rajsinghtech/garage-operator v0.9.0

on GitHub

Features

• optional spec.network.service.ipFamilyPolicy / ipFamilies for every operator-managed Service (API, gateway, headless, RPC) (#554) (#557) in #557 by @kevinpark1217
• let an Auto layout writer assign follower roles on external GarageNodes (#553) (#558) in #558 by @kevinpark1217
• FullyReplicated proof with opt-in topology proofs, explicit scope and per-site follower proofs (#486) in #486 by @rajsinghtech
• take one node-local pool member out of service and refill at RF (#475) (#503) in #503 by @rajsinghtech
• update garage default image to v2.5.0 (#527) in #527 by @renovate[bot]

Bug Fixes

• skip ServiceAccount token automount without Kubernetes discovery (#555) (#556) in #556 by @kevinpark1217
• exclude draining storage pods from API Service (#535) (#548) in #548 by @rajsinghtech
• exempt draining out-of-layout nodes from Admin pod-set (#544) (#549) in #549 by @rajsinghtech
• skip retained PVC handoff after completed node cycle (#541) (#547) in #547 by @rajsinghtech
• break cycle vs storage-rollout observedPodUid deadlock (#536) (#546) in #546 by @rajsinghtech
• surface rejected PVC expansion on status (#537) (#545) in #545 by @rajsinghtech
• verify parameter-only changes after Apply (#500) in #500 by @rajsinghtech
• restore real operator image and stop no-op Garage digest pin (#502) in #502 by @rajsinghtech
• keep a release line's first release on patch bumps (#495) in #495 by @rajsinghtech
• commit a federated peer's staged bootstrap role with the local role (#494) in #494 by @rajsinghtech
• re-commit intended changes Garage dropped before Apply (#490) in #490 by @rajsinghtech
• let a reselected Node cancel a retirement that cannot complete (#470) (#497) in #497 by @rajsinghtech
• prove the dynamic operator token on the serving Pod set (#472) (#496) in #496 by @rajsinghtech
• reserve publicEndpoint static nodePorts before the API Service (#491) in #491 by @rajsinghtech
• update module github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring to v0.95.0 (#559) in #559 by @renovate[bot]
• update module sigs.k8s.io/gateway-api to v1.7.0 (#534) in #534 by @renovate[bot]
• update k8s to v0.37.2 (#533) in #533 by @renovate[bot]
• update module go.yaml.in/yaml/v3 to v3.0.6 (#538) in #538 by @renovate[bot]
• update module github.com/onsi/ginkgo/v2 to v2.34.0 (#542) in #542 by @renovate[bot]
• update module github.com/prometheus/client_golang to v1.25.0 (#504) in #504 by @renovate[bot]

Documentation

• add TLS guide (ingress, mesh, pod certificates, admin endpoints) (#512) in #512 by @rajsinghtech
• generate CRD API reference from schemas (#501) in #501 by @rajsinghtech

Miscellaneous

• update module github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring to v0.95.1 (#573) in #573 by @renovate[bot]
• update docker.io/library/golang:1.27 docker digest to 0c050fe (#570) in #570 by @renovate[bot]
• update softprops/action-gh-release digest to 8a0cd65 (#571) in #571 by @renovate[bot]
• update ghcr.io/rajsinghtech/garage-operator docker tag to v0.8.3 (#552) in #552 by @renovate[bot]
• update sigstore/cosign-installer action to v4.1.3 (#560) in #560 by @renovate[bot]
• update dependency buildx to v0.38.2 (#550) in #550 by @renovate[bot]
• update dependency golangci/golangci-lint to v2.15.0 (#513) in #513 by @renovate[bot]
• update dependency helm to v4.3.1 (#511) in #511 by @renovate[bot]
• update dependency kubectl to v1.37.2 (#531) in #531 by @renovate[bot]
• update dependency mkdocs-material to v9.8.0 (#526) in #526 by @renovate[bot]
• update dependency python to 3.15 (#508) in #508 by @renovate[bot]
• update jaxxstorm/action-install-gh-release action to v4 (#539) in #539 by @renovate[bot]
• intermediate module bumps later superseded (#507 ginkgo→#542, #522 monitoring→#559/#573) by @renovate[bot]
• golang / distroless / actions / buildx digest bumps (#498, #499, #505, #509, #510, #514–#516, #517–#521, #523–#525, #528–#530, #532, #540, #562, #566, #568) by @renovate[bot]

Release

• bump chart and docs to v0.9.0 (#563) in #563 by @rajsinghtech

Testing

• settle layout data migration before existingClaim join (#574) in #574 by @rajsinghtech
• retry cert-manager manifest downloads on GitHub 5xx (#572) in #572 by @rajsinghtech
• root-cause Upgrade availability.log (setsid probe loop) and IPv6 kind-get false positive (#569) in #569 by @rajsinghtech
• install kind with pinned checksums (avoid kind-action sha256sum flakes) (#567) in #567 by @rajsinghtech
• harden Connected/InLayout peer-join waits and multi-cluster gateway cleanup (#565) in #565 by @rajsinghtech
• tolerate brief outages during upgrade storage rollouts (#564) in #564 by @rajsinghtech
• collect every Garage pod and layout history in multi-cluster debug dumps (#493) in #493 by @rajsinghtech

Upgrade notes

• Dual-stack Service fields (spec.network.service.ipFamilyPolicy / ipFamilies) are optional (#557). Unset leaves existing Services unmanaged; set ipFamilyPolicy: SingleStack to revert. Applies to API, gateway, headless (ClusterIP: None), and public-endpoint RPC Services. Re-apply CRDs.
• Auto layout writers may assign roles to follower nodes declared as external GarageNodes (#558 / design D2). Followers ignore writer cluster: / cluster-uid: tags when comparing intended roles. Auto + external gateway and NLP pool members remain out of scope.
• Default Garage image is now v2.5.0 (dxflrs/garage:v2.5.0@sha256:677e5b758e4425a325b811c425c026bf35a4bf42f7ddbaa773de3f4fd779a5a5) when spec.image is unset (#527). Clusters that omit spec.image roll to v2.5.0 through the usual storage rollout after upgrading the operator. Pin spec.image (or a chart defaultGarageImage) before upgrading if you need to stay on v2.4.1.
• FullyReplicated / spec.layoutManagement.redundancyVerification are opt-in (#486). Existing clusters keep prior redundancy behavior until you configure the new fields. Re-apply CRDs to pick up the additive schema.
• Node-local out-of-service (#503 / #475) adds the ability to take one pool member out of service and refill at the replication factor. No action required unless you use the new flow.
• Garage pods no longer automount a ServiceAccount token when Kubernetes discovery is off (#556). Clusters without discovery get a one-time pod template change (rollout). Extra containers that need the Kubernetes API should mount a projected ServiceAccount token via extraVolumes.
• Bug fixes also shipped in v0.8.3 are included for anyone jumping from v0.8.2.

New Contributors

• @kevinpark1217 made their first contribution in #556

Full Changelog: v0.8.3...v0.9.0