v1.1.6

What's Changed

• fix: authorize plane CRs created after agent connects (backport to release-v1.1) by @github-actions[bot] in #4424
• fix(api): include component in exec authorization hierarchy (backport to release-v1.1) by @JanakaSandaruwan in #4537
• fix(api): pin exec authz to the component's owning project (backport to release-v1.1) by @Ketharan in #4538

Full Changelog: v1.1.5...v1.1.6

v1.2.3

What's Changed

• fix(api): pin exec/wirelogs authz to the component's owning project (backport to release-v1.2) by @github-actions[bot] in #4516
• fix(api): include component in exec authorization hierarchy (backport to release-v1.2) by @github-actions[bot] in #4517

Full Changelog: v1.2.2...v1.2.3

v1.2.2

What's Changed

• fix: authorize CRs created after agent connects by @yashodgayashan in #4425

Full Changelog: v1.2.1...v1.2.2

v1.1.5

What's Changed

• chore: bump version to 1.1.5 by @openchoreo-release-bot[bot] in #4416
• chore: update CHANGELOG for v1.1.5 release by @stefinie123 in #4418

Full Changelog: v1.1.4...v1.1.5

v1.0.5

What's Changed

• chore: bump version to 1.0.5 by @openchoreo-release-bot[bot] in #4414
• chore: update CHANGELOG for v1.0.5 release with bug fix for backend authentication issues (#725) by @stefinie123 in #4415

Full Changelog: v1.0.4...v1.0.5

v1.2.1

What's Changed

• chore: bump version to 1.2.1 by @openchoreo-release-bot[bot] in #4371
• chore: update CHANGELOG for v1.2.1 release with security fix for Backstage portal API authentication by @stefinie123 in #4373

Full Changelog: v1.2.0...v1.2.1

v1.1.4

What's Changed

• chore: bump version to 1.1.4 by @openchoreo-release-bot[bot] in #4276
• fix: prevent shell injection and isolate privileged pods by @chalindukodikara in #4297

Full Changelog: v1.1.3...v1.1.4

v1.0.4

What's Changed

• chore: bump version to 1.0.4 by @openchoreo-release-bot[bot] in #4309
• fix: prevent shell injection and isolate privileged pods by @chalindukodikara in #4277

Full Changelog: v1.0.3...v1.0.4

v1.2.0

Highlights

• Project Release Lifecycle — Manage shared, project-scoped infrastructure (cell namespaces, NetworkPolicies, ResourceQuotas, RBAC, etc.) as versioned, immutable snapshots that can be promoted across environments.
• Portal Assistant Enhancements — Get automated suggestions to troubleshoot build and runtime issues during deployments.
• Shell Access for Components — Open an interactive shell to running component instances directly from the Backstage portal.
• Improved Release & Deployment Experience — Browse and compare releases, review configuration differences, manually trigger CronJob releases, and manage deployments through a redesigned workflow.
• Advanced Observability — View Kubernetes events and Cilium Hubble wire logs through the Observer API and Backstage portal.
• Enhanced Security — Internal communication between components and the Cluster Gateway is now secured with mutual TLS (mTLS), and ABAC policies now support authorization conditions based on resource type, component type, and workflow.
• Platform Improvements — Configure workload scheduling using Helm affinity and topology spread constraints, and automatically scale workloads to zero using KEDA for improved resource efficiency.
• Developer Experience — Try out OpenAPI and GraphQL APIs directly from the Backstage portal, along with numerous bug fixes and stability improvements across the platform.

Breaking Changes

1. Project Release Lifecycle

v1.2.0 introduces the project release lifecycle (ProjectType, ClusterProjectType, ProjectRelease, ProjectReleaseBinding) and makes Project.spec.type a required, immutable field. Upgrading from v1.1.x is not just a plain helm upgrade, it requires a short, staged migration.

