v1.1.0

What's changed in v1.1.0

• chore(deps): update unbounded-tech/workflow-vnext-tag action to v1.22.4 (#43) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update unbounded-tech/workflow-simple-release action to v2.1.4 (#42) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update helm release external-secrets to v2.14.0 (#41) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update helm release external-secrets to v2.15.0 (#44) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• feat(deps): update dependency hops-ops/aws-auto-eks-cluster to v2.2.2 (#45) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v1.0.2...v1.1.0

v1.0.2

What's changed in v1.0.2

• chore(deps): update helm release external-secrets to v2.12.0 (#32) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update helm release vault to v0.34.1 (#33) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update unbounded-tech/workflow-vnext-tag action to v1.22.3 (#34) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update upbound/action-up action to v1.2.0 (#35) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update dependency hops-ops/aws-auto-eks-cluster to v2 (#39) (by @renovate[bot])

  e2e test-only: tests/e2etest-secretstacks bootstraps aws-auto-eks-cluster v0.7.0 -> v2.2.1 (same version used by aws-observe/psql/aws-crossplane e2e). Does not change the SecretStack XR render. PR CI incl. e2e green.

• chore(deps): update actions/checkout action to v7 (#38) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update upbound/action-up-project action to v1.2.0 (#36) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• fix(deps): update helm release external-secrets to v2.13.0 (#40) (by @renovate[bot])

  XR-rendered chart pin (200-helm-release-external-secrets). Chart diff 2.12.0->2.13.0 is version/appVersion only; CRDs unchanged. App v2.13.0 tightens Secret validation for target.manifest and v1beta1 templateFrom targets; hops-ops ExternalSecrets use neither. validate/test/e2e green. fix type to cut a release (also ships 2.12.0, automerged earlier as chore).

See full diff: v1.0.1...v1.0.2

v1.0.1

What's changed in v1.0.1

• chore: update repository references after rename (#29) (by @patrickleet)

• fix: automate tested dependency updates (by @patrickleet)

  • fix: automate tested dependency updates

  • fix: bound dependencies below next major

  • fix: avoid overlapping Renovate extraction

  • fix: address dependency review findings

  • fix: scope package dependency extraction

  • fix: validate Renovate configuration changes

  • fix: use compatible major dependency ranges

• chore(deps): migrate workflows-crossplane to hops-ops@v3.2.0 (#31) (by @patrickleet)

  • chore(deps): migrate workflows-crossplane to hops-ops@v3.2.0

  • chore(deps): migrate workflows-crossplane to hops-ops@v3.2.0

  • chore(deps): migrate workflows-crossplane to hops-ops@v3.2.0

See full diff: v1.0.0...v1.0.1

v1.0.0

What's changed in v1.0.0

• feat: platform SecretStack with AWS and Vault backends (#28) (by @patrickleet)

  BREAKING CHANGE: * feat: platform SecretStack with AWS and Vault backends

  Break the API group to hops.ops.com.ai and select secrets backend via
  spec.backend (aws|vault). Gate PodIdentity and SM stores on aws; add optional
  Vault Helm install plus Vault SecretStore. Gate dependents on sticky helm
  revision existence rather than Ready. Dogfooded locally with hops config
  install --path against dory (ESO + Vault Releases Ready).

  • feat: prototype typed SecretStack composition gates

  • fix: restore local SecretStack validation

  • chore: remove accidental Rust composition prototype

  Implements [[tasks/remove-secretstack-rust-prototype]]

  • fix: validate and bootstrap SecretStack backends

  Implements [[tasks/address-secretstack-review-findings]]

  • fix: harden review workflow checkout

  Implements [[tasks/address-secretstack-review-findings]]

  • fix: compute SecretStack readiness

  Implements [[tasks/fix-secretstack-status-ready]]

  • fix: preserve disabled SecretStore setting

  Implements [[tasks/fix-secretstack-status-ready]]

See full diff: v0.20.0...v1.0.0

v0.20.0

What's changed in v0.20.0

• feat(deps): update dependency aws-pod-identity to v0.13.0 (#25) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.19.0...v0.20.0

v0.19.0

What's changed in v0.19.0

• feat(deps): update crossplane-contrib/function-auto-ready docker tag to v0.7.0 (#26) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.18.0...v0.19.0

v0.18.0

What's changed in v0.18.0

• chore(deps): update unbounded-tech/workflow-vnext-tag action to v1.21.3 (#21) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update unbounded-tech/workflow-simple-release action to v2.1.3 (#20) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• chore(deps): update unbounded-tech/workflows-crossplane action to v3 (#19) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• feat: add external-secrets resource defaults (#24) (by @patrickleet)

See full diff: v0.17.0...v0.18.0

v0.17.0

What's changed in v0.17.0

• feat(deps): update dependency aws-pod-identity to v0.11.0 (#23) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.16.0...v0.17.0

v0.16.0

What's changed in v0.16.0

• feat: Burstable resource defaults for external-secrets (operator + cert-controller + webhook) (by @patrickleet)

  All three pods shipped as BestEffort by default. Verified on pat-local:
  new pods rh2mx (controller) and lrxpw (cert-controller) and cfq2w
  (webhook) transitioned to Burstable QoS after install.

  Implements [[tasks/cluster-wide-resource-right-sizing-p95-observation]] tier-1 #5

• feat(deps): update crossplane-contrib/function-auto-ready docker tag to v0.6.5 (#22) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.15.0...v0.16.0

v0.15.0

What's changed in v0.15.0

• feat(secretstack): allow ESO IRSA role to write secrets under push/* (by @patrickleet)

  Adds a WritePushedSecrets IAM statement granting secretsmanager:* on
  arn:aws:secretsmanager:*:*:secret:push/*, scoped narrowly so the
  existing read-everywhere policy stays untouched. Pairs with the new
  PushSecret flow in AuthStack: the chart-managed iam-admin PAT gets
  pushed to AWS SM at push/<clusterName>/zitadel-credentials for
  consumers to pull and assemble into a Zitadel ProviderConfig.

  The push/ top-level prefix is the convention for AuthStack-style
  publishers; the wildcard keeps IAM as one statement regardless of how
  many stacks adopt the pattern. Read scope is unchanged.

  Verified live on pat-local: SecretStack composition redeploys cleanly,
  PushSecret transitions from AccessDenied to Synced after the ESO
  controller picks up the new session token (one rollout restart needed
  the first time; subsequent reconciles inherit fresh creds).

See full diff: v0.14.0...v0.15.0