github.com/operator-framework/operator-sdk

v1.42.3

What's Changed

• updating generated files post 1.42.2 release by @acornett21 in #7072
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #7076
• Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 by @dependabot[bot] in #7083
• Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 by @dependabot[bot] in #7075
• Bump github.com/distribution/distribution/v3 from 3.0.0 to 3.1.0 by @dependabot[bot] in #7078
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #7082
• Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #7081
• Bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 by @dependabot[bot] in #7080
• Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 by @dependabot[bot] in #7086
• Bump github.com/distribution/distribution/v3 from 3.1.0 to 3.1.1 by @dependabot[bot] in #7092
• Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.19.0 by @dependabot[bot] in #7093
• Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @dependabot[bot] in #7094
• Bump github.com/containerd/containerd from 1.7.29 to 1.7.32 by @dependabot[bot] in #7099
• updating ansible operator plugin version to 1.42.3 and other dependen… by @acornett21 in #7106
• Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/helm-operator by @dependabot[bot] in #7098
• Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/operator-sdk by @dependabot[bot] in #7097
• Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/scorecard-test by @dependabot[bot] in #7096
• Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/custom-scorecard-tests by @dependabot[bot] in #7095
• Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @dependabot[bot] in #7105
• updating images to ubi 9.8 by @acornett21 in #7107
• Release v1.42.3 by @acornett21 in #7108

Full Changelog: v1.42.2...v1.42.3

What's Changed

• updating generated files post 1.42.1 release by @acornett21 in #7067
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #7069
• updating ansible operator plugin to 1.42.2 by @acornett21 in #7070
• Release v1.42.2 by @acornett21 in #7071

Full Changelog: v1.42.1...v1.42.2

What's Changed

• updating generated files post 1.42.0 release by @acornett21 in #7018
• Bump ubi9/ubi-minimal from 9.6 to 9.7 in /images/operator-sdk by @dependabot[bot] in #7016
• Bump ubi9/ubi-minimal from 9.6 to 9.7 in /images/scorecard-test by @dependabot[bot] in #7014
• Bump ubi9/ubi-minimal from 9.6 to 9.7 in /images/custom-scorecard-tests by @dependabot[bot] in #7013
• adding a readme for the gpg management process by @acornett21 in #7019
• Bump ubi9/ubi-minimal from 9.6 to 9.7 in /images/helm-operator by @dependabot[bot] in #7015
• updating unit test make cmd to add -race flag by @acornett21 in #7024
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #7027
• point kuttl docs to github repo, instead of defunct kuttl website by @acornett21 in #7030
• test: update copyright to 2026 by @PascalBourdier in #7053
• ci: use golangci-lint v2 by @PascalBourdier in #7029
• Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 by @dependabot[bot] in #7054
• refactor: follow go fix advice about any by @PascalBourdier in #7052
• Bump github.com/docker/cli from 28.4.0+incompatible to 29.2.0+incompatible by @dependabot[bot] in #7058
• Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #7059
• Bump docker/login-action from 3 to 4 by @dependabot[bot] in #7060
• Bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #7061
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #7062
• updating go and dependencies to address cve's by @acornett21 in #7064
• Fix typos in documentation by @oglok in #7034
• Avoid grace period delay by @little-engineer-2025 in #7033
• Prefer strings.SplitSeq over strings.Split where possible by @caxu-rh in #7051
• Release v1.42.1 by @acornett21 in #7066

New Contributors

• @oglok made their first contribution in #7034
• @little-engineer-2025 made their first contribution in #7033
• @caxu-rh made their first contribution in #7051

Full Changelog: v1.42.0...v1.42.1

What's Changed

• Bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 by @dependabot[bot] in #6970
• fix typo in filename kustomization.yaml by @trent-s in #6974
• Fix missing +/- prefixes in migration diff for v1.39.0.md by @sshine in #6975
• Bump github.com/docker/docker from 28.2.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in #6976
• Bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in #6986
• Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #6989
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #6980
• Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #6993
• use go version from builder image, instead of downloading in Dockerfile by @acornett21 in #6996
• updating go and various dependencies by @acornett21 in #6997
• Bump actions/setup-go from 5 to 6 by @dependabot[bot] in #6998
• update observability docs to align with prometheus's docs by @acornett21 in #7000
• add support to scaffold oci helm registry charts by @acornett21 in #6999
• updating ansible plugin to v1.40.0 and corresponding dependencies by @acornett21 in #7001
• Bump github.com/containerd/containerd from 1.7.28 to 1.7.29 by @dependabot[bot] in #7008
• updating ansible plugin to v1.42.0 and corresponding dependencies by @acornett21 in #7010
• Release v1.42.0 by @acornett21 in #7011
• update signing keys by @joelanford in #7017

