1.4.5

What's Changed

• Add README.md and subchart values.schema.json validation to the platform release chart by @ajanikow in #2128
• Sync operator-managed predefined RBAC roles into the authorization sidecar by @ajanikow in #2130
• ci: add warn-only image CVE scan, bump trivy-scan orb to 1.0 by @MarkusReadius in #2132
• Fix data race in the test log scanner that made Test_Apply flaky by @ajanikow in #2133
• Aggregate bundled-chart container images into the platform release chart README and images.yaml by @ajanikow in #2131
• fix(deps): bump grpc, otel/sdk and oras-go to clear HIGH CVEs by @MarkusReadius in #2135
• Support Azure client-certificate authentication for Azure Blob Storage by @ajanikow in #2134
• fix(deps): bump golang.org/x/text and golang.org/x/net to clear the remaining fixable CVEs by @MarkusReadius in #2137
• [Feature] [Platform] Add ArangoPlatformConnector CRD and Connector V1 integration by @ajanikow in #2103
• Propagate service and chart overrides into the generated platform release values.yaml by @ajanikow in #2138
• [Feature] Inventory Collector by @ajanikow in #2115
• Strip pre-release suffix from detected ArangoDB version so version/feature gates compare numerically by @ajanikow in #2139
• Allow WebSocket upgrades over HTTP/2 on the gateway by @ajanikow in #2140
• Fix Envoy auth v3 response hashing and cookie header handling by @ajanikow in #2141
• Gate authentication CreateToken behind the authorization integration (IAM) by @ajanikow in #2142
• Add harden feature: append arangod hardening arguments by @ajanikow in #2145
• Add ArangoDeployment status subresource support and enable-arango-deployment-status feature by @ajanikow in #2143
• Expose authentication/authorization modes (inventory core-security + integration sidecar env vars) by @ajanikow in #2148
• Document authentication v1 token creation and IAM gating by @ajanikow in #2147
• Document the harden feature by @ajanikow in #2150
• Fix harden feature doc link so make ci-check passes by @ajanikow in #2151
• Default integration database.source to _graphs instead of _statistics by @ajanikow in #2149
• Sign the integration sidecar's ArangoDB client token locally from the mounted cluster JWT, fixing gateway /_login under rbac-enforced by @ajanikow in #2152
• Mark status-only propagation actions as internal by @ajanikow in #2154
• Serve the svc HTTP gateway without TLS only on loopback addresses by @ajanikow in #2153
• Add rbac-coredb feature: point serving member at local authorization sidecar by @ajanikow in #2144
• Lint Helm charts in CI by @ajanikow in #2156
• Add a README for the platform-storage chart by @ajanikow in #2155
• Clean up the gateway member TLS keyfile secret on removal via a Pod finalizer by @ajanikow in #2159
• Report INTEGRATION_AUTHORIZATION_MODE_COREDB as RBAC when rbac-coredb enforces it by @ajanikow in #2157
• Validate gateway serving certificates like arangod members by @ajanikow in #2162
• Reload gateway TLS certificates in place via Envoy SDS by @ajanikow in #2161
• Update doc links and add rclone config remarks by @Simran-B in #2129
• Add a dedicated License Manager API timeout and raise the reconciliation default to 2m by @ajanikow in #2163
• Set the Envoy node identity in the static gateway bootstrap so SDS-served TLS initializes by @ajanikow in #2165
• Platform chart: derive the release image list only from each chart's root images map by @ajanikow in #2166
• Add arango-deployment Helm chart by @ajanikow in #2146
• Bump Go toolchain to go1.25.13 (clears 7 stdlib vulnerabilities) by @ajanikow in #2167
• Document RBAC permissions for Meta V1, Storage V2 and Authorization V1 services by @ajanikow in #2168
• Add --sidecar.unix.enabled flag to disable the sidecar internal UNIX socket by @ajanikow in #2169
• Platform chart: emit image overridePaths as a list (keep every path for a shared image) by @ajanikow in #2171
• arango-deployment chart: expose gateway SSO (OpenID/ALB) via platform.authentication by @ajanikow in #2170
• RBAC API design doc: DELETE returns HTTP 200 with the resource response body, not 204 No Content by @ajanikow in #2172
• Sidecar: routable external HTTP endpoint for the management API (gateway reachability) by @ajanikow in #2173
• Add gateway ALB authentication type trusting AWS ALB OIDC via signed x-amzn-oidc-data by @ajanikow in #2164
• Sidecar: register authentication.v1 / authorization.v1 as default integrations by @ajanikow in #2174

Full Changelog: 1.4.4...1.4.5