What's Changed
- Support multi-arch downloads for helm docs by @patelsmit32123 in #1282
- Added support for using host network by @patelsmit32123 in #1277
- add rotateDaysBeforeExpiry to the OpenSearchCluster manifest by @arnitolog in #1281
- feat: add OLM bundle and Red Hat OpenShift certification support by @josedev-union in #1284
- feat: add CVE check CI job and update task file for olm validation by @josedev-union in #1288
- fix: one-time sync from old apiVersion to new one by @josedev-union in #1294
- fix: limit the last-applied annotation length by @josedev-union in #1291
- fix: transfer certificate secret ownership during API migration by @josedev-union in #1296
- Add configuration options for securityconfig-update pod by @UhyeongJo in #1270
- fix cve-2025-68121 by @josedev-union in #1304
- ci: use ct for chart lint by @josedev-union in #1306
- chore: add markStsReady helper function by @josedev-union in #1305
- Check rollout status of existing nodepools before cleaning up removed nodepools by @ThisIsQasim in #1190
- add storageclass for bootstrap pod by @josedev-union in #1309
- Fix: Properly quote YAML values with special characters by @josedev-union in #1311
- feat: support hostpath in additionalVolumes by @josedev-union in #1312
- fix: compare the node name before reconcile in smart scaler by @josedev-union in #1321
- Added support for custom OpenSearch HOME path by @patelsmit32123 in #1323
- Fix typos in user guide: version fields are strings by @lindhe in #1324
- fix cve-2026-24051 by @josedev-union in #1337
- chart: fix operator chart appVersion by @josedev-union in #1340
- fix: add waiting status check in smartscaler to avoid race condition by @josedev-union in #1332
- Add reconciler error count prometheus metric by @patelsmit32123 in #1336
- webhook: reject duplicate node pool component names by @josedev-union in #1345
- helm: add namespace to various OpenSearch resources in templates by @kobin23 in #1338
- fix bootstrap pod being removed before all masters are ready by @josedev-union in #1346
- fix: fetch node name from _cat/shards api correctly by @josedev-union in #1343
- ci: add a small delay before waiting cert-man rollout by @josedev-union in #1348
- chart: release operator chart 3.0.0 by @josedev-union in #1353
- fix: upgrade go version to 1.25.8 to fix CVE 2026-25679 and 2026-27142 by @josedev-union in #1359
- fix validations for AdditionalVolumes.persistentVolumeClaim by @josedev-union in #1367
- fix: disable kubeRbacProxy in operator 2.8.x installation by @josedev-union in #1361
- fix statefulsets/status RBAC for strict RBAC installs by @josedev-union in #1358
- Resolve CVE-2026-33634 by @peterzhuamazon in #1380
- fix CVE-2026-33186 by @josedev-union in #1377
- Add ready pod status check in CountRunningPodsForNodePool func by @patelsmit32123 in #1385
- fix: remove explicit BearerTokenFile from ServiceMonitor endpoint by @joluc in #1391
- fix: retry allocation exclude removal so nodes don't stay stuck by @josedev-union in #1357
- fix vulnerabilities by @josedev-union in #1398
- helm: support ingress configuration per nodePool by @dbsrl44 in #1317
- fix: correctly parse comma-separated watch namespaces by @josedev-union in #1403
- docs: clarify setVMMaxMapCount upgrade behavior before 3.0.0-alpha by @josedev-union in #1401
- Add josedev-union as a maintainer by @prudhvigodithi in #1405
- Fix incorrect CA certificate path when using generate: true with cust… by @synhershko in #1287
- fix(upgrade): skip empty unsupported-cluster-settings update on 2.x u… by @josedev-union in #1400
- Upgrade jenkins library version to accomodate new secrets vault by @gaiksaya in #1420
- fix CVE-2026-33811, 33814, 39820, 39836, 42499 by @josedev-union in #1419
- Add issues write permission to untriaged label workflow by @shreyah963 in #1421
- Pin GitHub Actions to commit SHAs by @Divyaasm in #1422
- fix: avoid finalizer deadlock when resources are being deleted by @josedev-union in #1429
- helm(cluster): Use appVersion as image tag by default by @lindhe in #1427
- Authenticate the operator to OpenSearch via mTLS client cert by @peropyict in #1414
- fix: bump go 1.25.11 to address CVE-2026-42504 by @josedev-union in #1432
- remove whitelist file type from security config update by @josedev-union in #1375
- fix: honor tls caSecret in securityconfig-update job by @josedev-union in #1404
- fix cves by @josedev-union in #1440
- feat: add monitoring relabelings and metric relabelings support by @mrgitics in #1408
- doc: split crd docs for different api types by @josedev-union in #1444
- Update SnapshotConfig booleans to pointers by @kzap in #1390
- fix: support disabling security plugin by @josedev-union in #1302
- fix: render gRPC transport settings as valid opensearch.yml by @synhershko in #1459
- fix: add client-side timeouts to the OpenSearch HTTP transport by @synhershko in #1458
- fix CVE-2026-39822 by @josedev-union in #1466
- Fix RollingRestart findStatus returning wrong ComponentsStatus entry by @AruneshDwivedi in #1468
- fix: gate emptyDir recovery on missing pods and a grace period by @josedev-union in #1467
- fix: retry failed securityconfig-update jobs by @josedev-union in #1465
- fix: disable bash globbing in startup command by @josedev-union in #1445
- fix xDS RBAC and HTTP/2 Vulnerabilities by @josedev-union in #1470
- fix CVE-2026-46600 and CVE-2026-56852 by @josedev-union in #1478
- Fix/preserve custom users in apply user hashes by @robertpaschedag in #1464
- feat(helm): allow disabling legacy API by @Pigueiras in #1438
