Skip to content

v2.7.0

Latest
Latest

Choose a tag to compare

View all tags
@ulucinar ulucinar released this 10 Aug 21:20
v2.7.0
e5e520f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

  • Bumps TF AWS provider 6.55.0
  • New managed resources across
    account, bedrock, bedrockagentcore, cloudwatchlogs, lambda and
    opensearchserverless API groups
  • Bugfixes and enhancements and CVE remediations
  • Bumps upjet v2.4.1-0.20260728103920-4f6e6e10dff2
  • Bumps crossplane-runtime v2.3.3

⚠️ Breaking bugfix API changes

KeyPair.lightsail — status.atProvider.privateKey removed (#2136)

The upstream Terraform provider changed private_key on aws_lightsail_key_pair from a
regular attribute to a Sensitive attribute. Consequently:

  • status.atProvider.privateKey is removed from the CRD
  • The private key is now written to the connection details secret after creation
    instead.

The private key is only available at creation time and cannot be re-read from AWS.
Back up existing keys before upgrading, and make sure a
writeConnectionSecretToRef is configured for new
KeyPair resources.

Go module consumers: crossplane-runtime v2.3 changes (#2171)

All generated API types moved their common Crossplane types from
github.com/crossplane/crossplane-runtime/v2/apis/common/v1 to
github.com/crossplane/crossplane/apis/v2/core/v2. Every *Ref, *Selector,
*SecretRef and SecretKeySelector field changed its Go type
(v1.Reference → v2.Reference, v1.Selector → v2.Selector,
v1.SecretKeySelector → xpv2.SecretKeySelector, …).

This is not a CRD/YAML-level change — the schema is identical, so
existing manifests and stored objects are unaffected.
It is a notification for anyone importing this provider's apis/... packages in Go
(e.g. function or composition authors, custom controllers). Please update imports accordingly if needed.

⚠️ Field Deprecations (#2136)

Following fields still work but will be removed in the next major version as underlying TF
versions deprecated them. Use the new replacements on external consumers where possible.

Kind Group Deprecated field Replacement
S3Endpoint dms spec.forProvider.kmsKeyArn spec.forProvider.serverSideEncryptionKmsKeyId
SecretVersion secretsmanager status.atProvider.arn status.atProvider.secretArn

Cluster.elasticache — valkey removed from spec.forProvider.engine (#2136)

valkey was never a valid engine for the Cluster resource; it was accepted by the CRD
enum but rejected by AWS. Aligned with the AWS SDK to avoid confusion
(see hashicorp/terraform-provider-aws#41181).
Valkey engines continue to be created via ReplicationGroup.elasticache or
ServerlessCache.elasticache.

🆕 New managed resources

Kind Group Terraform resource PR
PrimaryContact account aws_account_primary_contact #2181
Guardrail bedrock aws_bedrock_guardrail #2152
Evaluator bedrockagentcore aws_bedrockagentcore_evaluator #2143
Harness bedrockagentcore aws_bedrockagentcore_harness #2143
OnlineEvaluationConfig bedrockagentcore aws_bedrockagentcore_online_evaluation_config #2143
Policy bedrockagentcore aws_bedrockagentcore_policy #2143
PolicyEngine bedrockagentcore aws_bedrockagentcore_policy_engine #2143
ResourcePolicy bedrockagentcore aws_bedrockagentcore_resource_policy #2143
AccountPolicy cloudwatchlogs aws_cloudwatch_log_account_policy #2127
RuntimeManagementConfig lambda aws_lambda_runtime_management_config #2164
CollectionGroup opensearchserverless aws_opensearchserverless_collection_group #2160

