Skip to content

v1.1.0

Choose a tag to compare

View all tags
@sk9-devops sk9-devops released this 22 Jul 02:02
· 10 commits to main since this release
v1.1.0
6f2dd7a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.1.0

This release focuses on a real security and operability upgrade: namespace-scoped operator mode alongside a leaner CI pipeline and a stronger release/publishing posture. If you're running this operator in a shared or multi-tenant cluster, this is the release that lets you narrow its blast radius.

Highlights

  • Namespace-scoped operator mode. Set WATCH_NAMESPACE to restrict the manager's cache and reconciliation to a single namespace, paired with a new config/namespaced Kustomize profile and namespace-local Role/RoleBinding manifests. This is the first concrete step toward least-privilege deployment for platform teams who don't want a single operator instance holding cluster-wide reconciliation rights over every application namespace.
  • Consolidated CI pipeline. Build, test, and coverage automation now run as a single workflow, while Build and Tests remain independently visible status checks. Branch protection required-checks continue to work unchanged.
  • Stronger release and supply-chain posture. Protected branch/tag rules, CodeQL scanning, grouped Dependabot updates, and guarded image publishing are now part of the standard release process.

Added

  • Namespace-scoped operator mode via WATCH_NAMESPACE, restricting manager cache and reconciliation scope to a single namespace.
  • config/namespaced Kustomize profile for least-privilege, namespace-scoped deployments.
  • Namespace-local manager Role and RoleBinding manifests for scoped runtime permissions.
  • Unit test coverage for namespace resolution and manager options.
  • Documentation covering namespace-scoped operation, security boundaries, GitOps drift considerations, and cluster-scoped CRD requirements.

Changed

  • Consolidated build, test, and coverage automation into a single CI workflow, preserving independently visible Build and Tests jobs.
  • Updated README status badges to reflect the consolidated CI workflow.
  • Strengthened repository release and publishing posture with protected branch/tag rules, CodeQL, Dependabot grouping, and guarded image publishing.
  • Updated project documentation and roadmap to clarify namespace-scoped operation and the direction for future cross-namespace platform-team control.

Security

  • Bumped golang.org/x/net from 0.49.0 to 0.55.0.
  • Bumped grouped GitHub Actions dependencies via Dependabot.
  • Added CodeQL scanning for continuous static security analysis.

Fixed

  • Reduced CI required-check drift by keeping Build, Tests, and Lint status-check names stable through the workflow consolidation.
  • Verified protected-branch required-check behavior after CI consolidation.

Upgrading from v1.0.0

No breaking API changes in this release. WATCH_NAMESPACE is opt-in. If unset, the manager continues to watch cluster-wide as before. Existing cluster-scoped deployments require no changes; adopt config/namespaced when you're ready to scope the operator down.

Pinned install, cluster-scoped unchanged behavior:

kubectl apply -f https://raw.githubusercontent.com/k8s-operators-devops/app-maintenance-operator/v1.1.0/deploy/install.yaml

Pinned install, namespace-scoped:

kubectl apply -k https://github.com/k8s-operators-devops/app-maintenance-operator/config/namespaced?ref=v1.1.0

Operational Notes

  • The v1.1.0 image publishes as a multi-architecture GHCR image for linux/amd64 and linux/arm64.
  • The unknown/unknown entries visible in the GHCR package UI are BuildKit/SLSA provenance attestations, not additional runnable image architectures.
  • Always pin to the immutable tag for production installs; do not track :latest.

Known Limitations

  • CRDs remain cluster-scoped Kubernetes resources, so installing the API still requires cluster-level permission regardless of manager scope.
  • Namespace-scoped mode restricts the manager's runtime scope but does not yet provide central platform-team control across multiple application namespaces. See Roadmap.
  • Only AWS ALB fixed-response mode is currently supported.
  • Fixed-response HTML remains limited to 1024 bytes by ALB fixed-response constraints.

Full Changelog: v1.0.0...v1.1.0

Assets 2
Loading