- fix: stop one failing sub-reconciler from freezing cluster maintenance by @josedev-union in #1469
- feat: allow customizing the security context of init helper containers by @synhershko in #1461
- feat: allow image ref setting per a node pool by @josedev-union in #1442
- feat: support node-label based shard allocation awareness by @Pigueiras in #1463
- fix: generate admin/dashboards passwords that meet the security plugin policy by @synhershko in #1487
- fix: address unit test failures and bump go 1.25.13 to address stdlib CVEs by @josedev-union in #1497
- fix: fail closed on scale-down drain checks so nodes still holding data are not removed by @josedev-union in #1500
- Renew expired or CA-mismatched generated TLS certificates and restart nodes on rotation by @synhershko in #1460
- fix: honor deprecated transport.adminDn as fallback for admin_dn by @synhershko in #1489
- fix: skip non-YAML files when validating securityconfig secret by @synhershko in #1492
- fix: don't block reconciliation when monitoring is enabled but ServiceMonitor CRD is missing by @synhershko in #1493
- feat: use parallel podManagementPolicy for sts by @josedev-union in #1329
- fix: don't clear allocation exclusion for nodes whose nodePool was removed by @ThisIsQasim in #1476
- fix: harden upgrade state machine against abort, custom images, and crashloops by @josedev-union in #1473
- fix CVE-2026-56854 and CVE-2026-84304 by @josedev-union in #1511
- fix: backfill pvc labels to new api group during migration by @josedev-union in #1409
- fix: make cluster reconciler concurrency configurable by @josedev-union in #1510
- fix: allow cluster to initialize when http tls is disabled but transport tls is enabled by @synhershko in #1518
- fix: recover from ImagePullBackOff on upgrade abort and stop scaler gate starving upgrade/restart reconcilers by @synhershko in #1535
- fix: keep bootstrap pod until a real node has joined the cluster by @josedev-union in #1504
- chore: bump go version to 1.26.x by @josedev-union in #1564
- fix: don't leak last-applied annotation into pod templates; pin dashboards rollingUpdate by @synhershko in #1523
- fix: only add migration finalizer when a legacy twin exists by @synhershko in #1559
- webhook: reject unknown node pool roles and missing cluster-manager pool by @synhershko in #1557
- fix: don't let secondary-kind reconcilers clobber a concurrent status write by @synhershko in #1563
- fix: default confMgmt block so smartScaler defaults to true when omitted by @synhershko in #1536
- fix: warn when a custom roles_mapping.yml leaves the Dashboards user unmapped by @synhershko in #1556
- fix: reject unset-enabled transport/http TLS with no generate or secret by @synhershko in #1546
- fix: use RequeueAfter for scaler drain-wait polling instead of bare Requeue by @synhershko in #1554
- fix: do not start a rolling restart while a scaled-down pod is still terminating (#1572) by @synhershko in #1577
- fix: re-enable shard allocation when an upgrade is reverted (#1571) by @synhershko in #1575
- fix: patch instead of full-update legacy CR metadata during migration by @synhershko in #1561
- fix: skip bootstrap pod when node pool PVCs already exist (#1573) by @synhershko in #1578
- fix: retry legacy status restore on migrated twins until it sticks by @synhershko in #1576
- fix: don't destructively re-apply securityconfig when adopting a cluster from operator <=2.8.0 by @synhershko in #1562
- fix: key componentsStatus Replace/RemoveIt on identity, not stale Status by @synhershko in #1551
- fix: reject invalid spec.general.version transitions at admission by @synhershko in #1555
- fix: detect securityconfig job failure promptly and honor retry backoff by @synhershko in #1560
- fix: recognize StatefulSet-recreated pods as missing for emptyDir recovery by @synhershko in #1558
- docs: call out the cert-manager prerequisite in the Installation section by @gohri81-tech in #1583
- feat: add PersistentVolumeClaimRetentionPolicy to GeneralConfig by @josedev-union in #1437
- fix: detect stuck pods repeatedly killed while Running-but-not-ready by @synhershko in #1549
- fix: let rolling restarts and upgrades proceed on a permanently yellow cluster by @synhershko in #1569
- fix: generate release notes and mark prereleases in the release workflow by @synhershko in #1490
- ci: fix the two workflow failures on main that a code change can fix by @synhershko in #1566
- fix: hold a scale-down while any node pool has a pod down by @synhershko in #1593
- release: bump versions for 3.0.0-beta by @synhershko in #1594
- Update k8s new release method workflows by @peterzhuamazon in #1596
- Update release permission to use GITHUB_TOKEN by @peterzhuamazon in #1597
New Contributors
- @arnitolog made their first contribution in #1281
- @UhyeongJo made their first contribution in #1270
- @lindhe made their first contribution in #1324
- @kobin23 made their first contribution in #1338
- @dbsrl44 made their first contribution in #1317
- @gaiksaya made their first contribution in #1420
- @shreyah963 made their first contribution in #1421
- @Divyaasm made their first contribution in #1422
- @peropyict made their first contribution in #1414
- @mrgitics made their first contribution in #1408
- @kzap made their first contribution in #1390
- @AruneshDwivedi made their first contribution in #1468
- @robertpaschedag made their first contribution in #1464
- @Pigueiras made their first contribution in #1438
- @gohri81-tech made their first contribution in #1583
Full Changelog: v3.0.0-alpha...v3.0.0-beta