New Contributors

• @sshine made their first contribution in #6975

Full Changelog: v1.41.0...v1.42.0

What's Changed

• Bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 by @dependabot in #6970

v1.41.0

Additions

• For Go-based operators, add new target to setup/teardown Kind cluster for E2E tests and remove Kind setup from CI workflows. (#6954)

Changes

• For Go-based operators, upgrade the Go version from 1.23 to 1.24. (#6954)
• For Go-based operators, upgrade golangci-lint to v2.1.0 and update .golangci.yml to the v2 config format with enhanced structure and controls. (#6954)
• For Go-based operators, upgrade controller-gen from v0.17.2 to v0.18.0. (#6954)
• For Go-based operators, upgrade controller-runtime from v0.20.4 to v0.21.0 and kubernetes dependencies to v0.33. (#6954)
• This version upgrades the scaffold used as based from kuebbuilder 4.5.2 to 4.6.0. To check further details see kubebuilders v4.6.0 release notes

v1.40.0

Additions

• (go/v4) For Go-based operators, a devcontainer is now available to allow users to develop and test the operator in a local environment and leverage on solutions such as VS Code Remote Containers and GitHub Codespaces to have a consistent development environment. (#6928)
• (go/v4) For Go-based operators, new GitHub Actions are available to ensure better quality of their code. (#6928)
• (go/v4) For Go-based operators, controllers now use .Named("<Kind>") in SetupWithManager to prevent naming conflicts in multi-group projects. (More info). (#6928)
• (go/v4) For Go-based operators, a new Makefile target named lint-config has been added to verify that your .golangci.yaml configuration file is valid. This helps catch issues early when customizing lint rules.
  (More info). (#6928)
• For ALL-based operators, scaffolded resources now include the app.kubernetes.io/name label to support Kubernetes best practices for app identification. (More info). (#6928)
• For ALL-based operators, new role manifests are now scaffolded under the config/rbac/ directory to assist cluster administrators. For each API defined in the project, three role files are generated: <kind>_admin_role.yaml, <kind>_editor_role.yaml, and <kind>_viewer_role.yaml.
  These roles are not applied by default. Instead, they are provided as helpers, allowing cluster administrators to customize and apply appropriate permissions as needed.
  The primary motivation for scaffolding these roles is to simplify integration with Kubernetes' aggregated roles mechanism. By including annotations such as rbac.authorization.k8s.io/aggregate-to-admin: "true", rbac.authorization.k8s.io/aggregate-to-edit: "true", and rbac.authorization.k8s.io/aggregate-to-view: "true", these role definitions can automatically contribute permissions to the default admin, edit, and view roles in a cluster when applied.
  For more information on Kubernetes RBAC and aggregated roles, see: https://kubernetes.io/docs/reference/access-authn-authz/rbac/. (#6928)
• For ALL-based operators, new role manifests are now scaffolded under the config/rbac/ directory to assist cluster administrators. For each API defined in the project, three role files are generated: <kind>_admin_role.yaml, <kind>_editor_role.yaml, and <kind>_viewer_role.yaml.
  These roles are not applied by default. Instead, they are provided as helpers, allowing cluster administrators to customize and apply appropriate permissions as needed.
  The primary motivation for scaffolding these roles is to simplify integration with Kubernetes' aggregated roles mechanism. By including annotations such as rbac.authorization.k8s.io/aggregate-to-admin: "true", rbac.authorization.k8s.io/aggregate-to-edit: "true", and rbac.authorization.k8s.io/aggregate-to-view: "true", these role definitions can automatically contribute permissions to the default admin, edit, and view roles in a cluster when applied.
  For more information on Kubernetes RBAC and aggregated roles, see: https://kubernetes.io/docs/reference/access-authn-authz/rbac/. (#6928)

