v1.2.2

Changed

• Updated latest stable install, pinned install, namespaced install, GitOps, docs-site, generated manifest, Kustomize, issue-template, and image-publish references for v1.2.2.
• Improved the GitHub Pages landing-page copy, structured metadata, copyable snippets, and architecture guidance for ALB maintenance routing.
• Clarified RFC3339 schedule examples across README, configuration docs, samples, CRD schema, and generated install manifest.

Security

• Includes the previously approved high-priority dependency/security update for google.golang.org/grpc and related Go module dependencies.

Fixed

• Documented AWS Load Balancer Controller IAM permissions required for generated maintenance Ingress listener-rule reconciliation.
• Clarified finalizer-safe uninstall behavior, troubleshooting, and cleanup expectations for operator removal.

Install

Latest stable install:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/latest/deploy/install.yaml

Pinned production install:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.2.2/deploy/install.yaml

Image

ghcr.io/k8s-operators-devops/app-maintenance-operator:v1.2.2

Published as a multi-architecture GHCR image for linux/amd64 and linux/arm64. The unknown/unknown entries shown by GHCR are BuildKit provenance attestations, not runnable image architectures.

v1.2.1

v1.2.1

This patch release keeps the public install and documentation experience aligned after the v1.2.0 release. It does not rewrite or replace v1.2.0; it gives the merged documentation and release-reference cleanup its own clean release marker.

Changed

• Updated active install references from v1.2.0 to v1.2.1 across README, docs site, generated install manifest, Kustomize config, GitOps examples, issue template, and image publishing workflow default.
• Clarified ALB IngressGroup and direct Ingress-name targeting language across repository documentation.
• Clarified planned Helm examples so users do not mistake them for a currently published chart.
• Extended hack/bump-release.ps1 so future release bumps update the full active release surface more consistently.

Fixed

• Removed stale release wording, Kubebuilder placeholder comments, and an outdated ServiceMonitor patch reference from documentation and configuration.

Install

Pinned cluster-scoped install:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.2.1/deploy/install.yaml

Pinned namespace-scoped install:

kubectl apply -k https://github.com/k8s-operators-devops/app-maintenance-operator/config/namespaced?ref=v1.2.1

Operational Notes

• The release image tag is ghcr.io/k8s-operators-devops/app-maintenance-operator:v1.2.1.
• No API-breaking changes are included.
• Dependabot changes are not included in this patch release.
• v1.2.0 remains immutable and available as its original release/tag.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

Highlights

v1.2.0 adds ALB IngressGroup-based maintenance targeting for AWS Load Balancer Controller users. You can now put an entire ALB IngressGroup into maintenance with spec.albGroupName, while direct Ingress-name targeting through spec.targetIngress remains supported for users who want to target one existing Ingress.

Added

• Added ALB IngressGroup maintenance targeting with spec.albGroupName.
• Added generated maintenance Ingress overlays that join the requested ALB IngressGroup with alb.ingress.kubernetes.io/group.order: "-1000".
• Added listener-port discovery from same-namespace ALB IngressGroup members, including HTTPS listener support when group members declare HTTPS listener ports.
• Added namespace-scoped and global-scoped documentation updates for the new targeting model.
• Added direct Ingress-name samples for enable, disable, and scheduled maintenance.

Changed

• Updated README and configuration docs to present two supported targeting options: ALB IngressGroup name or Ingress name.
• Updated samples to make ALB IngressGroup targeting the default AWS ALB path.
• Updated generated install manifests and Kustomize release references for v1.2.0.
• Clarified that ALB IngressGroup targeting does not mutate or back up existing application Ingresses.

Security

• Included the approved high-priority Dependabot update for github.com/google/cel-go from v0.26.0 to v0.29.0.

Upgrade Notes

No breaking API changes are included. Existing spec.targetIngress resources continue to work. For AWS Load Balancer Controller users, prefer spec.albGroupName when the operational boundary is the ALB IngressGroup.

