v0.2.1

tinycode-operator v0.2.1

Operator image: quay.io/bjohns/tinycode-operator:v0.2.1

Changes

• Declarative vLLM config (spec.vllm) with auto-probing and 80/20 context/output split
• Cross-namespace vLLM discovery (spec.discovery.namespaces)
• GitOps mode (spec.git) with init container, credential support, pullOnRestart
• Shared team workspace (spec.storage.projectsAccessMode: ReadWriteMany)
• OpenShift management extensions (kubeconfigNamespace, clusterRole)
• OLM bundle for OperatorHub with FBC catalog
• HELM_DRIVER=configmap for namespace RBAC fix
• Shell injection prevention (Helm template quoting)
• CRD validation tightening (git URL/branch patterns, clusterRole allowlist, image registry restriction)
• SSRF prevention in vLLM URL probing
• SCC RBAC fix (added patch/update verbs)
• NetworkPolicy Helm template
• Secret read audit logging
• Kubeconfig exception sanitization
• kubernetes 29→36.0.2 (urllib3 CVE fix)
• kopf 1.37→1.44.6, pyyaml 6.0.3
• GitHub Actions pinned to SHA (checkout v7, setup-python v6)
• Complete spec reference documentation (34 CRD fields)

v0.2.0

tinycode-operator v0.2.0

Added

• Cross-namespace discovery RBAC (config/rbac/discovery_role.yaml)
• 44 unit tests (pytest) for all validation and config functions
• Dependabot for GitHub Actions and pip

Fixed

• hostPath SCC selection bug (path not enabled)
• readOnly hostPath applied in Helm template
• SCC runAsUser enforced as MustRunAs UID 1001
• observedGeneration set in CR status
• Secret RBAC reduced to get-only
• Helm binary checksum verification
• Spec hash skips no-op Helm upgrades
• DynamicClient reused (cached)
• CSV liveness flag matches Dockerfile
• Dockerfile multi-arch Helm download
• Install script uses admin (not edit) ClusterRole
• Namespace Preparation documented in README
• CONTRIBUTING.md sample file reference fixed
• Git URL scheme documentation corrected

Full changelog

v0.1.1...v0.2.0

v0.1.1 — Security & Polish

tinycode-operator v0.1.1

Security hardening and documentation improvements.

Security

• Shell injection prevention in Helm git init container (quoted values)
• CRD validation patterns tightened (image registry allowlist, git URL/branch, clusterRole allowlist)
• SSRF prevention in vLLM URL probing (metadata endpoint blocking)
• SCC RBAC fix (added patch/update verbs to match operator code)
• Helm template value quoting for all user-controlled strings
• Kubeconfig exception sanitization (no secret content in status)
• NetworkPolicy Helm template
• Secret read audit logging

Fixed

• CI YAML validation for multi-document samples (safe_load_all)
• CONTRIBUTING.md CRD name corrected (TinycodeInstance)
• CONTAINER.md synced with authoritative container repo version

Added

• CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, CHANGELOG.md
• CI workflow (Python lint, Helm lint, YAML validation)
• CI/License/Release badges
• Issue/PR templates, Dependabot, .gitignore
• License section in README

Full changelog

v0.1.0...v0.1.1

v0.1.0 — Initial Release

tinycode-operator v0.1.0

First public release of the tinycode Kubernetes Operator.

Features

• TinycodeInstance CRD — declarative management of tinycode deployments
• Declarative vLLM config — spec.vllm with auto-probing of /v1/models and 80/20 context/output split
• Cross-namespace discovery — spec.discovery.namespaces for multi-namespace vLLM service discovery
• GitOps mode — spec.git clones a repo into the workspace via init container
• Shared team workspace — spec.storage.projectsAccessMode: ReadWriteMany for multi-user deployments
• Cluster-admin mode — spec.clusterAdmin with kubeconfig mounting and oc CLI
• OpenShift integration — SCC binding, Route creation, arbitrary UID support
• OLM bundle — installable via OperatorHub with File-Based Catalog
• Helm-based deployment — operator manages instances via Helm charts
• Security hardened — CRD validation patterns, SSRF prevention, Helm value quoting, NetworkPolicy, audit logging

Installation

make install
make push

See README.md for full documentation and the RHOAI setup guide for OpenShift AI deployment.