Changes

• The bundle build target now respects the CONTAINER_TOOL variable, allowing users to use alternative container tools like podman instead of docker. (#6932)
• For All-based Operators, upgrade OPM to version from v1.23.0 to v1.55.0, which includes several bug fixes and improvements. For further information, see: https://github.com/operator-framework/operator-registry/releases. (#6953)
• (go/v4) For Go-based Operators, the main.go file has been enhanced to support real TLS certificates for both webhooks and the metrics server, with automated certificate rotation via cert-manager. This change improves security and aligns with production-grade best practices.
  Previously, setups relied on kube-rbac-proxy (deprecated in Operator SDK and Kubebuilder, see: kubebuilder/discussions/3907), which generated TLS certificates dynamically — a method no longer recommended for secure environments. The updated approach adopts static certificates managed by cert-manager.
  Additionally, integrations with Prometheus now support scraping metrics using the cert-manager generated certificates. A related fix was introduced to ensure that CA injection patches are only applied to CRDs with a conversion webhook, avoiding unnecessary annotations.
  To support these improvements, changes to config/default/kustomization.yaml are required. These include: configuring webhook and metrics server certificates, enabling Prometheus scraping with TLS, and correcting CA injection behavior.
  These updates also introduce flexible opt-in mechanisms, allowing users to selectively enable or disable: - TLS for the metrics server via cert-manager - TLS for webhooks via cert-manager - TLS configuration for Prometheus scraping
  Together, these changes are part of a broader effort to elevate the default security posture and configurability of Go-based operators. (#6928)
• (go/v4) For Go-based operators, a fix has been implemented to ensure that the Prometheus configuration can properly scrape metrics from the operator's metrics server when TLS is enabled. (#6928)
• (go/v4) For Go-based operators, a fix has been implemented to ensure that CA injection patches are applied only to CRDs that define a conversion webhook.
  Previously, the CA injection patch logic was overly broad — applying injection annotations to all CRDs whenever a webhook was scaffolded with the --conversion flag. This behavior was introduced in Kubebuilder release v3.5.0 when replacements were introduced in place of legacy vars and the kustomize/v2-alpha plugin was adopted.
  The incorrect behavior likely went unnoticed due to incomplete support for conversion webhooks in earlier versions. This release addresses that gap, enabling proper scaffolding and CA injection behavior specifically for CRDs with conversion webhooks.
  To support this improvement, a new marker has been introduced: +kubebuilder:scaffold:crdkustomizecainjectionns. This marker ensures that the correct replacements are generated in config/default/kustomization.yaml for CA injection. Additionally, the kubebuilder:scaffold:crdkustomizewebhookpatch marker was created to ensure that the webhook patch is only applied to CRDs that have a conversion webhook in the config/crd/kustomization.yaml file.
  For more information on this and other scaffolding markers, refer to the official Kubebuilder documentation: https://book.kubebuilder.io/reference/markers/scaffold. (#6928)
• (go/v4) For Go-based operators, ENVTEST version management is now automated by deriving values from go.mod, and controller tests now locate binaries dynamically. (More info)
  These updates improve the developer experience by: - Reducing manual configuration for ENVTEST. - Ensuring IDEs or test runners can locate the binaries reliably. - Making controller test scaffolding more robust and portable. (#6928)
• (go/v4) For Go-based operators, updated GolangCI-Lint configuration to replace the deprecated exportloopref linter with the copyloopvar linter. (#6928)
• (go/v4) For Go-based operators, upgraded project scaffolding to Go 1.23, Kubernetes v0.32.1, and controller-runtime v0.20.4.
  The default project scaffolding for Go-based operators has been updated to use:
  • Go 1.23
  • Kubernetes modules v0.32.1
  • controller-runtime v0.20.4
  • Ginkgo v2.22.0 and Gomega v1.36.1. (#6928)
• Breaking change: (go/v4) For Go-based operators, upgraded controller-runtime from v0.19.4 to v0.20.0 and added support for Kubernetes 1.32. Removed deprecated webhook.Validator and webhook.Defaulter interfaces from the runtime. Webhooks should no longer reside under the api/ directory—this has been the default behavior since Kubebuilder rlease [v4.3.0)(https://github.com/kubernetes-sigs/kubebuilder/releases/tag/v4.3.0).
  A --legacy=true flag was added to support scaffolding webhooks in the old layout when needed. (More info · Migration guide). (#6928)

What's Changed

• fix: primary-resouce is created in wrong place. by @holyspectral in #6872
• docs: Replace memcached-operator in v1.39.0 update instructions by @blu3r4y in #6898
• Fix Allow IfNotPresent policy when operator-sdk run bundle #6795 by @kaovilai in #6851
• Bump github.com/containerd/containerd from 1.7.23 to 1.7.27 by @dependabot in #6916
• updating dependencies to address CVE's by @acornett21 in #6917
• Bump github.com/distribution/distribution/v3 from 3.0.0-rc.1 to 3.0.0-rc.3 by @dependabot in #6918
• adding logic to GHA's to remove unused diskspace by @acornett21 in #6920
• Release v1.39.2 by @acornett21 in #6919

New Contributors

• @blu3r4y made their first contribution in #6898
• @kaovilai made their first contribution in #6851

Full Changelog: v1.39.1...v1.39.2

v1.39.1

What's Changed

• re-generate scaffolding post release by @acornett21 in #6893
• fix constant reconcilation issue in helm controller by @acornett21 in #6892
• fix constant reconcilation issue in helm controller by @acornett21 in #6895
• Release v1.39.1 by @acornett21 in #6896

Full Changelog: v1.39.0...v1.39.1

v1.39.0

Changes

• For Go-based, Helm-based and Ansible-based operators this release moves to Kubernetes 1.31 API's and Kubebuilder v4 Scaffolding, specifically utilizing the v4.2.0 version. The update to Kubebuiler results in some scaffolding changes which more information can be found below: - Add support to protect project with network policies (#3853). (#6878)