v0.0.9

Changelog

• a6b6aa3 Add some checks
• b4259a6 Add timeout
• e0cf4a3 Add waits
• 486c08e Add working mac smoke test and provisional Tammy smoke test
• a1ff109 Custom user provided coreDHCP configs
• 148412e Document httpBootScript in UPGRADE.md
• 9b70095 Fix default for vault addr
• fb0cd5b Make baremetal more resilient
• aa836c1 Merge pull request #64 from OpenCHAMI/go-proxy
• 7bce861 Merge pull request #67 from OpenCHAMI/bug/55-smd-httproutes
• 3d927fd Merge pull request #68 from OpenCHAMI/feature/66-coredhcp-config
• 1311076 Merge pull request #70 from OpenCHAMI/bug/69-http-boot-service
• 1c52a18 Merge pull request #72 from OpenCHAMI/renovate/aws-sdk-go-v2-monorepo
• 18c0fe4 Merge pull request #73 from OpenCHAMI/renovate/go-modules-(minorpatch)
• e52461a Remove image prompt
• cecd512 Remove test files
• 3f42873 Restore goimports alias in generated deepcopy
• 047ad7a Serve boot-service bootscript over HTTP for iPXE
• f841161 chore(deps): go mod tidy
• 468293f fix(ci): bump golang image to 1.27.2 and golangci-lint to v2.14.0
• e2949a2 fix(deps): update aws-sdk-go-v2 monorepo
• 9a66387 fix(deps): update go modules (minor/patch)
• a75413c ran go mod tidy
• 920facb smd and boot-service public routes

v0.0.8

Changelog

• 981606e Merge pull request #63 from OpenCHAMI/bug/vault-oidc-base-comparison
• f243609 fix incorrect return value from ensureOIDCProvider
• 0808ac2 fix lint

v0.0.7

Changelog

• 057dcc5 1. RoleID-bound SecretID (AppRole-recreation detection) ensureAppRoleSecretID now takes the live RoleID and binds the generated SecretID to it via a new annotation openchami.org/vault-approle-role-id. The regeneration decision became three-way (internal/reconcilers/vault.go): - Absent / empty id → generate. - Non-empty id bound to the current RoleID → preserve (unchanged normal-reconcile behavior; no VSO churn). - Non-empty id bound to a different RoleID, or no binding annotation → regenerate. This handles your primary concern — the "Secret survives, Vault/AppRole recreated → new RoleID → stale 403" case now self-heals. A hand-created Secret with no annotation is treated as unbound and adopted (operator mints a SecretID of known provenance and stamps the annotation). As you noted, a manually revoked SecretID with an unchanged RoleID is not auto-detected; that would need active login-probing and is left as a separate concern. 2. Ownership / lifecycle of the operator-created Secret The operator-written Secret now carries the standard managed labels (openchami.org/managed-by=operator, app.kubernetes.io/name=vault-approle), matching the tokensmith_bootstrap.go convention. On the owner reference question: I deliberately did not add one. The OpenCHAMIControlPlane is namespaced and lives in a different namespace than the openchami- control-plane namespace, and Kubernetes forbids cross-namespace owner references. Cleanup is already handled correctly — the controller's deletion path deletes the entire openchami- namespace (openchamicontrolplane_controller.go:285), which garbage-collects this Secret along with everything else. I documented this rationale in the function godoc. 