0.9.0

Added

• Bounded, request-driven PostgreSQL memberships in Kubernetes. EphemeralAccessPolicy defines a requestable bundle; immutable EphemeralAccessRequest resources resolve, activate, expire, and revoke one grant without touching the durable PostgresPolicy. approval.mode: Required is only a real approval boundary under admission enforcement — approving and otherwise managing a request are the same write to ephemeralaccessrequests/status, so RBAC alone cannot separate them. Deploy the CI-tested Kyverno profile in k8s/security/, or front the API with a trusted broker, before relying on it: securing ephemeral access sets out the three trust postures. (#158)
• A generated Helm chart reference documenting every value. Previously 14 of the 21 chart values were undocumented, including serviceAccount.annotations (required for GKE Workload Identity) and the EPHEMERAL_ACCESS_MAXIMUM_DURATION / EPHEMERAL_ACCESS_MAX_PENDING_TTL ceilings. Generated by helm-docs from values.yaml; CI fails if it drifts.
• Approving a plan that can never execute is now reported. A policy in spec.mode: plan never consults spec.approval, so annotating its plan is accepted and then does nothing — indistinguishable from a stalled operator. The policy now reports an ApprovalIgnored condition and a warning Event, pointing at mode: apply with approval: manual, which is the combination that gates an apply.
• Namespace-scoped operator deployments. The chart value operator.watchNamespace sets WATCH_NAMESPACE, which scopes every operator watch and conflict-detection list to one namespace, and switches the chart from ClusterRole/ClusterRoleBinding to a namespaced Role/RoleBinding. Unset, the operator remains cluster-scoped as before. (#162)

Deprecated

• Omitting spec.approval on a PostgresPolicy. Behaviour is unchanged — the value is still inferred from spec.mode (apply → auto, plan → manual) — but the inference hides whether a human gates SQL execution behind an unrelated field, and spec.mode itself defaults to apply. Policies relying on it report an ApprovalUnset condition and increment pgroles.deprecated.approval_unset. Migration: write down the value you already get. A future release will reject the omission. (#73)

Removed

• PostgresPolicy status fields planned_sql, planned_sql_truncated, and last_reconcile_time. Superseded by PostgresPolicyPlan in 0.5.0, but still written on every reconcile with pending changes. Migration: read plan SQL from the plan the policy points at — kubectl get pgplan $(kubectl get pgr <policy> -o jsonpath='{.status.current_plan_ref.name}') -o jsonpath='{.status.sqlInline}' — falling back to the gzipped ConfigMap in status.sqlRef, or a truncated status.sqlInline for plans too large for either. Replace last_reconcile_time with status.last_successful_reconcile_time. (#73)
• OperatorContext::new, in the pgroles-operator crate. It could not supply the shared request index the reconcilers now read, so a context built through it produced lookups that no watch ever fed. Migration: use OperatorContext::new_with_runtime_config, passing the RequestIndex fed by the request controller's watch and the optional watch namespace. (#162)

Fixed

• The operator no longer holds PostgreSQL connections open against every database it manages. Connection pools are cached for the operator's lifetime and inherited sqlx's 10-minute idle timeout, which never elapsed against the 5-minute default requeue interval — each reconcile re-touched the pool first, and sqlx's FIFO idle queue spread those touches across every pooled connection. A pool that once peaked at N concurrent connections therefore occupied N backends indefinitely, per database, whether or not anything was reconciling. Pools now drain to zero between reconciles.

What's Changed

• Add Kubernetes-native ephemeral PostgreSQL access by @hardbyte in #160
• feat!: remove deprecated PostgresPolicy status fields by @hardbyte in #164
• docs: operator-first documentation audit and restructure by @hardbyte in #167
• ci: validate doc manifests against generated CRD schemas, document chart values by @hardbyte in #168
• Scale ephemeral access reconciliation by @hardbyte in #165
• chore: prepare the 0.9.0 release by @hardbyte in #169

Full Changelog: v0.8.0...v0.9.0