App Platform v6.0.0 introduces a major platform update with a new secrets management model, enhanced GitOps repository options, support for custom Kubernetes manifests, reduced default infrastructure resource requirements, and updates to core platform components including Argo CD, Kyverno, Istio, and Tekton Pipelines.

External Secrets Operator is added as a new component. A lightweight git-server hosts the values repository, while Gitea becomes an optional platform app. The BYO git feature now supports migration from the default in-cluster git server to an external git repository.

Users can store custom Kubernetes manifests in the values repo. The default platform resource requests have been significantly reduced (0.8 CPU, 1GB RAM, 6 PVs less). Fifteen core components received updates, including ArgoCD, Kyverno, and Tekton Pipelines, alongside numerous stability and CI/CD improvements.

📘

For a full list of changes, review the release notes on GitHub: Release v6.0.0.

New

• Added the following apps: external-secrets, istio-cni, and ztunnel.

Changed

• [Breaking change] Platform secrets are now encrypted by SealedSecrets. Support for SOPS has been removed. See Platform secrets for more details.
• [Breaking change] The values repository is now hosted in an in-cluster lightweight git-server by default. This was previously hosted in Gitea. Now the Gitea app is optional.
• [Breaking change] Access credentials to the values git repository are no longer stored in that repository. See Git credentials storage and access.
• Updated core applications. See the Core application changes table below for details.

Removed

• ingress-nginx
• promtail

Core application changes

Upgrade notes

The automated upgrade from v5 to v6 will be provided in the next patch release. The upgrade procedure moves the values repo from Gitea to the built-in lightweight git server. As part of this, all platform secrets are re-encrypted to be compatible with SealedSecrets.