3. Vault RBAC documentation - docs/install-production.md §6.3 (new) — documents the operator's own Vault policy, explicitly including auth/approle/role//secret-id with create/update, flagged as the new capability required by this fix. - §8 rewritten — the manual staging is now marked "the operator provisions this for you," with §8.1 kept as the legacy/air-gapped path (including how to stamp the binding annotation for a fully admin-managed SecretID). - hack/local-dev/seed-vault.sh — dropped the manual kubectl create secret step (operator does it now); prints a note instead. - test/fixtures/production-controlplane.yaml.example and internal/admin/init.go — stale "create out-of-band" comments updated. Tests Updated/added in vault_test.go (all passing): - AppRoleSecretIDIdempotent — now seeds the matching RoleID annotation; asserts preserve + no GenerateSecretID. - AppRoleSecretIDRegeneratesOnRoleIDMismatch (new) — stale RoleID → regenerate + rebind annotation. - AppRoleSecretIDAdoptsUnboundSecret (new) — no annotation → regenerate + stamp annotation. - AppRoleSecretIDBootstrap — now also asserts the annotation and managed-by label.
• f37e1e7 Merge pull request #55 from OpenCHAMI/bug/54-vso-approle-management
• 08c5ea7 Merge pull request #56 from OpenCHAMI/feature/vault-oidc-cli-client
• ed82c01 Merge pull request #61 from OpenCHAMI/dev/oidc-redo
• 7ecc78a Operator OIDC management redo
• cc26ec3 Refactor rate limit type and error handling in S3 client
• da98359 Separated the two meanings of the Vault address;Made conflict-detecting (no silent overwrite); Webhook validation;updated tests; updated docs
• a229aca feat: Add CLI OIDC configuration for Tokensmith
• 6d3b006 fix Vault OIDC client is created without redirect URIs and Operator-created OIDC client not authorized on provider
• 34e9315 fix lint and test errors
• 3459a26 fix lint and test failures
• aa67aea fix linting failures
• a5906b5 fix more issues tieing the vault issuer uri back to the tokensmith OIDC provider uri
• d848cb1 fixed isClusterInternalHost() policy treating every single-label hostname as inherently cluster-internal
• ea98a17 make operator own AppRole secret
• 22e44c3 oidcIssuer now applies the same HTTP/HTTPS policy as vault.address; isValidOIDCIssuer now truly enforces scheme://host[:port]
• 2a24d32 oidcIssuer path/query/fragment now rejected, not silently stripped; read-back now strictly verifies the issuer; stale vault.address comments/docs updated
• 37a9009 set provider mode for tokensmith to be vault