Read the v1.1 → v1.2 upgrade guide (https://openchoreo.dev/docs/platform-engineer-guide/upgrades/v1.1-to-v1.2/) before upgrading. Installing the v1.2.0 CRDs before backfilling Project.spec.type will halt control-plane reconciliation for every existing project. Running workloads on data planes are not affected; only control-plane reconciliation pauses during the upgrade window, and the migration is reversible (see the guide's Rollback section).

Here are the changes:

1. Project.spec.type is now required and immutable

Every Project must reference a (Cluster)ProjectType:

spec:
  type:                       # NEW — required, immutable
    kind: ClusterProjectType  # defaults to ProjectType if omitted
    name: default

• Who's affected: every install with Project resources created on v1.1.x (they have no spec.type).
• Impact: once the strict v1.2.0 CRD is installed, any write to a Project without spec.type is rejected with spec.type: Required value. Because the v1.1.x controller writes Project status on every reconcile, installing the strict CRD before backfilling breaks reconciliation for all existing projects. The field is immutable once set.
• Action required: follow the upgrade guide: pause control-plane writers, install the relaxed Project CRD, backfill spec.type (name: default for existing projects), then install the strict CRD set and upgrade. A default ClusterProjectType that provisions only the namespace ships with the release.

2. Projects must be deployed to an environment before their components

In v1.1.x the RenderedRelease controller implicitly created a project's cell namespace (dp-{orgNamespace}-{project}-{env}-{hash}). v1.2.0 removes that. The namespace is now part of the project's released manifests, applied through the Project release lifecycle.

The controller does not automatically create ProjectReleaseBindings, so the Projects will not be automatically deployed. But in clients (Backstage UI, occ), you have the option to offer a one-shot "deploy to all environments".

• Who's affected: anyone creating new projects after the upgrade, and any automation that assumed a component could deploy to an environment before the project was deployed there.
• Impact:
  • Migrated projects (from previous version): no disruption. The binding's RenderedRelease server-side-applies a Namespace with the exact name your workloads already use; the existing namespace is adopted, not recreated.
  • New projects: a component deploys to an environment only after its project is released (deployed) there.
• Action required: for existing projects, the upgrade guide creates one ProjectReleaseBinding per pipeline environment, so deployed state carries over. Going forward, deploy the project before its components.

Full upgrade instructions: v1.1.x → v1.2.x upgrade guide (https://openchoreo.dev/docs/platform-engineer-guide/upgrades/v1.1-to-v1.2/)

2. Tracing API response body update

The GET /api/v1alpha1/traces/{traceId}/spans/{spanId} API has been updated to return the complete span status object instead of only the span status code. Please refer the module README to determine module compatibility with this update. Furthermore, if you use your own client to invoke Observer, please update it as per the changes in here