🔼 Terraform AWS provider version bump

  • #2136 — 6.34.0 → 6.53.0. The single largest change in this release; the
    KeyPair.lightsail, Cluster.elasticache, required→optional and deprecation items above
    all originate here. Also backports new fields into cluster-scoped v1beta1 APIs,
    configures singleton-list conversions for newly added nested blocks, and fixes example
    manifests the new provider version rejected (Broker.mq, Cluster.elasticache, kafka).
  • #2151 — 6.53.0 → 6.55.0. Additive at the API level (no removed CRD properties, no
    new required-field rules, no new deprecations). Carries three fixes not implied by the
    title:
    • Table.dynamodb — in-place GSI/attribute updates no longer fail validation.
    • Broker.mq — a spurious empty shared_resources diff is dropped, preventing a no-op
      update.
    • SecurityConfig.opensearchserverless — samlOptions now uses a regular singleton-list
      conversion after TF 6.x switched it to a list-nested block. No CRD API change.
  • #2176 — VaultLockConfiguration.backup now supports updates. The retention arguments
    are no longer ForceNew, so changing retention on an unlocked vault applies in place
    instead of looping on upjet's assertNoForceNew refusal (EXT-338). Adds
    status.atProvider.locked / lockDate and the first example manifests for this kind.
  • #2177 — InstanceState.rds stopped → available transitions (fixes #2100).
    spec.forProvider.state can now bring a stopped RDS instance back up. Also adds the
    missing password secrets to the instancestate.yaml examples; Go bumped to 1.26.5.

🐞 Bug fixes

  • #2185 — Streaming configuration propagation to DynamoDB global-table replicas in MRSC mode
    When streaming is enabled via spec.forProvider.streamEnabled: true in Table.dynamodb in
    MRSC mode, the configuration is now properly propagated to all the replica tables.
  • #2182 — Perpetual diff on DB parameter groups when only applyMethod differs
    (fixes #1286, #1444). Affects ParameterGroup / ClusterParameterGroup in the rds,
    docdb and neptune groups: AWS silently ignores apply-method-only changes, so
    applyMethod never round-tripped. A shared custom diff now suppresses the parameter
    diff when all parameter changes are ApplyMethod-only; value changes and
    additions/removals are untouched.
  • #2140 — Perpetual reconcile loop on LBListenerRule.elbv2 with action.forward.
    target_group_arn was late-inited into spec but stripped from state on the next Observe,
    producing a diff on every cycle. Fixed with a forced per-action late-init (which also
    backfills order and forward.stickiness) plus a custom diff that suppresses the
    resulting spurious ARN add/remove. Real user-driven ARN changes still apply.
  • #2137 — Stale tag keys in status.atProvider.tags / tagsAll. A tag key removed from
    or renamed in spec.forProvider.tags kept appearing in status indefinitely. The external
    AWS resource was always correct — only observed state was wrong.
  • #2117 — External-name oscillation on VPC endpoint associations (fixes #2116).
    aws_vpc_endpoint_subnet_association and aws_vpc_endpoint_route_table_association
    flipped the crossplane.io/external-name annotation between the Terraform ID and the
    import ID on every reconciliation, causing perpetual updates, delete/recreate cycles and
    AWS 429 throttling. Both forms are now derived deterministically from the named fields.
  • #2122 — Conversion webhooks not served by non-leader replicas. Webhook registration
    was gated behind leader election, so followers could not serve conversion requests. It now
    happens eagerly on all pods, with reconciler setup still deferred to the leader.
  • #2156 — Missing performanceInsightsKmsKeyId reference on RDS Instance/Cluster
    (fixes #2155). Adds the cross-resource reference to aws_kms_key (all versions, both
    scopes) with the generated Ref/Selector fields, plus KMS example manifests.

🔧 Upjet & crossplane-runtime bumps and their transitive effects

Directly consumed by changes in this release

  • #678 — conversion webhook registration
    decoupled from leader election. Consumed by #2122.
  • #693 — custom setup-aggregator and
    terraformed templates, plus the new Terraform.ResourceSchema template variable
    (replacing Terraform.SchemaVersion). Consumed by #2137 (tags fix) and #2140
    (forced late-init).
  • #698 — Plugin Framework external client:
    fixes "Unexpected Identity Change" errors during Observe for Framework resources with
    Terraform resource identity, and makes external-name resolution error out when
    FrameworkResourceWithComputedIdentifier returns the placeholder stub instead of a real
    identifier. Relevant to the bedrockagentcore and opensearchserverless resources added
    here. Consumed by #2151.
  • #664 — migrates common API imports to
    crossplane/apis/v2 for runtime 2.3.x. Consumed by #2171; this is the source of the
    Go-level v1.Reference → v2.Reference change described under Breaking changes.

