Altinity/clickhouse-operator release-0.27.2 on GitHub

Added

Add configurable MaxConcurrentReconciles for CHK controller by @miguel-signoz in #2033. Default is 1. Closes #2032

reconcile:
  runtime:
    reconcileCHKsThreadsNumber: 1

Auto-heal Completed CHIs with sustained-NotReady hosts by @dashashutosh80 in #1998. Closes #1994. Tuned off by default:

reconcile:
  recovery:
    onStatus:
      # Recovery for a CHI whose .status.status is Aborted (reconcile did not complete)
      # when one of its host pods transitions to Ready — auto-resumes the reconcile.
      aborted:
      completed:
        # Action when a Completed CHI's pod flips Ready=True -> Ready=False and
        # stays NotReady for at least onPodNotReadyThreshold:
        #   none (default) — do nothing
        #   retry          — re-enqueue the CHI so the stuck host is force-restarted
        # OFF by default: force-recreating a Completed CHI's pod is destructive — it can
        # interrupt a replica's in-progress recovery and means hard downtime for a
        # single-replica shard. Opt in with `retry` only where that trade-off is acceptable.
        onPodNotReady: none
        # Minimum duration a pod must stay Ready=False before recovery fires, once enabled
        # (Go duration string; default 5m). Raise it for slow-recovering replicas.
        onPodNotReadyThreshold: 5m

Configure operator rootCA with a secret. Closes #1925

 clickhouse:
    access:
      scheme: https
      port: 8443
      rootCASecretRef:
        name: root-ca-secret
        key: ca.crt

Helm: Add podSecurityContext and podAnnotations to crdHook Job by @qlevasseur-genetec in #2009

Changed

Split Keeper services to internal and external ones. Closes #1982
Apply filter earlier when scraping metrics in order reduce memory usage by @dentiny in #2028. Closes #2019
Backward-incompatible config rename in ClickHouseOperatorConfiguration: reconcile.recovery.from.{aborted,completed} → reconcile.recovery.onStatus.{aborted,completed} (the from grouping level is removed; per-status action keys are unchanged, and the obsolete from key is silently ignored on load). If you set reconcile.recovery.from.aborted.onPodReady: none on 0.27.0/0.27.1 to disable Aborted auto-recovery, re-apply it as reconcile.recovery.onStatus.aborted.onPodReady: none — otherwise the default (retry) silently re-enables it on upgrade.

Security

Operator metrics port no longer exposes /debug/pprof. The operator's metrics HTTP listener (default :9999) served Go's shared http.DefaultServeMux, onto which net/http/pprof is transitively registered through a controller-runtime dependency — unintentionally exposing the /debug/pprof/* endpoints (including the CPU profile and trace handlers) to anything able to reach the operator's metrics Service, enabling unauthenticated profiling/DoS and heap/goroutine dumps. The listener now uses a dedicated mux that serves only the metrics endpoint; /metrics is unchanged.
Bumped versions of dependent libraries to address CVEs

Fixed

Add replica restart fix for operator when remote_servers configmap is propagated by @oo007 in #2024. Closes #2013
Escape reserved characters in element text by @AruneshDwivedi in #2034
Helm: Wire watchNamespaces value into operator ConfigMap by @jtomaszon in #2007. Closes #1919
Fixed incorrect watched namespace override #2008

FIPS Harness

Align FIPS test plan, requirements, and e2e FIPS coverage, fixed failing operator tests by @Elmo33 in #2011
Wire security.kubernetes.tls.minVersion into the Kubernetes API client transport by @Elmo33 in #2020
Expand FIPS TLS e2e coverage with host-run cipher probes and broader listener rejection checks by @Elmo33 in #2031

New Contributors

@oo007 made their first contribution in #2024
@jtomaszon made their first contribution in #2007
@dentiny made their first contribution in #2028
@miguel-signoz made their first contribution in #2033
@AruneshDwivedi made their first contribution in #2034

Full Changelog: release-0.27.1...release-0.27.2