What's Changed

• chore: clean up root by @chathuranga95 in #2945
• chore: bump version to 1.1.0 by @Mirage20 in #2952
• test: add unit tests for gateway and kubernetes clients using testify by @chathuranga95 in #2949
• fix: update default schedule for scheduled-task component to valid cron expression by @ThusharaSampath in #2955
• fix: add missing openAPIV3Schema wrapper in trait specs for componentrelease generate by @VajiraPrabuddhaka in #2957
• chore: update BYOI samples by @rashadism in #2959
• feat: validate traits do not create workload resources by @ChathurangaKCD in #2922
• fix: add deployment strategy for observer by @akila-i in #2981
• fix: add deployment strategy for rca-agent by @akila-i in #2986
• test: improve integration tests in observabilityalertrule controller by @akila-i in #2992
• test: add unit tests for alerts email and webhook notification by @akila-i in #2995
• test: improve unit test coverage for observer/api/handlers by @akila-i in #3005
• chore(cli): add tests and remove dead code in pkg/cli by @JanakaSandaruwan in #3003
• ci: add Trivy image scan workflow by @Mirage20 in #3011
• ci: add periodic Trivy image scan trigger by @Mirage20 in #3012
• chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by @dependabot[bot] in #2967
• chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @dependabot[bot] in #2966
• chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #2868
• chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #2863
• chore(deps): bump dawidd6/action-download-artifact from 16 to 19 by @dependabot[bot] in #2862
• test: add comprehensive unit tests for API handlers by @LakshanSS in #3007
• fix(cli): use spec hash to select release in binding generate by @VajiraPrabuddhaka in #3006
• test: add mockery tooling by @chathuranga95 in #3015
• test: add comprehensive unit tests for request and response models by @LakshanSS in #3025
• test: add HTTP-layer integration tests for all API handler resources by @LakshanSS in #3016
• refactor: inject client into clustertrait for testability by @JanakaSandaruwan in #3028
• refactor(cli): inject client into clustercomponenttype, componenttype, trait by @JanakaSandaruwan in #3031
• ci: fix codecov ignore pattern for generated mocks by @JanakaSandaruwan in #3032
• test: add git secret creation unit tests by @chalindukodikara in #3013
• test: add service authz wrapper unit tests by @chathuranga95 in #2994
• chore: upgrade Go from 1.24 to 1.26 by @Mirage20 in #3033
• refactor(cli): inject client into authz role resources by @JanakaSandaruwan in #3034
• chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by @dependabot[bot] in #3037
• chore(deps): bump korthout/backport-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #3036
• test: improve unit test coverage for pkg/fsindex by @VajiraPrabuddhaka in #3027
• ci: add setup-go composite action to dependabot scanning by @Mirage20 in #3040
• chore(deps): bump actions/setup-go from 6.1.0 to 6.4.0 in /.github/actions/setup-go by @de...

v1.2.0-rc.2

Highlights

• mTLS for Cluster Gateway — Internal component-to-cluster-gateway communication is now secured with mutual TLS
• Manual Trigger for CronJob Releases — Manually trigger cronjob release bindings via the API
• Helm Scheduling Controls — Added affinity and topology spread constraint support to Helm charts
• Bug Fixes — Preserved newlines in build env/args, corrected endpoint schema type derivation on workload create, fixed multi-container pod log retrieval, and made missing default-plane errors report as IsNotFound