Observable schema/behavior effects in the shipped CRDs

  • #660 — SSA list-map markers are no longer
    emitted on observation (status.atProvider) fields. Visible in this release as
    LBListener.elbv2 status.atProvider.defaultAction losing x-kubernetes-list-type: map
    / x-kubernetes-list-map-keys: [index] and the injected index default. Removing those
    markers from a status field is schema-compatible; it stops server-side-apply from treating
    observed lists as associative maps.
  • crossplane-runtime 2.3.x adds status.lastHandledReconcileAt to every MR CRD in the
    provider ("holds the value of the most recent reconcile-requested-at annotation token that
    the controller has processed"). This accounts for the bulk of the 2038 modified CRD files.
  • #684 — XValidation rules are omitted for
    required fields that have references, so a field satisfied purely by a
    *Ref/*Selector no longer trips the "is a required parameter" CEL rule.
  • #672 — configurable Description on SSA
    InjectedKey.

🔐 Security / CVE remediations

Dependency v2.6.0 v2.7.0
google.golang.org/grpc v1.79.3 v1.82.1
golang.org/x/net v0.55.0 v0.57.0
golang.org/x/crypto v0.52.0 v0.54.0
Go toolchain 1.25.11 1.26.5

✨ Non-breaking Resource API changes

Non-breaking API relaxations (#2136)

The following fields were Required → Optional (the generated
is a required parameter CEL validation rules were dropped). Existing manifests keep
working; validation is simply looser now:

Kind Group Field
Gateway bedrockagentcore spec.forProvider.protocolType
MetricAlarm cloudwatch spec.forProvider.comparisonOperator
MetricAlarm cloudwatch spec.forProvider.evaluationPeriods
Broker mq spec.forProvider.user
CloudFormationStack serverlessrepo spec.forProvider.capabilities

New Cross-resource references

New cross-resource references generated in this release:

Kind Group Field Target
Instance, Cluster rds performanceInsightsKmsKeyId aws_kms_key (#2156)
Guardrail bedrock kmsKeyArn aws_kms_key (#2152)
RuntimeManagementConfig lambda functionName aws_lambda_function (#2164)
Collection opensearchserverless collectionGroupName aws_opensearchserverless_collection_group (#2160)
AgentRuntime bedrockagentcore filesystemConfiguration.efsAccessPoint.accessPointArn aws_efs_access_point (#2151)
AgentRuntime bedrockagentcore filesystemConfiguration.s3FilesAccessPoint.accessPointArn aws_s3_access_point (#2151)
Browser, CodeInterpreter bedrockagentcore certificate.location.secretsManager.secretArn aws_secretsmanager_secret (#2151)

New fields

New top-level spec.forProvider fields from the Terraform provider bumps (non-exhaustive —
nested additions are not listed):

Kind.Group New field(s)
RestAPI.apigateway endpointAccessMode, securityPolicy
AgentRuntime.bedrockagentcore filesystemConfiguration
Browser.bedrockagentcore browserSigning, certificate, enterprisePolicy
CodeInterpreter.bedrockagentcore certificate
Gateway.bedrockagentcore policyEngineConfiguration
GatewayTarget.bedrockagentcore privateEndpoint
Memory.bedrockagentcore indexedKey, streamDeliveryResources
Budget.budgets metrics
Distribution.cloudfront cacheTagConfig
Function.cloudfront tags
MetricAlarm.cloudwatch evaluationCriteria, evaluationInterval
ResourcePolicy.cloudwatchlogs resourceArn
Directory.ds enableDirectoryDataAccess
Table.dynamodb restoreBackupArn
NetworkInterface.ec2 enaSrdSpecification
Route.ec2 odbNetworkArn
VPCIpamPoolCidrAllocation.ec2 tags
Addon.eks namespaceConfig
ReplicationGroup.elasticache durability
ServerlessCache.elasticache networkType
User.elasticache passwordsWo, passwordsWoVersion
LB.elbv2 enablePrefixForIpv6SourceNat
Application.emrserverless jobLevelCostAllocationConfiguration
WindowsFileSystem.fsx selfManagedActiveDirectory.passwordWo
CatalogTable.glue viewDefinition
Connection.glue authenticationConfiguration (with OAuth2/basic-auth secret refs)
Replicator.kafka logDelivery
Stream.kinesis warmThroughputMibPs
EventSourceMapping.lambda, Function.lambda useResourceTimeoutForPropagation
Broker.mq resourceShareArns
Configuration.mq skipDestroy
Domain.opensearch deploymentStrategyOptions
Collection.opensearchserverless collectionGroupName, encryptionConfig, vectorOptions
ResourceShare.ram resourceShareConfiguration
Cluster.rds autoMinorVersionUpgrade
Bucket.s3 bucketNamespace
DBCluster.timestreaminfluxdb, DBInstance.timestreaminfluxdb maintenanceSchedule
Server.transfer ipAddressType
ResourceGateway.vpclattice resourceConfigDnsResolution
VaultLockConfiguration.backup status.atProvider.locked, status.atProvider.lockDate

