valkey-io/valkey-operator v0.5.0 on GitHub

v0.5.0 introduces a number of enhancements and bug fixes to ValkeyCluster - thank you to everyone who contributed to this release!

Breaking

ValkeyCluster TLS moved under `spec.networking`

spec.tls is removed. TLS configuration now lives at spec.networking.tls, and certificate.secretName is required when TLS is set. This is phase 1a of the spec.networking tree (#318).

# before
spec:
  tls:
    certificate:
      secretName: valkey-tls

# after
spec:
  networking:
    tls:
      certificate:
        secretName: valkey-tls

We immediately dropped support for spec.tls, so upgrading CRDs against a live cluster will cause it to downgrade to plaintext (no TLS). You can perform these steps to avoid that:

Stop the operator running 0.4
Deploy the 0.5 CRDs
Deploy the migrated ValkeyCluster CRs (from spec.tls to spec.networking.tls)
Start operator running 0.5

We have done this change to align with bucketing all networking related configs under one field networking, of which more features will be added in the future.

Features

Zone scheduling axis (#340)

scheduling.zone.spread mirrors scheduling.node.spread on topology.kubernetes.io/zone, with shard,
primaries, and pods dimensions
All three render as topology spread constraints, so a shard with more members than there are zones balances across
them rather than becoming unschedulable
Admission rejects combinations that would emit duplicate constraints

Zone pinning (#344)

scheduling.zone.pinning.zones assigns every pod a fixed zone by round-robin: zones[(shardIndex + nodeIndex) % len(zones)]
Adding shards or replicas never moves an existing pod
The list is immutable while set
Read the persistence warning in the docs before enabling it on a cluster with persistent volumes

Live ACL changes (#319)

user and password changes now apply to running nodes via ACL LOAD, with no pod restart
A new ACLApplied condition on ValkeyNode reports when the change is live on the server
Because a Valkey user can hold several passwords at once, a credential rotation can be done with no auth gap: add the new password, wait for ACLApplied, move clients across, then drop the old one

Staged pod template rolls (#338)

the ValkeyCluster controller now owns the authorized pod template via ValkeyNode.spec.workloadRevision
Template changes that previously restarted every pod at once (including operator upgrades) now roll one node at a time, replicas first, with failover ahead of a primary
A new WorkloadRollPending condition marks a node waiting its turn

Exporter arguments (#345)

exporter.args passes command-line flags to the metrics sidecar
The connection settings the operator previously passed as flags are now environment variables, so anything you set in args takes precedence

Fixes

Cluster recovers from a simultaneous restart of every node (#333)

When all pods restarted at once and every IP changed, each node's persisted nodes.conf pointed at dead addresses with no surviving gossip path, and the cluster stayed Reconciling until someone ran CLUSTER MEET by hand
The operator now detects peers whose node ID belongs to a live member at a different address and re-MEETs them, emitting a StaleAddressesHealed event
This also covers the case where an operator upgrade itself restarts every pod

Dual-channel replication (#359)

The _replication system user was missing +sync
With dual-channel-replication-enabled yes, the RDB side channel issues a legacy SYNC, which failed with -NOPERM and left the replica retrying the handshake indefinitely

valkey_operator_build_info labels (#336)

Published images reported empty version and branch

Operator ACL (#341)

The _operator user is granted config|get so applied configuration can be read back and audited

Logging (#330)

"getting system users secret" dropped from info to debug

Known issues

ACLApplied does not signal permission-only changes (#369)

The condition compares the user set and password hashes, so adding or removing a user or password moves it through PendingPropagation back to True
A change to a user's enabled flag or permissions still takes effect on the server, but the condition does not report a transient state for it, so it is not a signal to wait on for those fields

What's Changed

fix: Set debug level for "getting system users secret" output by @nantiferov in #330
fix: set version/branch labels in valkey_operator_build_info metric by @bjosv in #336
test: add e2e test for operator permissions by @tkarger in #245
feat: Add zone scheduling axis by @jdheyburn in #340
feat(acl): allow config|get for auditability by @tkarger in #341
fixed e2e test failing on main branch as config get is allowed by operator users by @sandeepkunusoth in #351
fix: grant _replication user +sync for dual-channel replication by @itsyuvalcohen in #359
feat: Add args configuration support to exporter by @nantiferov in #345
refactor(api)!: move ValkeyCluster TLS under spec.networking by @daanvinken in #339
feat: stage pod template rolls via Spec.WorkloadRevision by @daanvinken in #338
fix: re-introduce cluster members whose addresses changed after a full restart by @matka12 in #333
chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #348
chore(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #350
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #349
chore(deps): bump docker/login-action from 4.2.0 to 4.6.0 by @dependabot[bot] in #346
chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #347
test(e2e): add shutdown-on-sigterm failover test by @Sagar2366 in #295
feat: apply ACL changes live without rolling pods by @melancholictheory in #319
feat: add scheduling.zone.pinning by @jdheyburn in #344
chore: Auto update and freeze pre-commit version by @nantiferov in #370

New Contributors

@nantiferov made their first contribution in #330
@itsyuvalcohen made their first contribution in #359

Full Changelog: v0.4.0...v0.5.0