Pinned install:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.2.0/deploy/install.yaml

Namespace-scoped install:

kubectl apply -k https://github.com/k8s-operators-devops/app-maintenance-operator/config/namespaced?ref=v1.2.0

Operational Notes

• The v1.2.0 image is published to GHCR as ghcr.io/k8s-operators-devops/app-maintenance-operator:v1.2.0.
• The image publish workflow builds linux/amd64 and linux/arm64 images.
• Always pin production installs to immutable release tags instead of tracking :latest.

Known Limitations

• Only AWS ALB fixed-response mode is currently supported.
• Fixed-response HTML must stay within the AWS ALB 1024-byte body limit.
• CRDs remain cluster-scoped Kubernetes resources, even when the manager runs with namespace-scoped watch/RBAC.
• Central platform-team control across multiple application namespaces remains future roadmap work.

Full Changelog: v1.1.1...v1.2.0

v1.1.1

v1.1.1

This patch release locks in the install-documentation polish, release-reference alignment, Google crawling metadata, and prioritized dependency updates that landed after v1.1.0.

Highlights

• Clarified global scoped and namespace scoped installation guidance in the README.
• Added Helm command examples for operator installation and scheduled Maintenance resource creation.
• Updated pinned install, GitOps, issue-template, generated manifest, and publishing workflow references for v1.1.1.
• Replaced the basic fixed-response HTML samples with a polished ALB-safe maintenance page.
• Added GitHub Pages crawling metadata with docs/robots.txt, docs/sitemap.xml, canonical URL metadata, and social preview metadata.

Security

• Includes prioritized Dependabot updates already merged through PR #26: OpenTelemetry, Kubernetes/controller-runtime dependencies, and GitHub Actions.

Fixed

• Clarified that operator watch scope belongs in deployment configuration, not in the Maintenance custom resource spec.
• Ensured the generated install manifest and kustomize source manifests consistently point to the v1.1.1 image and operator version.

Upgrading from v1.1.0

No breaking API changes are included.

Pinned global scoped install:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.1.1/deploy/install.yaml

Pinned namespace scoped install:

kubectl apply -k https://github.com/k8s-operators-devops/app-maintenance-operator/config/namespaced?ref=v1.1.1

Container image:

ghcr.io/k8s-operators-devops/app-maintenance-operator:v1.1.1

Operational Notes

• The release tag points to the protected main commit validated by required checks.
• The tag-triggered image publishing workflow builds the linux/amd64 and linux/arm64 image.
• Google Search Console sitemap processing can lag even when the public sitemap endpoint returns 200 application/xml.

Full Changelog: v1.1.0...v1.1.1

v1.1.0

v1.1.0

This release focuses on a real security and operability upgrade: namespace-scoped operator mode alongside a leaner CI pipeline and a stronger release/publishing posture. If you're running this operator in a shared or multi-tenant cluster, this is the release that lets you narrow its blast radius.

Highlights

• Namespace-scoped operator mode. Set WATCH_NAMESPACE to restrict the manager's cache and reconciliation to a single namespace, paired with a new config/namespaced Kustomize profile and namespace-local Role/RoleBinding manifests. This is the first concrete step toward least-privilege deployment for platform teams who don't want a single operator instance holding cluster-wide reconciliation rights over every application namespace.
• Consolidated CI pipeline. Build, test, and coverage automation now run as a single workflow, while Build and Tests remain independently visible status checks. Branch protection required-checks continue to work unchanged.
• Stronger release and supply-chain posture. Protected branch/tag rules, CodeQL scanning, grouped Dependabot updates, and guarded image publishing are now part of the standard release process.

Added

• Namespace-scoped operator mode via WATCH_NAMESPACE, restricting manager cache and reconciliation scope to a single namespace.
• config/namespaced Kustomize profile for least-privilege, namespace-scoped deployments.
• Namespace-local manager Role and RoleBinding manifests for scoped runtime permissions.
• Unit test coverage for namespace resolution and manager options.
• Documentation covering namespace-scoped operation, security boundaries, GitOps drift considerations, and cluster-scoped CRD requirements.

