chore(deps): pin dependencies #16
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/kubernetes-dependencies"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
294b6832026.8.x→2026.8.49962c171.20.4→v1.21.20.29.x→0.29.11.34.1→1.37.1fd7dc98v1.13.8→v1.13.104b3d947ac252db17.1.7→17.3.10.4.10→0.8.28b7a25c5.2.1→5.3.00.7.0→0.9.0e089f10→085e372v1.162.0→v1.163.00d52fff2ebeaa3840f3186a669316.x.x→6.1.01.x→1.13.044.141.0→44.164.70.95.x→0.95.2Release Notes
cert-manager/cert-manager (cert-manager)
v1.21.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.
All users should upgrade.
Changes by Kind
Bug or Regression
replacesfield was being populated for the wrong issuer on issuer changes (#9236, @hjoshi123)spec.vault.servercould be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @FelixPhipps)Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @FelixPhipps)vaultissuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespacedIssuer, unless ambient credentials are explicitly enabled via--issuer-ambient-credentials.ClusterIssuerand explicitserviceAccountRef(IRSA) configurations are unaffected. (#9231, @FelixPhipps)Other (Cleanup or Flake)
google.golang.org/grpcto v1.83.2 to fix reported security vulnerabilities (#9255, #9317)golang.org/x/cryptoto v0.56.0 to fix reported security vulnerabilities (#9265)v1.21.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.21.1 fixes a controller panic for Certificates with
spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck atReady=False(InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.All users should upgrade.
Changes by Kind
Bug or Regression
gatewayAPI.enabledinstead of the invalidgatewayAPI.enable. (#9012, @mateenali66)Other (Cleanup or Flake)
golang.org/x/textto v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)google.golang.org/grpcto v1.82.1 to fix a reported security vulnerability (#9063)github.com/google/cel-goto v0.29.0 to fix a reported security vulnerability (#9072)go.opentelemetry.io/otelto v1.44.0 to fix a reported security vulnerability (#9073)v1.21.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.
Known Issues
renewal.policy: Disabled: the new Certificate renewal policies feature (#8258) causes a nil pointer dereference panic in the trigger controller whenever a Certificate'sspec.renewal.policyis set toDisabled—pki.RenewalTime()returns(nil, nil)for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. Workaround: do not setrenewal.policy: Disabledon any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See #9031 for details.filteredEventHandlertype assertion failures ("OnAdd missing Object","OnUpdate missing ObjectOld","OnDelete missing Object") for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. This is cosmetic only — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See #8994 for details.Ready: False, Reason: InvalidSolverand never self-correct: new eager validation of ACME solver Secrets (#8255) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly reportReady: False, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. Workaround: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See #9036 for details and a fix proposal.Major Themes
Default
tokenrequestRBAC removed from Helm chartThe Helm chart no longer creates a default
RoleandRoleBindinggranting the cert-manager controller permission to create tokens for its own ServiceAccount (serviceaccounts/token: create). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.If you use
serviceAccountRef.namepointing at the controller ServiceAccount, you must now either create your ownRole/RoleBindinggrantingserviceaccounts/token: create, or migrate to a dedicated ServiceAccount (recommended — see the Vault or Route53 documentation).Restrict Challenge and Order RBAC in
cert-manager-editClusterRoleThe
cert-manager-editaggregate ClusterRole no longer grantscreateforchallenges.acme.cert-manager.ioorcreate,patch,updatefororders.acme.cert-manager.io(GHSA-8rvj-mm4h-c258). These resources are internal to cert-manager's ACME workflow. Challengepatchandupdateare retained because users may need them to remove stuck finalizers.This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.
