Release release-0.27.3 · Altinity/clickhouse-operator

Added

Helm: scrape native ClickHouse Keeper Prometheus metrics when serviceMonitor.enabled is set, by @Slach in #2048. Closes #2038. Opt out with serviceMonitor.keeperMetrics.enabled: false. Keeper must expose a metrics port; clusters without Keeper are unaffected.

serviceMonitor:
  enabled: true
  keeperMetrics:
    enabled: true
    port: metrics

Protect the last healthy replica in a shard during an interrupted roll. Closes #1704. Replaces #1967. Unhealthy replicas in a shard are reconciled before healthy ones; a disruptive restart or image roll is deferred when it would take down the last healthy replica. Sibling shards keep converging — a deferred host no longer aborts the rest of the pass. The CHI still reports Aborted with event reason HostReconcileDeferredShardSafety until the deferred host can be rolled.

Image upgrades again exclude the host first (LB drain, remote_servers de-prioritisation, in-flight query drain). Closes #2055. That was a regression since 0.26.3.
Honor onLostVolume: no so the operator does not SYSTEM DROP REPLICA when a volume is lost. The setting existed but was ignored on the ForceDrop path.

reconcile:
  host:
    drop:
      replicas:
        onLostVolume: no

Retry transient Kubernetes API errors on CHI kube Get calls, by @aaron276h in #2025. Closes #2026. Bounded exponential backoff (5 attempts, ~7.5s) for connection refused/reset, timeouts, and apiserver 5xx — a brief control-plane blip no longer aborts a large reconcile. Terminal errors (NotFound, Forbidden, …) still fail immediately.
Fix informer delete handling for DeletedFinalStateUnknown tombstones, by @27rohan in #2039. Closes #1882. Missed-watch relist payloads no longer panic the operator; malformed delete events are logged instead.
Skip cluster/host reconcile hooks on unreachable hosts (e.g. a scale-up replica that has no pod yet, or a dying host that cannot serve SQL). Closes #2052. instead of failing the hook and blocking reconcile. Emits HookSkippedUnreachableHost. Reachability overrides failurePolicy: Fail. The hook still runs on hosts that can be reached.

Bumped dependencies to address CVEs in the operator and metrics-exporter images. An image scan flagged four CVEs; all are addressed by patch/minor bumps with no API or behavior changes:
- CVE-2026-39822 (HIGH) and CVE-2026-42505 (MEDIUM) — Go standard library. Fixed by building on Go 1.26.5 (go.mod 1.26.4 → 1.26.5).
- CVE-2026-46600 — golang.org/x/net bumped v0.55.0 → v0.56.0.
- CVE-2026-56852 — golang.org/x/text bumped v0.37.0 → v0.39.0.
Reachability note: govulncheck confirms the stdlib crypto/tls and x/text issues are reachable from operator/exporter code; the x/net and stdlib os issues are present-in-image but not reachable. All four are bumped for image hygiene regardless. The FIPS module (GOFIPS140=v1.0.0) is pinned independently of the Go toolchain and is unaffected.

Full Changelog: release-0.27.2...release-0.27.3