Changed

• Consolidated build, test, and coverage automation into a single CI workflow, preserving independently visible Build and Tests jobs.
• Updated README status badges to reflect the consolidated CI workflow.
• Strengthened repository release and publishing posture with protected branch/tag rules, CodeQL, Dependabot grouping, and guarded image publishing.
• Updated project documentation and roadmap to clarify namespace-scoped operation and the direction for future cross-namespace platform-team control.

Security

• Bumped golang.org/x/net from 0.49.0 to 0.55.0.
• Bumped grouped GitHub Actions dependencies via Dependabot.
• Added CodeQL scanning for continuous static security analysis.

Fixed

• Reduced CI required-check drift by keeping Build, Tests, and Lint status-check names stable through the workflow consolidation.
• Verified protected-branch required-check behavior after CI consolidation.

Upgrading from v1.0.0

No breaking API changes in this release. WATCH_NAMESPACE is opt-in. If unset, the manager continues to watch cluster-wide as before. Existing cluster-scoped deployments require no changes; adopt config/namespaced when you're ready to scope the operator down.

Pinned install, cluster-scoped unchanged behavior:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.1.0/deploy/install.yaml

Pinned install, namespace-scoped:

kubectl apply -k https://github.com/k8s-operators-devops/app-maintenance-operator/config/namespaced?ref=v1.1.0

Operational Notes

• The v1.1.0 image publishes as a multi-architecture GHCR image for linux/amd64 and linux/arm64.
• The unknown/unknown entries visible in the GHCR package UI are BuildKit/SLSA provenance attestations, not additional runnable image architectures.
• Always pin to the immutable tag for production installs; do not track :latest.

Known Limitations

• CRDs remain cluster-scoped Kubernetes resources, so installing the API still requires cluster-level permission regardless of manager scope.
• Namespace-scoped mode restricts the manager's runtime scope but does not yet provide central platform-team control across multiple application namespaces. See Roadmap.
• Only AWS ALB fixed-response mode is currently supported.
• Fixed-response HTML remains limited to 1024 bytes by ALB fixed-response constraints.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

v1.0.0

First stable release of app-maintenance-operator, a Kubernetes operator for application maintenance mode on AWS Load Balancer Controller ALB IngressGroups.

This is application traffic maintenance, not node maintenance. The operator creates a temporary higher-priority ALB IngressGroup overlay and leaves the original application Ingress unchanged.

Install

Pinned install from this release tag:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.0.0/deploy/install.yaml

Or download the attached release asset:

kubectl apply -f app-maintenance-operator-v1.0.0-install.yaml

Container Image

ghcr.io/k8s-operators-devops/app-maintenance-operator:v1.0.0

The release workflow also publishes the latest convenience tag.

Runtime Names

• Namespace: alb-maintenance-operator
• Deployment: alb-maintenance
• ServiceAccount: alb-maintenance
• Metrics Service: alb-maintenance-metrics

The operator pod includes:

• app.kubernetes.io/version: v1.0.0
• OPERATOR_VERSION=v1.0.0

API Highlights

• spec.maintenanceMode is the master switch.
• maintenanceMode: false or omitted disables maintenance and ignores schedule.
• maintenanceMode: true enables maintenance immediately unless schedule narrows the window.
• schedule.start and schedule.end use RFC3339 timestamps, including Z or explicit timezone offsets.

Attached Assets

• app-maintenance-operator-v1.0.0-install.yaml - complete install manifest
• maintenance-enable.yaml - sample immediate maintenance CR
• maintenance-disable.yaml - sample disable CR
• maintenance-scheduled.yaml - sample scheduled maintenance CR
• SHA256SUMS - checksums for attached YAML assets

Verify

kubectl get pods -n alb-maintenance-operator
kubectl logs -n alb-maintenance-operator deployment/alb-maintenance -c manager
kubectl get crd maintenances.k8smaintenance.io

Notes

The target Ingress must be AWS ALB-managed and must define alb.ingress.kubernetes.io/group.name. The Maintenance resource must be created in the same namespace as the target application Ingress.