Metrics port name and path Helm values removed
The Helm values
prometheus.servicemonitor.targetPort,prometheus.servicemonitor.path, andprometheus.podmonitor.pathhave been removed. The controller Service metrics port has been renamed fromtcp-prometheus-servicemonitortohttp-metrics. Because the Helm values schema usesadditionalProperties: false, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. (#8952)ACME and Certificate Management
ACMEUseARIfeature gate. When enabled, cert-manager queries the ACME server'srenewalInfoendpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. (#8798)waitInsteadOfSelfChecksolver option: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See configuration details. (#8858)renewalPoliciesfield on the Certificate API provides more expressive control over renewal scheduling, complementingrenewBeforeandrenewBeforePercentage. (#8258)--certificate-request-maximum-backoff-durationflag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. (#8893)Gateway API and cainjector
acme.cert-manager.io/http01-parentreffallback: "true"annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. (#8749)cert-manager.io/ignore-tls-listenersannotation: exclude specific Gateway TLS listeners from certificate management. (#8727)enableGatewayAPIconfiguration restructure:enableGatewayAPIandenableGatewayAPIListenerSetare deprecated in favor ofgatewayAPI.enabled/gatewayAPI.enableListenerSet. The old fields continue to work. (#8732)CAInjectorMergingpromoted to GA: unconditionally enabled; will be removed in a future release. (#8583)ServerSideApplyfeature gate is deprecated. (#8692)--ignore-namespacesflag: skip specified namespaces when watching Secrets for injection. (#8614)Deployment and Observability
AuthFailedIssuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. (#8808, #8779)runtimeClassNamesupport: configurable for cert-manager components and ACME HTTP01 solver pods. (#8791, #8976)startupapicheck.ttlSecondsAfterFinished: opt-in automatic cleanup of the startupapicheck Job. (#8523)--acme-http01-solver-extra-labels: propagateglobal.commonLabelsto dynamically-created ACME HTTP01 solver resources. (#8761)Notable Bug Fixes
renewBeforePercentage: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. (#8947)..path segments, preventingpath.Joinfrom silently resolving relative segments. (#8930)Community
As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.
A special thanks to:
for their contributions, comments and support!
Also, thanks to the cert-manager maintainer team for their help in this release:
And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:
Changes since v1.20.0
Feature
AuthFailedIssuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)certificateRequestMaximumBackoffDurationcontroller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file,--certificate-request-maximum-backoff-durationCLI flag, or Helm valueconfig.certificateRequestMaximumBackoffDuration. Defaults to 32 hours for backward compatibility. (#8893, @lunarwhite)waitInsteadOfSelfCheckfield to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#8858, @wallrj)runtimeClassNamesupport for cert-manager components and ACME HTTP01 solver pods. (#8791, @jsoref)runtimeClassNamesupport for ACME HTTP01 solver pods via theacmesolver.runtimeClassNameHelm value. (#8976, @erikgb)--acme-http01-solver-extra-labels, allowing Helm'sglobal.commonLabelsto propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)startupapicheck.ttlSecondsAfterFinishedHelm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)cert-manager.io/ignore-tls-listenersannotation for ignoring gwapi listeners. (#8727, @hjoshi123)--ignore-namespaceswas added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#8614, @figaw)cert-manager.io/alt-names,cert-manager.io/ip-sansto Certificates generated from ingress like objects in cert-shim controllers. (#8927, @jabbrwcky)acme.cert-manager.io/http01-parentreffallback: "true"causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#8749, @apkatsikas)Bug or Regression
RoleandRoleBindinggranting the cert-manager controller ServiceAccount permission to create tokens for itself (serviceaccounts/token: create). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely onserviceAccountRef.namepointing at the controller ServiceAccount (an undocumented pattern), you must now create your ownRoleandRoleBindinggrantingserviceaccounts/token: createon that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#8931, @wallrj-cyberark)renewBeforePercentagecalculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#8947, @ThatsMrTalbot)parentRefbug when both issuer config and annotations are present. (#8619, @hjoshi123)e2e-setup-samplewebhookinstallation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)webhook.configandwebhook.volumesare defined. (#8664, @jnohlgard)createand Ordercreate/patch/updatefrom the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). (#8958, @wallrj-cyberark)..path segments inspec.vault.pathand auth mount path fields, preventingpath.Joinfrom silently resolving relative segments before constructing the Vault API request. (#8930, @wallrj-cyberark)Other (Cleanup or Flake)
prometheus.servicemonitor.targetPort,prometheus.servicemonitor.path, andprometheus.podmonitor.path. The metrics path is always/metricsand the target port is alwayshttp-metrics. Rename the controller service metrics port fromtcp-prometheus-servicemonitortohttp-metricsfor consistency with other workloads. Users must remove these keys from their value overrides before upgrading. (#8952, @erikgb)enableGatewayAPIandenableGatewayAPIListenerSetfields onControllerConfigurationare deprecated and moved into thegatewayAPIsub-struct asgatewayAPI.enabledandgatewayAPI.enableListenerSet. The old fields continue to work. (#8732, @ThatsMrTalbot)livekit/livekit (docker.io/livekit/livekit-server)
v1.13.10Compare Source
Changed
Fixed
v1.13.9Compare Source
Please note that release v1.13.8 introduced a behaviour change that caused egress start failures explained in #4955. This release restores the behaviour to what it was in v1.13.7 and before.
