v0.30.0

0.30.0 (2026-10-17)

⚠ BREAKING CHANGES

• project-sync: the account namespace is drover-<cluster id>-<project>, the ClusterRoleBindings and the bound RoleBindings have that prefix, the allowed_kubernetes_namespaces of each OpenBao role follows, and a login role is <cluster id>_<project>_<statement>. A client sends the new namespace name in kubernetes_namespace of a credential request, and the new role name at a login. The first reconcile run after the upgrade writes the new objects, and it deletes each old login role that the last status of a project names. The old account namespaces and their bindings stay. Delete the old bindings first, then the old namespaces, as docs/project-sync.md describes.

Features

• project-sync: put the cluster id in the names of the account namespace, the bindings, and the login roles (#153) (52ead13)

v0.29.0

0.29.0 (2026-10-17)

Features

• project-sync: write the namespace count of each project to an annotation (#152) (c231f5d)

v0.28.0

0.28.0 (2026-10-16)

⚠ BREAKING CHANGES

• project-sync: every key that project-sync writes is under managed.drover.evil8.io/, and the default trust annotation is drover.evil8.io/trust-policy.

Features

• project-sync: move the keys of the service to the prefix managed.drover.evil8.io (#147) (8c0cd44)

v0.27.3

0.27.3 (2026-10-15)

Bug Fixes

• api-filter: keep the native answer when a namespace of a fan-out list fails with a status other than 403 (#145) (f2a60f6)

v0.27.2

0.27.2 (2026-10-15)

Bug Fixes

• api-filter: give an empty collection a resourceVersion and keep an all-denied watch open (#143) (e384628)

v0.27.1

0.27.1 (2026-10-11)

Bug Fixes

• project-sync: warn for a bound Role without its namespace, and keep the lister going after a failed list (#140) (b6773d0)

v0.27.0

0.27.0 (2026-10-11)

Features

• project-sync: bind extra roles to the project ServiceAccounts (#139) (f30eeae)

Bug Fixes

• deps: update opentelemetry-go monorepo to v1.47.0 (#123) (a87a2de)

v0.26.0

0.26.0 (2026-10-04)

⚠ BREAKING CHANGES

• a query or a dashboard that selects a drover metric by the attribute cluster must select drover.cluster.

Features

• name the cluster attribute of every metric drover.cluster (#133) (5c540ed)

v0.25.0

0.25.0 (2026-10-04)

Features

• project-sync: export the readiness of each trust statement as a gauge (#131) (4133dfd)

v0.24.0

0.24.0 (2026-10-03)

⚠ BREAKING CHANGES

• project-sync: name a login role _ and harden the trust reconcile (#129)

Bug Fixes

• project-sync: name a login role <project>_<name> and harden the trust reconcile (#129) (8d36f19)