What's Changed

• chore: clean up root by @chathuranga95 in #2945
• chore: bump version to 1.1.0 by @Mirage20 in #2952
• test: add unit tests for gateway and kubernetes clients using testify by @chathuranga95 in #2949
• fix: update default schedule for scheduled-task component to valid cron expression by @ThusharaSampath in #2955
• fix: add missing openAPIV3Schema wrapper in trait specs for componentrelease generate by @VajiraPrabuddhaka in #2957
• chore: update BYOI samples by @rashadism in #2959
• feat: validate traits do not create workload resources by @ChathurangaKCD in #2922
• fix: add deployment strategy for observer by @akila-i in #2981
• fix: add deployment strategy for rca-agent by @akila-i in #2986
• test: improve integration tests in observabilityalertrule controller by @akila-i in #2992
• test: add unit tests for alerts email and webhook notification by @akila-i in #2995
• test: improve unit test coverage for observer/api/handlers by @akila-i in #3005
• chore(cli): add tests and remove dead code in pkg/cli by @JanakaSandaruwan in #3003
• ci: add Trivy image scan workflow by @Mirage20 in #3011
• ci: add periodic Trivy image scan trigger by @Mirage20 in #3012
• chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by @dependabot[bot] in #2967
• chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @dependabot[bot] in #2966
• chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #2868
• chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #2863
• chore(deps): bump dawidd6/action-download-artifact from 16 to 19 by @dependabot[bot] in #2862
• test: add comprehensive unit tests for API handlers by @LakshanSS in #3007
• fix(cli): use spec hash to select release in binding generate by @VajiraPrabuddhaka in #3006
• test: add mockery tooling by @chathuranga95 in #3015
• test: add comprehensive unit tests for request and response models by @LakshanSS in #3025
• test: add HTTP-layer integration tests for all API handler resources by @LakshanSS in #3016
• refactor: inject client into clustertrait for testability by @JanakaSandaruwan in #3028
• refactor(cli): inject client into clustercomponenttype, componenttype, trait by @JanakaSandaruwan in #3031
• ci: fix codecov ignore pattern for generated mocks by @JanakaSandaruwan in #3032
• test: add git secret creation unit tests by @chalindukodikara in #3013
• test: add service authz wrapper unit tests by @chathuranga95 in #2994
• chore: upgrade Go from 1.24 to 1.26 by @Mirage20 in #3033
• refactor(cli): inject client into authz role resources by @JanakaSandaruwan in #3034
• chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by @dependabot[bot] in #3037
• chore(deps): bump korthout/backport-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #3036
• test: improve unit test coverage for pkg/fsindex by @VajiraPrabuddhaka in #3027
• ci: add setup-go composite action to dependabot scanning by @Mirage20 in #3040
• chore(deps): bump actions/setup-go from 6.1.0 to 6.4.0 in /.github/actions/setup-go by @dependabot[bot] in #3042
• chore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 by @dependabot[bot] in #3035
• chore(deps): bump github.com/knadh/koanf/v2 from 2.3.2 to 2.3.4 by @dependabot[bot] in #3049
• chore(deps): bump distroless/static from f512d81 to e3f9456 by @dependabot[bot] in #3018
• chore(deps): bump distroless/static from f512d81 to e3f9456 in /cmd/cluster-agent by @dependabot[bot] in #3019
• chore(deps): bump distroless/static from f512d81 to e3f9456 in /cmd/cluster-gateway by @dependabot[bot] in #3020
• chore(deps): bump distroless/static from f512d81 to e3f9456 in /cmd/observer by @dependabot[bot] in #3022
• chore(deps): bump distroless/static from f512d81 to e3f9456 in /cmd/openchoreo-api by @dependabot[bot] in #3024
• chore: modify observer mock implementations to use mockery by @akila-i in #3039
• refactor(cli): remove legacy resources package code by @JanakaSandaruwan in #3051
• test: add tests for workflow run apis by @chalindukodikara in #3050
• test: add tests for k8sresources package by @chalindukodikara in #3057
• test: add tests for licenser by @chalindukodikara in #3058
• ci: switch backport workflow from comment-based to label-based by @Mirage20 in #3059
• refactor: centralize action constants as single source of truth by @binoyPeries in #3053
• refactor(cli): inject client into occ cmd packages and add unit tests by @JanakaSandaruwan in #3064
• feat: add workflowrun deletion api by @chalindukodikara in #3062
• ci: add failure comment with workflow run link to backport workflow by @Mirage20 in #3066
• ci: use action output to detect backport failure by @Mirage20 in #3070
• test(cli): add tests for fsmode Index methods by @VajiraPrabuddhaka in #3068
• refactor(cli): inject client into 7 occ cmd packages and add tests by @JanakaSandaruwan in #3072
• test(cli): add tests for fsmode typed package by @VajiraPrabuddhaka in #3076
• test: add mcp handler unit tests by @chathuranga95 in #3038
• chore: add unit tests for authz related functions by @mevan-karu in #3010
• test: add integration tests to k8sresources package by @chalindukodikara in #3075
• fix: add timezone support to scheduled-task component type by @LakshanSS in #3081
• test: improve coverage on internal/validation/component package by @ChathurangaKCD in #3080
• refactor(cli): inject client into component cmd and add tests by @JanakaSandaruwan in #3082
• test(cli): add tests for fsmode generator package by @VajiraPrabuddhaka in #3079
• test: add cluster gateway tests by @yashodgayashan in #3085
• test: add mcp handler unit tests by @chathuranga95 in #3083
• test: add authz service unit tests by @chathuranga95 in #3086
• chore: add tests for observer authz package by @mevan-karu in #3063
• test(cli): add unit tests for occ cmd and resources packages by @JanakaSandaruwan in #3087
• test: add tests for workflow run controller by @chalindukodikara in #3089
• docs: clarify issue triage process by @tishan89 in #3093
• test: add cluster agent test cases by @yashodgayashan in http...