Changed
Fixed
forgejo-helm/forgejo-helm (forgejo)
v17.3.1: 17.3.1Compare Source
Bug Fixes
Continuous Integration
Miscellaneous Chores
v17.3.0: 17.3.0Compare Source
Features
Bug Fixes
Continuous Integration
Miscellaneous Chores
v17.2.0: 17.2.0Compare Source
Features
Continuous Integration
Miscellaneous Chores
rajsinghtech/garage-operator (garage-operator)
v0.8.2Compare Source
Bug Fixes
Documentation
Miscellaneous
bda439f(#489) in #489 by @renovate[bot]162be52(#480) in #480 by @renovate[bot]1e93e00(#473) in #473 by @renovate[bot]Release
Testing
Upgrade notes
status.blockErrorsandstatus.resyncQueueLength. Re-applying CRDs is optional. The built-in Garage image is still v2.4.1.status.blockErrorsandstatus.resyncQueueLengthnow read0when Garage was observed with no errors or an empty queue, and are left out when Garage could not be observed (#477). Go API consumers: both fields are now pointers in v1beta1 and v1beta2.OperatorAdminTokenReadycondition (#476). When it is False, its message names the Pod or GarageNode that is blocking GarageKey/GarageBucket reconciliation.garage.rajsingh.info/node-local-pool-membership-stagingannotation and a node affinity that admits both the old and new activation tokens (#479). This is internal: don't strip it with GitOps or drift tooling. It is removed when the hand-off finishes.Contributors
Thanks to @florissmit10 for #476 and #477, and for reporting #471 and #474, and to @rajsinghtech and @renovate[bot] for everything else in this release.
Full Changelog: https://github.com/rajsinghtech/garage-operator/compare/v0.8.1...v0.8.2
v0.8.1Compare Source
Bug Fixes
Documentation
Release
Upgrade notes
networking.k8s.io/ingresseswrite access and always watched Ingresses on every install. From v0.8.1 this is controlled by the chart valueingress.enabled(defaultfalse, likegatewayAPI.enabled), which renders the--enable-ingressflag (ENABLE_INGRESSenv var for non-Helm installs), the Ingress RBAC rules (ClusterRole and namespace-scoped Roles) and the Ingress watch.spec.websiteExposure.ingress, setingress.enabled=true(for example--set ingress.enabled=true). With--reuse-valuesfrom v0.8.0 the new value is absent and renders as disabled, so pass it explicitly. Without it the bucket reportsWebsiteExposed=Falsewith reasonIngressDisabled; Ingresses already created by v0.8.0 stay in place and keep serving (and are still garbage-collected with their bucket) but are not reconciled or cleaned up until you enable it. Installs that do not use Ingress exposure need no change and now run without any Ingress RBAC.Contributors
Thanks to @Faustvii for reporting #460.
