v0.7.22

Changelog

• 4eb1364 Fix cosign sign-blob invocation for goreleaser release
• 2924ee2 Merge pull request #764 from bergerx/worktree-bridge-cse_01Gr93ohBLFfiaueE5KpKy6Q
• 63bba0e Merge branch 'master' into worktree-bridge-cse_01Gr93ohBLFfiaueE5KpKy6Q
• e43b0cd Delete the expandenv alias to fully block template env-var access
• c31d21c Merge pull request #763 from bergerx/worktree-bridge-cse_01Aoezqc6KwWb7B1ZoemBDeg
• 69b6951 Document single-maintainer project continuity in SECURITY.md
• b053921 Merge pull request #762 from bergerx/worktree-bridge-cse_017oXr77t9vFza2M1AtuQ5zD
• 6957c39 Sign release artifacts with cosign and generate SBOMs
• dc8760d Merge pull request #761 from bergerx/worktree-bridge-cse_01JA5WJ4Fky5V7kKJFs6wKkD
• a254c86 Pin GitHub Actions to commit SHAs instead of mutable tags
• 209a49d Merge pull request #760 from bergerx/worktree-bridge-cse_01DDpFqd5T1xcZJ454XxijLJ
• 4f6bac8 Harden against security audit findings: patch Go toolchain, drop env template funcs, add govulncheck to CI
• 420dc20 Merge pull request #759 from bergerx/worktree-bridge-cse_01CtzDWtjdLNAw3eqBXq1sE6
• f2c055e Bump CodeQL workflow actions to node24 releases
• a70e012 Retrigger CI now that CodeQL workflow is re-enabled
• 99ceda0 Update CodeQL workflow to non-deprecated action versions
• d0bb4ad Merge pull request #758 from bergerx/worktree-bridge-cse_01MAagTu87xA2VNKhNGr5KQs
• e88b8ea Add SECURITY.md
• eeb7cb3 Merge pull request #752 from bergerx/dependabot/go_modules/k8s.io/kubectl-0.36.3
• 5f25d30 Bump k8s.io/kubectl from 0.36.2 to 0.36.3
• 26e2adf Merge pull request #751 from bergerx/worktree-bridge-cse_01BSjKTkqoSfRPBqokpEF6YM
• 694801d Merge remote-tracking branch 'origin/master' into worktree-bridge-cse_01BSjKTkqoSfRPBqokpEF6YM
• 5932697 Merge pull request #750 from bergerx/worktree-bridge-cse_01CyniRGfkcCg1VxAHkvdXPF
• cb7196b Merge pull request #749 from bergerx/worktree-bridge-cse_01FJGcK4m7h1cHAHu75qRYfB
• 0685f8c Fix panic in HTTPRoute/GRPCRoute templates when spec.hostnames is unset
• 6883781 Move Karpenter capacity-envelope e2e test out of the parallel pool
• bbb1ad9 Secret: recognize Helm release-storage secrets, flag superseded revisions, list manifest resources
• d541e1b Merge pull request #748 from bergerx/worktree-bridge-cse_01R7CfJroKvt38ABj2BLwbhE
• 292916d Add generic_health_summary/resource_health_summary for lists of unknown-kind resources
• 66bd9b2 Merge pull request #747 from bergerx/worktree-bridge-cse_015PDAQjGcnidjiHKbbZdZFP
• 4ee9aec Pod: cross-check hard constraints against Karpenter NodePool capacity envelope
• 16face3 Merge pull request #746 from bergerx/worktree-bridge-cse_013KLPncrXcBFiKmodZZMgN1
• 11cce93 Pod: render required topologySpreadConstraints and required pod (anti-)affinity
• 8675b2e Merge pull request #745 from bergerx/worktree-bridge-cse_01D4zkrnw5pNut23eMHgLWxd
• 74b2d87 Merge pull request #743 from bergerx/worktree-bridge-cse_012bTm42to1vKNM3PEzCPRBL
• 4be7c9b Fix CI: mkdir E2E_HOME before flock in ASSUME_MINIKUBE_IS_CONFIGURED path
• dd300e3 renderGroupedTable: stop padding the last group's header label
• ccd40c8 Add make test-e2e-quick and switch to one shared e2e minikube cluster
• 390b239 input: set Kind/APIVersion on pods fetched via typed clientset List
• 700579a Merge pull request #744 from bergerx/worktree-bridge-cse_01WrmXKX4AKVbYKk6rXutvKU
• c1d0aba Node.tmpl: fix stack overflow in pods-by-usage table row building
• 929cff5 Comment out heavyweight pre-push hooks, delegate to CI for now
• 5163fc7 Pod/PV/StorageClass: cross-check PVC zone locality against Pod placement
• b646f9f update gitignore
• 35bd316 pod_health_summary: drop redundant "-n " when it matches the caller
• 0f08d62 Node.tmpl: rework pod-usage/health rendering, add container runtime
• db97d83 Merge pull request #742 from bergerx/worktree-bridge-cse_01J6ujUbK5Udb8ZB7Tik5zSk
• 9426b20 Update crossplane-xr-deep e2e fixture for node selector rendering
• 0c49c31 Pod: render hard node-selection constraints for unscheduled Pods
• 9e623d9 Merge pull request #741 from bergerx/worktree-bridge-cse_017bMhefbC4jPweQyeicPnqt