v0.0.6

Changelog

• fa2c410 Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
• 040e6b9 Merge pull request #37 from OpenCHAMI/dev/tokensmith-issuer
• 55c9fe5 Merge pull request #39 from OpenCHAMI/38-bug-missing-client-id
• e7ac39e Merge pull request #48 from OpenCHAMI/18-rancher-admission-namespace
• 5008ae1 Merge pull request #49 from OpenCHAMI/19-envoy-gateway-crds
• 5a55d73 Merge pull request #50 from OpenCHAMI/dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc-1.45.0
• a6d26fe Rancher PSA label documentation update
• 0cb4185 adding back to the declaration
• 14bba69 derive TOKENSMITH_ISSUER from CR spec
• 58d1d7a envoy gateway CRDs documenation updates
• e99c5b0 fix vault OIDC client_id injection

v0.0.5

Changelog

• 30567d3 Merge pull request #36 from OpenCHAMI/bug-35-tokensmith-env
• 86558df fix tokensmithOIDCIssuerEnvName to use TOKENSMITH_OIDC_PROVIDER

v0.0.4

Changelog

• c7e32fe Better updates to dynamically discover the API endpoints vs relying on the defaults
• b049cfe Create backendRefs for security policies
• a007a03 Merge pull request #20 from OpenCHAMI/cr-probe-scheme
• 4de640b Merge pull request #24 from OpenCHAMI/bugfix/tokensmith-introspection-endpoint
• 03ee98a Merge pull request #25 from OpenCHAMI/dev/13-cnpg-kube-api-access
• e64ddff Merge pull request #26 from OpenCHAMI/dev/postgres-internal-traffic-policy
• ba441dc Merge pull request #28 from OpenCHAMI/dev/CNPG-RBAC
• c77198b Merge pull request #29 from OpenCHAMI/dev/core-dhcp
• 996e0bc Merge pull request #32 from OpenCHAMI/dev/cnpg-rbac-endpoint-discovery
• 51273ea Merge pull request #33 from OpenCHAMI/dev/security-policies-backend-refs
• 0752eba Merge pull request #34 from OpenCHAMI/dev/oauth-exchange-httproute
• a0b13f2 add cnpg network egress
• 360d46b add the TLS generation stuff to the rest of the services
• 682f96d added egress policy on CNPG pods
• 72cdb38 create RBAC marker for CNPG
• 1ef6947 feat: Add OIDCIntrospectionEndpoint to TokensmithSpec and update related documentation
• 6ec978d fix lint and test errors
• c284d69 fix lint and testing errors
• 6f5bb69 fix linter issue; unnecessary conversions
• ee298a4 fix(coredhcp): run coredhcp as root (UID 0) to bind port 67
• 6dbba4a fix: Update import alias for core v1 package in deepcopy file
• 390eb89 fixes to discover endpointslice port instead of assuming 443
• 1b57c67 linting errors. Switched from the deprecated corev1.Endpoints to discoveryv1.EndpointSlice
• 0bc5381 more test fixes
• e8a904f set TLS to be an option you can set in the spec
• e881c2e test(coredhcp): extract root-UID assertions to reduce gocyclo complexity
• af5b57b try to fix linting and failing tests
• bf1fafd update capabilities for coredhcp
• d652a80 update tokensmith httproute to include oauth/exchange
• 77a4985 yet more fixes

v0.0.3

Changelog

• fd1e3ec File: /Users/trcotton/git/github.com/openchami/openchami-operator/internal/reconcilers/tokensmith.go
• fb07fa8 Add renovate.json
• 088f7b1 Adding OpenCHAMI renovate config
• d0b871f Fixing license text
• 63c8d9b Merge pull request #10 from OpenCHAMI/ci/openchami-operator-readiness
• c141ad1 Merge pull request #12 from OpenCHAMI/11-fix-tokensmith-scheme
• 0406242 Merge pull request #8 from OpenCHAMI/renovate/configure
• 8b58051 Refactor Dockerfile to use prebuilt operator binary and remove build stage
• d23de72 Refactor OpenCHAMICluster to OpenCHAMIControlPlane
• 81787c7 Refactor tests and configurations to use constants for improved readability and maintainability
• c747fe2 Update GitHub Actions dependencies for golangci-lint workflow
• d44fce9 Update Go version to 1.26 and adjust golangci-lint configuration for improved compatibility
• 3a2b2cd Update Scorecard workflow to use latest actions and improve checkout configuration
• 298a51d feat(logging): add logq-compactor and logq-query support
• a09ebc7 feat: Add GoReleaser configuration and update Dockerfiles for multi-platform builds
• 4e8d03e feat: Add installation and verification steps for Vault CLI in E2E tests
• ae16c03 feat: Enhance Docker and CI configurations for improved build and testing processes
• 0844d22 feat: Enhance Gateway reconciler to handle BackendTLSPolicy CRD absence gracefully
• e84ff4b feat: Update CI workflows for linting and e2e tests with improved commands and timeout settings
• 8022f06 fix: Update ENVTEST_VERSION to v0.25.0 and improve Docker image testing steps
• 4bd9666 refactor: Replace ptrBool function with a boolean variable for Optional fields feat: Update GitHub workflows for E2E tests and golangci-lint configuration chore: Clean up unused lines in various configuration files
• e699832 update to remove fixed bugs from bug list

v0.0.2

What's Changed

• chore: Configure Renovate for automatic consistency scanning by @alexlovelltroy in #8
• feat: Enhance Docker and CI configurations for improved build and testing process by @alexlovelltroy in #10
• Change tokensmith probe scheme to use HTTP by @travisbcotton in #12

New Contributors

• @alexlovelltroy made their first contribution in #8
• @travisbcotton made their first contribution in #12

Full Changelog: v0.0.1...v0.0.2