Full Changelog: https://github.com/rajsinghtech/garage-operator/compare/v0.8.0...v0.8.1
v0.8.0Compare Source
Bug Fixes
11ed52e(#455) in #455 by @renovate[bot]Documentation
Features
Miscellaneous
e0174e5(#447) in #447 by @renovate[bot]Release
Testing
Upgrade notes
spec.discovery.websiteExposure, theBucket IDcolumn,volumeAttributesClassName, the pod extras fields andlayoutManagement.siteRole/status.layoutWriter(v1beta1 and v1beta2 both carry them).volumeAttributesClassNameneeds a CSI driver and cluster with VolumeAttributesClass support. Pod extras andsiteRoleare no-ops until set.networking.k8s.io/ingressesandgateway.networking.k8s.io/httproutes. Namespace-scoped installs get these in the namespace Role.websiteExposure. A cross-namespace exposure resource has no owner reference and would be orphaned if its bucket is deleted by an older operator; delete it manually in that case.New Contributors
Thanks also to @florissmit10 for #431 and to everyone who reported issues.
Full Changelog: https://github.com/rajsinghtech/garage-operator/compare/v0.7.12...v0.8.0
v0.7.12Compare Source
Bug Fixes
Release
v0.7.11Compare Source
Bug Fixes
Features
Miscellaneous
3680233(#419) in #419 by @renovate[bot]1cfcdb1(#418) in #418 by @renovate[bot]03fd17c(#417) in #417 by @renovate[bot]a9a9552(#416) in #416 by @renovate[bot]303a32d(#413) in #413 by @renovate[bot]0b35c9e(#411) in #411 by @renovate[bot]2293b36(#409) in #409 by @renovate[bot]Testing
Release
v0.7.10Compare Source
Bug Fixes
Features
Miscellaneous
f44f6e8(#403) in #403 by @renovate[bot]Release
v0.7.9Compare Source
Bug Fixes
Miscellaneous
512690a(#380) in #380 by @renovate[bot]Testing
Release
v0.7.8Compare Source
Bug Fixes
Features
Miscellaneous
WIP
Release
v0.7.7Compare Source
Bug Fixes
Miscellaneous
7543a96(#363) in #363 by @renovate[bot]4013ae0(#357) in #357 by @renovate[bot]0ecdc2a(#350) in #350 by @renovate[bot]Refactoring
Testing
WIP
Release
v0.7.6Compare Source
Bug Fixes
Documentation
Features
Miscellaneous
1c2c046(#344) in #344 by @renovate[bot]45a5f7a(#340) in #340 by @renovate[bot]37fe631(#338) in #338 by @renovate[bot]0d1d3a7(#332) in #332 by @renovate[bot]Testing
Release
v0.7.5Compare Source
Bug Fixes
Documentation
Features
Miscellaneous
2632668(#323) in #323 by @renovate[bot]5822931(#320) in #320 by @renovate[bot]Release
v0.7.4Compare Source
Bug Fixes
Miscellaneous
Testing
Release
v0.7.3Compare Source
What's new in v0.7
Before upgrading
Thanks to @florissmit10 for the original DaemonSet prototype and use case that the node-local pool design builds on.
Full changelog: https://github.com/rajsinghtech/garage-operator/compare/v0.6.29...v0.7.3
v0.7.2Compare Source
v0.7.1Compare Source
v0.7.0Compare Source
v0.6.29Compare Source
Bug Fixes
Miscellaneous
Release
v0.6.28Compare Source
Bug Fixes
Release
v0.6.27Compare Source
Bug Fixes
Miscellaneous
Release
v0.6.26Bug Fixes
v0.6.21Compare Source
Bug Fixes
Release
v0.6.20Compare Source
Features
Release
v0.6.19Compare Source
Bug Fixes
Features
Miscellaneous
Release
v0.6.18Compare Source
Bug Fixes
Miscellaneous
v0.6.17Compare Source
Bug Fixes
v0.6.16Compare Source
Bug Fixes
v0.6.15Compare Source
Bug Fixes
Features
Miscellaneous
v0.6.14Compare Source
Bug Fixes
Miscellaneous
v0.6.13Compare Source
Bug Fixes
Miscellaneous
v0.6.12Compare Source
Bug Fixes
Miscellaneous
v0.6.11Compare Source
Bug Fixes
v0.6.10Compare Source
Gateway readiness probe passthrough
A small, additive operator change.
