v0.8.1

What's new

• Each ledger entry says what happens on delete. onDelete is Retain, Delete, DeleteEvenIfNotEmpty or ManualDeletion (an RDS instance, which the operator never deletes). A KMS key entry lists in heldBy the entries that still need it.
• Retained resources leave a trace. When the operator lets go of a retained SQS queue, SNS topic, S3 bucket, DynamoDB table, KMS key or RDS instance, it leaves cloudctl.io/released-from=<namespace>/<cr-name> and cloudctl.io/released-at=<date> on it, so a resource nobody remembers can be traced. aws resourcegroupstaggingapi get-resources --tag-filters Key=cloudctl.io/released-from lists them. They are never used as ownership, and adopting the resource again removes just those two tags. Turn them off with --release-tags=false (chart: manager.releaseTags: false).

What's fixed

• Adopting a KMS key that was pending deletion failed. AWS refuses to tag a key in that state, and the operator tagged it before cancelling the deletion. It now cancels first.

Upgrade notes

• On the first pass after the upgrade every ledger entry gets onDelete (and key entries heldBy): one status write per CR. The CRD gains two optional status fields, which the chart carries.
• Resources let go by earlier versions have no released tags.
• No spec, IAM or default-behavior changes.