLogin.issuer is set, the coordinator validates login tokens against the external IdP via its Identity table.
  • Dashboard session expiry — in-place auth-recovery dialog replaces the previous redirect.