v0.7.6

Changes

IAM access apps were missing

• DynamoDB grants now cover the table's secondary indexes (<table>/index/*), so querying or scanning an index is no longer denied. Transactions are granted too: TransactGetItems with any access, TransactWriteItems and ConditionCheckItem with ReadWrite.
• S3 ReadWrite now includes s3:AbortMultipartUpload, so an app can abort its own failed multipart uploads instead of leaving the parts to accumulate and cost storage.

Validation

• serviceAccountName and networkServiceAccountName must be valid ServiceAccount names (DNS subdomains). An invalid one used to be accepted and then fail on every pass; it is now rejected when the CR is applied.
• A consumed resourceName may be up to 256 characters, so resources with long names can be consumed.
• A queue or topic entry removed and added back with fifo flipped, while the old queue or topic is still tracked, is refused with FIFOChanged instead of being reconciled as the old one.

RBAC

• The manager's role no longer has create or delete on appdependencies; it never used them.

Upgrade notes

• Every IAM role the operator manages gets a new policy once, on its next pass.
• A CR with an invalid ServiceAccount name is now rejected when applied. Such a CR never worked; on clusters without CRD validation ratcheting, updating it is refused until the name is fixed.
• Apply the CRDs and the manager role before upgrading (the chart does). No new operator IAM permissions.