👥 Project

  • #2163 — jonasz-lasut added as a maintainer

Full PR list

PR Title Author Category
#2185 Propagate DynamoDB Stream Configuration to Replicas @ulucinar Bug fix
#2182 fix: suppress ApplyMethod-only diffs for DB parameter groups @erhancagirici Bug fix
#2181 account: add PrimaryContact managed resource @davemac30 New resource
#2180 Revert "account: add PrimaryContact managed resource" @jonasz-lasut Revert
#2177 Fix InstanceState.rds stopped → available transitions @ulucinar TF fork bump / Bug fix
#2176 Update underlying provider fork to support updates in VaultLockConfiguration @jonasz-lasut TF fork bump / Bug fix
#2173 Move main.go.tmpl to the config/templates package @ulucinar Enhancement
#2172 account: add PrimaryContact managed resource @davemac30 New resource (reverted)
#2171 Update crossplane-runtime to v2.3.3 @jonasz-lasut Framework bump / Breaking (Go API)
#2170 Update all non-major github action renovate CI bump
#2169 Update dependency crossplane/crossplane to v2.3.4 renovate CI bump
#2168 Update actions/stale action to v11 renovate CI bump
#2167 Update actions/setup-go action to v7 renovate CI bump
#2166 Update actions/cache action to v6 renovate CI bump
#2164 Add RuntimeManagementConfig.lambda resource @sac-outsystems New resource
#2163 add jonasz-lasut as maintainer @erhancagirici Project
#2160 Add aws_opensearchserverless_collection_group resource @fed-sv New resource
#2159 buildtagger: tag config_test and roundtrip test files @erhancagirici CI / Enhancement
#2156 fix: add missing reference to instance and cluster resources @fernandezcuesta API change (references)
#2152 feat: add Guardrail.bedrock resource @erhancagirici New resource
#2151 feat: bump TF AWS provider v6.55.0 @erhancagirici TF bump / Bug fixes
#2147 examples/rds: stop hardcoding engineVersion in Instance examples @ulucinar Examples
#2143 feat: add new bedrockagentcore resources @erhancagirici New resources
#2140 Add custom diff and custom late initialize for elbv2.LBListenerRule @sergenyalcin Bug fix
#2137 Fix stale resource tag keys in status.atProvider.tags/tagsAll @ulucinar Bug fix
#2136 feat: bump TF provider to v6.53.0 @erhancagirici TF bump / Breaking
#2127 Add cloudwatchlogs.AccountPolicy resource @sergenyalcin New resource
#2124 Update actions/checkout action to v7 renovate CI bump
#2122 Decouple conversion webhook registration from leader election @sergenyalcin Bug fix
#2121 Update alpine Docker tag to v3.24.1 renovate CI bump / Security
#2118 renovate: Remove invalid wildcards from renovate config @bobh66 CI
#2117 Fix VPC endpoint association external name oscillation @aditmeno Bug fix
#2112 Update dependency kubernetes-sigs/kind to v0.32.0 renovate CI bump
#2111 Update alpine Docker tag to v3.24.0 renovate CI bump / Security
#2095 Pin dependencies renovate CI / Supply chain
#2088 Update crossplane versions in CI to v2.3.2 renovate CI bump
#2062 Update golangci-lint versions in CI to v2.12.2 renovate CI bump

Contributors

davemac30, aditmeno, and 8 other contributors
Assets 2
Loading