Added
spec.gateway.readinessProbe(*corev1.Probe) — override the gateway tier's readiness probe. Use it to supply a custom serving-aware gate, e.g. an exec probe that keeps a gateway in service as long as it can reach a read quorum. When unset, behavior is unchanged.Why the default is a bind-only TCP check (and not admin
/health)A serving-aware
/healthreadiness probe was prototyped and deliberately not made the default./healthis a cluster-wide consistent write-quorum signal: atreplication.factor=2, losing a single storage node drops every partition below write-quorum, so/healthreturns 503 on every node (likewise during federation bootstrap before remote peers join). Behind apublishNotReadyAddresses: falseService (e.g. a Tailscale anycast), that would mark all gateways NotReady and withdraw the whole anycast — taking down reads too, even thoughread_quorum=1means reads still work. So gateway readiness stays bind-only TCP (gateways keep serving reads), and the serving/quorum signal belongs in monitoring, not readiness. The passthrough is for operators who have a genuine read-capability gate.Upgrade notes
v1beta1(gateway-as-bool) is unaffected.v0.6.9Compare Source
Federation signal & cross-region reachability
Two fixes found while analyzing a healthy federated cluster's
PeerUnreachablecondition. Both are signal-quality / reachability improvements — neither was an availability issue.Bug fix —
PeerUnreachableno longer cries wolfThe condition flagged dead roleless identities — node IDs Garage still remembers but that hold no layout role (e.g. a gateway whose metadata PVC was recreated, leaving its old identity in the peer list). For those the "ConnectClusterNodes will recover it" remediation is impossible (the node is gone), so the alarm was permanently noisy and buried the genuinely-actionable case.
PeerUnreachablenow flags only peers that hold a current-layout role or are draining — so a real missing member (roled cross-region gateway, or a stuck drain) still trips it, while discarded identities are ignored.Hardening — per-pod gateway
rpc_public_addrfor cross-region reachabilityA multi-pod gateway tier with a single
gateway.rpcPublicAddrmade every pod advertise the same hostname, so remote regions could reach only one of them (the rest showed "never seen"). The gateway tier now substitutes an{ordinal}placeholder per pod (symmetric withremoteClusters[].gatewayRpcEndpointTemplate); an address without the placeholder is used verbatim. A webhook warning fires when a unified multi-pod gateway tier sets a sharedrpc_public_addrwith no{ordinal}.Upgrade notes
PeerUnreachablecleanup takes effect immediately.{ordinal}gateway support ships dormant: it changes nothing untilspec.gateway.rpcPublicAddruses the placeholder (which, on an existing tier, triggers a gateway config update + rolling restart). Adopt it when you want per-pod cross-region gateway peering.v0.6.8Compare Source
Federation gateway-tag fix
A focused follow-up to v0.6.7's gateway-outage work, closing the last federation edge case found during production gateway testing.