• 20e6079 Merge remote-tracking branch 'origin/master' into pr-741
• 3cce194 Merge pull request #736 from bergerx/add-volumesnapshot
• b6c86e8 Show per-pod resource usage and status on Node (#178)
• a0c1b8c Add VolumeSnapshot and VolumeSnapshotContent templates (#669)
• 9ed7a8b Merge pull request #735 from bergerx/worktree-bridge-cse_01QUZbRGe53XtT1Wx9ZmGwPq
• 226de62 Merge pull request #732 from bergerx/worktree-bridge-cse_016BUCrtZxWpaWMGQ7o4t8da
• eb1cd68 Surface ReadWriteOncePod claim holder on PersistentVolumeClaim (#669)
• 0251378 Merge pull request #734 from bergerx/add-volumeattachment-fetch
• f3db4d9 Merge pull request #733 from bergerx/fix-pv-deep-storageclass-glue
• 4d2f49e Fetch VolumeAttachment from PersistentVolume (#669)
• e90dc2e Fix PersistentVolume --deep rendering glued onto inlined StorageClass
• f9ccab9 Fix node-metrics e2e regex for available field
• 105b402 Warn about node-memory eviction/OOM risk for non-Guaranteed pods
• ea0feca Merge pull request #731 from bergerx/worktree-bridge-cse_01E91XBSfaHizYYnVP9oaNTn
• 097e43a Fetch StorageClass from PersistentVolume/PersistentVolumeClaim (#669)
• be7f495 Merge pull request #728 from bergerx/worktree-bridge-cse_01LWNc61z1Y2Wz57S5P242S5
• 1bec444 Use the resource_ref template for Composition/CompositionRevision/ProviderConfig references
• 19fccbe Surface Crossplane composition refs and managed-resource create/policy metadata
• c74fac8 Merge pull request #730 from bergerx/worktree-bridge-cse_01P9WdB3fj7L2QtUyH6bfKVe
• 130c383 Merge pull request #727 from bergerx/worktree-bridge-cse_013PRkonXuoQBWUgwmTmLja8
• 11d0cd1 Merge pull request #729 from bergerx/worktree-bridge-cse_01ViVn5qZViEDfN8g9cpdVc6
• 289b805 Render Crossplane drift as a unified diff instead of a bare field count
• f230e1d Fetch and surface PriorityClass referenced by Pod
• 8890b4d Add karpenter.sh/v1 NodePool and NodeClaim templates (#663)
• 696f6fa Merge pull request #726 from bergerx/worktree-bridge-cse_0158Mon5ct9RJbX9xpdXgJeR
• e75a10e Add Crossplane managed-resource drift detection (spec.forProvider vs status.atProvider)
• 24b174c Merge pull request #725 from bergerx/worktree-bridge-cse_01WdAaiTEWNAugxaXcmx94Xi
• f0037c6 Move install-e2e-deps' per-scenario dependencies into their topical test groups
• 3cfc83b Merge pull request #718 from bergerx/worktree-bridge-cse_01DwUhbKHhaqemibvGQobHJX
• 88d70eb Merge pull request #722 from bergerx/worktree-bridge-cse_01KcG5XSWmAe5vPVaYSs1sxp
• 21156bf Split TestE2EParallel's ~50 subtests into topical files
• cc7ad9f Fix nil namespace when composed resource ref omits its own namespace
• c529fc3 Merge pull request #717 from bergerx/worktree-bridge-cse_0142jVubBFry6aqz3RnKhWqa
• a22ff13 Split cmd/main_test.go's standalone functions into topical files
• eb07d82 Merge pull request #716 from bergerx/worktree-bridge-cse_01Qm7nM1VifFXL8qniTx49Z6
• 6340d01 Guard crossplane_composed_resources against non-XR shaped fields
• 583ed73 Add generic Crossplane XR/Composition rendering (#667)
• 8c4a053 Merge pull request #715 from bergerx/worktree-bridge-cse_01J8tvaNxfs8DKpvGhVMh4rN
• 1b2b048 Render Pod PVC volume refs via resource_ref template
• 7f4f64e Merge pull request #714 from bergerx/fix-local-shallow-live-query-leak
• e1352b5 Use resource_ref template for ConfigMap and Secret volume references
• 1e7d504 Use resource_ref style format for ConfigMap and Secret volume references
• d72a7bc Use resource_ref format for ConfigMap and Secret volume references
• 0c98546 Fix e2e regex to allow optional ConfigMap volume size info
• 8269c36 Rework e2e tests broken by --local's live-query removal
• 771f455 Make --local disable live queries like --shallow
• 94111a3 Merge pull request #713 from bergerx/secret-template-dockerconfig-and-expiry
• 213aae4 Fold service-account-token's ServiceAccount ref into the Type line
• 010ee98 Add Secret-type-specific detail for basic-auth, ssh-auth, service-account-token, bootstrap-token
• 137fba6 Show dockerconfigjson registries, flag expired certs, and surface Secret type