v0.5.0

v0.5.0 introduces a number of enhancements and bug fixes to ValkeyCluster - thank you to everyone who contributed to this release!

Breaking

ValkeyCluster TLS moved under spec.networking

spec.tls is removed. TLS configuration now lives at spec.networking.tls, and certificate.secretName is required when TLS is set. This is phase 1a of the spec.networking tree (#318).

# before
spec:
  tls:
    certificate:
      secretName: valkey-tls

# after
spec:
  networking:
    tls:
      certificate:
        secretName: valkey-tls

We immediately dropped support for spec.tls, so upgrading CRDs against a live cluster will cause it to downgrade to plaintext (no TLS). You can perform these steps to avoid that:

1. Stop the operator running 0.4
2. Deploy the 0.5 CRDs
3. Deploy the migrated ValkeyCluster CRs (from spec.tls to spec.networking.tls)
4. Start operator running 0.5

We have done this change to align with bucketing all networking related configs under one field networking, of which more features will be added in the future.

Features

Zone scheduling axis (#340)

• scheduling.zone.spread mirrors scheduling.node.spread on topology.kubernetes.io/zone, with shard,
  primaries, and pods dimensions
• All three render as topology spread constraints, so a shard with more members than there are zones balances across
  them rather than becoming unschedulable
• Admission rejects combinations that would emit duplicate constraints

Zone pinning (#344)

• scheduling.zone.pinning.zones assigns every pod a fixed zone by round-robin: zones[(shardIndex + nodeIndex) % len(zones)]
• Adding shards or replicas never moves an existing pod
• The list is immutable while set
• Read the persistence warning in the docs before enabling it on a cluster with persistent volumes

Live ACL changes (#319)

• user and password changes now apply to running nodes via ACL LOAD, with no pod restart
• A new ACLApplied condition on ValkeyNode reports when the change is live on the server
• Because a Valkey user can hold several passwords at once, a credential rotation can be done with no auth gap: add the new password, wait for ACLApplied, move clients across, then drop the old one

Staged pod template rolls (#338)

• the ValkeyCluster controller now owns the authorized pod template via ValkeyNode.spec.workloadRevision
• Template changes that previously restarted every pod at once (including operator upgrades) now roll one node at a time, replicas first, with failover ahead of a primary
• A new WorkloadRollPending condition marks a node waiting its turn

Exporter arguments (#345)

• exporter.args passes command-line flags to the metrics sidecar
• The connection settings the operator previously passed as flags are now environment variables, so anything you set in args takes precedence

Fixes

Cluster recovers from a simultaneous restart of every node (#333)

• When all pods restarted at once and every IP changed, each node's persisted nodes.conf pointed at dead addresses with no surviving gossip path, and the cluster stayed Reconciling until someone ran CLUSTER MEET by hand
• The operator now detects peers whose node ID belongs to a live member at a different address and re-MEETs them, emitting a StaleAddressesHealed event
• This also covers the case where an operator upgrade itself restarts every pod

Dual-channel replication (#359)

• The _replication system user was missing +sync
• With dual-channel-replication-enabled yes, the RDB side channel issues a legacy SYNC, which failed with -NOPERM and left the replica retrying the handshake indefinitely

valkey_operator_build_info labels (#336)

• Published images reported empty version and branch

Operator ACL (#341)

• The _operator user is granted config|get so applied configuration can be read back and audited

Logging (#330)

• "getting system users secret" dropped from info to debug

Known issues

ACLApplied does not signal permission-only changes (#369)

• The condition compares the user set and password hashes, so adding or removing a user or password moves it through PendingPropagation back to True
• A change to a user's enabled flag or permissions still takes effect on the server, but the condition does not report a transient state for it, so it is not a signal to wait on for those fields

What's Changed

• fix: Set debug level for "getting system users secret" output by @nantiferov in #330
• fix: set version/branch labels in valkey_operator_build_info metric by @bjosv in #336
• test: add e2e test for operator permissions by @tkarger in #245
• feat: Add zone scheduling axis by @jdheyburn in #340
• feat(acl): allow config|get for auditability by @tkarger in #341
• fixed e2e test failing on main branch as config get is allowed by operator users by @sandeepkunusoth in #351
• fix: grant _replication user +sync for dual-channel replication by @itsyuvalcohen in #359
• feat: Add args configuration support to exporter by @nantiferov in #345
• refactor(api)!: move ValkeyCluster TLS under spec.networking by @daanvinken in #339
• feat: stage pod template rolls via Spec.WorkloadRevision by @daanvinken in #338
• fix: re-introduce cluster members whose addresses changed after a full restart by @matka12 in #333
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #348
• chore(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #350
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #349
• chore(deps): bump docker/login-action from 4.2.0 to 4.6.0 by @dependabot[bot] in #346
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #347
• test(e2e): add shutdown-on-sigterm failover test by @Sagar2366 in #295
• feat: apply ACL changes live without rolling pods by @melancholictheory in #319
• feat: add scheduling.zone.pinning by @jdheyburn in #344
• chore: Auto update and freeze pre-commit version by @nantiferov in #370

New Contributors

• @nantiferov made their first contribution in #330
• @itsyuvalcohen made their first contribution in #359

Full Changelog: v0.4.0...v0.5.0