Bug fix
tier:gateway. If such an imported gateway role later orphaned (e.g. a gateway lost its identity), the tombstone reaper — which finds gateway roles by theirtier:gatewaytag — couldn't see it, so the dead role stuck in the layout. Imported nodes now carry the propertier:gateway/tier:storagetags (the remote-name tag is retained for stale-node cleanup).Hardening
capacity:nullrole with no live or operator-claimed owner is reaped even if a re-import stripped its tier tag — but only after it has been continuously down past the same dwellPeerUnreachableuses, so a transient blip or briefly-down federated peer is never reaped on a single snapshot."default"fallback), so a cluster with an unsetspec.zonecorrectly recognizes a remote configuredzone: "default"as itself and never pulls its roles into the local zone.Notes
layoutManagement.autoApply: trueis safe on v0.6.7+ (zone-scoped reaper) and this release further hardens the reaper against over-reaping imported roles.v0.6.7Compare Source
Bug fixes
key_tableunsynced and S3 auth failing with403.garage-gateway-prefix andAtois the pod suffix, so per-ordinal dialing works for arbitrarily named gateway nodes.Hardening (v0.6.7 backlog, #219)
spec.keyPermissionsinstead of leaving them dangling.replication.factoris now refused with aStorageScaleDownBlockedcondition rather than orphaning the layout role.503responses are classified and fast-requeued instead of treated as terminal errors.maxUnavailable=1).GatewayLayoutDegradedcondition surfaces operator-owned gateway nodes that are missing from the layout.Docs
Upgrade notes
layoutManagement.autoApply: falseto work around the cross-region churn (#220), you can re-enable it once all regions are on v0.6.7 — the reaper no longer fights across regions.v0.6.6Compare Source
Highlights
Gateway-tier unification, a safe path to change the replication factor, and a round of availability hardening.
Features
GarageNodes — symmetric with storage. Each is a single-replica StatefulSet with a persistent metadata PVC (stable identity) and acapacity: nillayout role, so S3 key/bucket auth resolves locally instead of needing a quorum RPC to the storage tier. This release also adds race-safe layout apply and a richer cluster-health status surface.purge-cluster-layoutannotation drives a resumable state machine to changereplication.factor— the only safe way to do it, since the factor is fixed at layout creation upstream. It refuses federated clusters, requires at least N storage nodes, and tears down cleanly on abort (never leaves storage scaled to zero).status.unreachablePeers, so a sustained-down node is visible without reading Garage internals.Bug fixes & hardening
pods/execRBAC.Testing / CI
v0.6.5Compare Source
Bug Fixes
v0.6.4Compare Source
Bug Fixes
Miscellaneous
v0.6.3Compare Source
Bug Fixes
v0.6.2Compare Source
Bug Fixes
v0.6.1Compare Source
Bug Fixes
v0.6.0Compare Source
Features
Refactoring
v0.5.11Compare Source
Bug Fixes
v0.5.10Compare Source
Bug Fixes
Documentation
v0.5.9Compare Source
Bug Fixes
v0.5.8Compare Source
Bug Fixes
v0.5.7Compare Source
Refactoring
v0.5.6Compare Source
Refactoring
v0.5.5Compare Source
Bug Fixes
Documentation
Testing
v0.5.4Compare Source
Bug Fixes
v0.5.3Compare Source
Bug Fixes
v0.5.2Compare Source
Bug Fixes
v0.5.1Compare Source
Bug Fixes
v0.5.0Compare Source
Bug Fixes
Features
Miscellaneous
bjw-s-labs/helm-charts (ghcr.io/bjw-s-labs/helm/app-template)
v5.3.0Changelog:
Changed
element-hq/synapse (ghcr.io/element-hq/synapse)
v1.163.0Compare Source
Changelog: https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md
renovatebot/renovate (renovate/renovate)
v44.164.7Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.6Compare Source
Build System
v44.164.5Compare Source
Bug Fixes
constraintscorrectly when applyingpostUpgradeTasks(#47069) (08cb221), closes #47068 #43633v44.164.4Compare Source
Bug Fixes
v44.164.3Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.1Compare Source
Bug Fixes
x-access-tokenfor personal access tokens in clone URLs (#47073) (6cc8898)v44.164.0Compare Source
Features
go-importmodproxy (#47044) (0876273)v44.163.0Compare Source
Features
v44.162.0Compare Source
Features
