Repository navigation
v0.12.0
·
28 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
Upgrade notes
- Readiness now waits for all required watches to initialize and clears during relists and shutdown. Individual policy failures remain separate from process readiness; allow time for initial synchronization during rollout.
- Candidate plans now honor
preserve_undeclared_grantsbefore computing approval effects. Review replanned candidates after upgrading: obsolete revokes disappear, and changed effects use the existing revalidation and approval rules. - Consecutive grantor revokes share role blocks. SQL hashes and statement counts may change; semantic approval identity does not change merely because SQL formatting changes.
- OTLP exports include per-process instance identity and standard SDK metadata. Review backend resource-label mapping and aggregation across replicas. Existing metric names and millisecond units remain unchanged.
Added
- OTLP metrics and logs share a configurable resource identity, including a default process instance ID. Standard resource environment variables and an optional Helm Downward API example support deployment attribution. (#224)
- Controller readiness waits for required watch synchronization and clears during relists and shutdown. Watch synchronization, watch events, and controller progress have bounded telemetry labels. (#225)
- Optional policy-state monitoring examples include alert rules, Collector configuration, and operational queries. (#226)
Fixed
- Candidate plans apply the same undeclared object-grant preservation filter as normal reconciliation before computing review SQL and approval effects. Explicit absence assertions, default privileges, and memberships retain their existing semantics. (#230)
- SQL rendering and execution combine consecutive grantor-specific revocations into shared role blocks, preserving change order and restoring the configured execution role. Full SQL, redacted previews, and CLI/operator execution use the same renderer. (#230)
- Authority preflight recognizes PostgreSQL 16+
createrole_self_grant=inheritwhen a non-superuser creates a default-privilege owner in the same plan. Later default revokes account for planned roles, automatic inherited memberships, and membership removals, additions, and inheritance downgrades.