gohost rules forgo-proxyrequests (#47043) (1dce2f8)v44.161.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.161.1Compare Source
Bug Fixes
v44.161.0Compare Source
Features
Miscellaneous Chores
v44.160.1Compare Source
Miscellaneous Chores
Build System
v44.160.0Compare Source
Features
v44.159.0Compare Source
Features
v44.158.3Compare Source
Bug Fixes
v44.158.2Compare Source
Miscellaneous Chores
Tests
gh actions-lockvia Renovate (#46987) (fc4719b)Build System
v44.158.1Compare Source
Miscellaneous Chores
Build System
v44.158.0Compare Source
Features
v44.157.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.157.0Compare Source
Features
Tests
Build System
v44.156.3Compare Source
Bug Fixes
gohost rule credentials as private (#47031) (28ed2ee)v44.156.2Compare Source
Bug Fixes
modecan be used (#46697) (9ccdc69), closes #43020Tests
v44.156.1Compare Source
Bug Fixes
v44.156.0Compare Source
Features
Miscellaneous Chores
v44.155.9Compare Source
Bug Fixes
v44.155.8Compare Source
Build System
v44.155.7Compare Source
Miscellaneous Chores
Build System
v44.155.6Compare Source
Bug Fixes
v44.155.5Compare Source
Bug Fixes
v44.155.4Compare Source
Build System
v44.155.3Compare Source
Bug Fixes
Documentation
v44.155.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.155.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.155.0Compare Source
Features
v44.154.1Compare Source
Bug Fixes
renovate-image(#46970) (bbe08af), closes #46969v44.154.0Compare Source
Features
Bug Fixes
hostRulesandinternalHostAccesswhen resolvingglobalExtends(#46666) (cf46a67)v44.153.1Compare Source
Bug Fixes
v44.153.0Compare Source
Features
v44.152.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
enabledandmanagerFilePatterns(#46683) (2a300e8), closes #43020Tests
v44.151.5Compare Source
Bug Fixes
Code Refactoring
scopes(#46675) (92ef4c7), closes #43020v44.151.4Compare Source
Bug Fixes
additionalPropertiesfor maps of values (#46681) (df8fe3d)v44.151.3Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v44.151.2Compare Source
Bug Fixes
Build System
v44.151.1Compare Source
Bug Fixes
Documentation
b9767f5(main) (#46927) (f9f131c)v44.151.0Compare Source
Features
Miscellaneous Chores
v44.150.1Compare Source
Bug Fixes
v44.150.0Compare Source
Features
Miscellaneous Chores
v44.149.3Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v44.149.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.149.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.149.0Compare Source
Features
Documentation
v44.148.6Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v44.148.5Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.4Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.3Compare Source
Bug Fixes
v44.148.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.1Compare Source
Miscellaneous Chores
Build System
v44.148.0Compare Source
Features
Miscellaneous Chores
v44.147.0Compare Source
Features
v44.146.3Compare Source
Bug Fixes
Miscellaneous Chores
Code Refactoring
buildSchemafunction (#46679) (c72bd25)Tests
v44.146.2Compare Source
Bug Fixes
v44.146.1Compare Source
Bug Fixes
v44.146.0Compare Source
Features
Miscellaneous Chores
v44.145.3Compare Source
Bug Fixes
v44.145.2Compare Source
Miscellaneous Chores
Build System
v44.145.1Compare Source
Bug Fixes
v44.145.0Compare Source
Features
Miscellaneous Chores
v44.144.1Compare Source
Bug Fixes
v44.144.0Compare Source
Features
Bug Fixes
Code Refactoring
indexMarkdownfunction (#46693) (baea689)Tests
Build System
v44.143.0Compare Source
Features
slsa-framework/actions/*'withs (#46792) (4ca515b)Bug Fixes
java-maventool (#46587) (4a0935d), closes #41849Miscellaneous Chores
Code Refactoring
Build System
v44.142.1Compare Source
Bug Fixes
depNamewhen it matches repo name (#46789) (9284b7e), closes #46787Code Refactoring
v44.142.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
f5438ed200tofe4febd003fe4febd003tod2d0904693d2d0904693to19d3c90ed519d3c90ed5to4178509cf74178509cf7toc4d0995cebc4d0995cebtoa50df43d9da50df43d9dto1f436bc4731f436bc473to78e5f42165chore(deps): update kubernetes dependenciesto chore(deps): pin dependencies78e5f42165to872894ba4bView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.